High cpu usage when use it through root mode, and libcapd.so process doesn't be killed

[zyf0330]

When select all interfaces to capture, multiple libcapd.so processes are running.
And after stop capture, these processes keep running. I must kill them manually.

What info do you need

[emanuele-f]

Only 1 libpcapd process should be running, which is stopped when you stop the capture in PCAPdroid.

Please provide the following information:

• build info, from the PCAPdroid About page, info icon on the top
• app and root daemon log, from the PCAPdroid Log view in the left drawer

[zyf0330]

• build info

Build type: playstore
Build version: 1.7.2
Build date: 2024-04-21 00:10:27
Current date: 2024-05-06 17:04:33
Device: Sony XQ-CT72 (rooted)
OS version: Android 14 (SDK 34)


DumpMode: NONE
FullPayload: true
TLSDecryption: false
TLSSetupOk: false
CAInstallSkipped: false
BlockQuic: NEVER
RootCapture: false
Socks5: false
BlockPrivateDns: true
CaptureInterface: wlan1
MalwareDetection: false
Firewall: false
PCAPNG: false
BlockNewApps: false
TargetApps: [com.xingin.xhs]
IpMode: BOTH
Trailer: false
StartAtBoot: false
PrivateDnsMode: opportunistic
MitmBatteryOptimized: false

• app log

[I] 06/May/2024 16:31:28 - [PCAPdroid] Build type: PLAYSTORE
[I] 06/May/2024 17:05:39 - [CaptureService] Private DNS: opportunistic
[I] 06/May/2024 17:05:39 - [CaptureService] Private DNS: opportunistic
[I] 06/May/2024 17:05:39 - [MatchList] The UID 10203 mapping has changed from com.google.android.gsf to com.google.android.gms
[I] 06/May/2024 17:05:39 - [MatchList] Migration completed
[I] 06/May/2024 17:05:40 - Connected to pcapd (pid=20855)
[I] 06/May/2024 17:05:40 - Starting packet loop
[I] 06/May/2024 17:06:11 - stopPacketLoop called
[I] 06/May/2024 17:06:11 - Stopped packet loop
[I] 06/May/2024 17:06:11 - Host LRU cache size: 0
[I] 06/May/2024 17:06:11 - Discarded fragments: 0
[I] 06/May/2024 17:06:11 - [CaptureService] Connection update thread exit requested
[I] 06/May/2024 17:06:23 - [CaptureService] Private DNS: opportunistic
[I] 06/May/2024 17:06:23 - [CaptureService] Private DNS: opportunistic
[I] 06/May/2024 17:06:23 - Killing old pcapd with pid 20862
[I] 06/May/2024 17:06:24 - Connected to pcapd (pid=23015)
[I] 06/May/2024 17:06:24 - Starting packet loop

• root log

[I] 06/May/2024 17:06:24 - Connected to client
[D] 06/May/2024 17:06:24 - Using BPF: ip or ip6
[I] 06/May/2024 17:06:24 - Could not get interface "any" IP[19]: No such device
[I] 06/May/2024 17:06:24 - Could not get interface "any" IPv6[19]: No such device
[D] 06/May/2024 17:06:24 - any(0): datalink=SLL2(276)

It seems that kill doesn't work, and by the way the pid number to kill is correct.
Everytime start to capture, a new process is started. When stop, it doesn't be succeeded to kill.

[emanuele-f]

This is weird, it could be something related to Magisk, which Magisk version are you using? Can you try granting permanent root to PCAPdroid, to see if this is linked to the root permission prompt?

Another check you can do: select "any" as the root capture interface. It may be because no packets are captured on the wlan1 interface

In case you are able to debug manually, this is the relevant function: https://github.com/emanuele-f/PCAPdroid/blob/master/app/src/main/jni/core/capture_libpcap.c#L69C5-L69C18

[zyf0330]

I use Magisk fork version Alpha, and has granted permanent root. There is no prompt.
And I tried "any" too.

I don't know too much c and Android native development, so debug is hard to me.

[emanuele-f]

When this happens, do you see any connections in PCAPdroid? I suspect the capture gets stuck reading the next packet. What rom are you using?

[zyf0330]

I didn't see any connections.

I use Sony Xperia 1 iv with raw ROM.

[emanuele-f]

This should be fixed in 8610e6a . @zyf0330 can you confirm this is fixed in the the latest PCAPdroid version (1.7.5)?

[zyf0330]

Ok, after try, I will reply you. Maybe a long time.