Hi @madbrain thanks for your post above. Out of curiosity I did a packet capture of traffic to-from the Envoy-R for a fifteen minute period. Within that period there was only one TLS session with a host 3.211.77.50 and a substantial transfer of data.
There were also a couple of brief http exchanges with very little payload.
0000 7c ff 4d eb e2 e6 00 1d c0 62 3a 6a 08 00 45 00 |.M…b:j…E.
0010 00 85 a8 89 40 00 40 06 0b 69 c0 a8 07 66 34 d9 …@.@…i…f4.
0020 89 99 dc dc 00 50 0f c4 61 79 0b c5 26 1b 50 18 …P…ay…&.P.
0030 01 6d 54 b8 00 00 48 45 41 44 20 2f 31 32 31 34 .mT…HEAD /1214
0040 31 35 30 32 37 36 37 34 20 48 54 54 50 2f 31 2e 15027674 HTTP/1.
0050 31 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 1…Accept: /…
0060 48 6f 73 74 3a 20 70 69 6e 67 2e 65 6e 70 68 61 Host: ping.enpha
0070 73 65 65 6e 65 72 67 79 2e 63 6f 6d 0d 0a 43 6f seenergy.com…Co
0080 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d nnection: close.
0090 0a 0d 0a …