I installed Packet Capture on my android and did some scans because this topic. So, I saw Dalvik/2.1.0 in a log of WhatsApp on port 80. Since Dalvik/2.1.0 should be prior that Android 5, is it normal I saw this on my LG X Power that has Android 6.0.1?
I wouldn't worry about the Dalvik version number
Searching on Dalvik/2.1.0 leads to http://www.webapps-online.com/online-tools/user-agent-strings/dv/plugin294709/dalvik which lists the user agent string used by older Android devices.
Note that the numbering went up from Dalvik/1.6.0 on Android 4.4.4 to Dalvik/2.1.0 on Android 5.0 and up. Another posting at https://github.com/allinurl/goaccess/issues/667 indicates that at least through Android 7.1.1 still used the 2.1.0 version.
From this StackOverflow post on Browser sending “Dalvik†as user agent it looks like the VM is sending the user agent string.
Most likely, the version number changed at Android 5.0 Lollipop when ART became the default runtime.
Q & A