长时间运行后，CPU占用异常

[iceQookie]

在运行十几个小时后，设备出现高CPU占用，异常流量，疑似出现回环（sim卡无流量开销）。
top显示CPU占用400+
目前没有更多设备进行测试
无法确定是否是特例
但并非第一次在此设备上出现该异常

[iceQookie]

短时间获取不到日志，需要时间来获取
更新：怀疑是追加HTTP代理的问题，关闭后已连续运行五个小时无异常

[houweim]

同样碰到这个问题

[ryqryq]

同样用了几个小时后，会出现cpu占用异常。这个问题在1.10.*版本均会出现，老版本没有。
异常时日志里会大量出现以下内容。

05-26 05:16:19.859 |/GoLog
from udp:127.0.0.1:45677 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.858 l/GoLog
from udp:127.0.0.1:57108 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.858 l/GoLog
from udp:127.0.0.1:33754 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.857 |/GoLog
from udp:127.0.0.1:53886 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.857 |/GoLog
from udp:127.0.0.1:50687 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.856 I/GoLog
from udp:127.0.0.1:36052 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.855 l/GoLog
from udp:127.0.0.1:36389 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.855 l/GoLog
from udp:127.0.0.1:36984 accepted udp:10.10.14.3:32761
[socks -> direct]
05-26 05:16:19.853 1/GoLog
from udp:127.0.0.1:41584 accepted udp:10.10.14.3:32761
[socks -> direct]

[2dust]

from udp:127.0.0.1:41584 accepted udp:10.10.14.3:32761
[socks -> direct]

如果说有大量这个日志，可能是局域网流量都进入了，你可以在设置 VPN 是否绕过局域网 为绕过

[iceQookie]

出现此问题时，VPN 是否绕过局域网 一直是“绕过”。

[2dust]

from udp:127.0.0.1:41584 accepted udp:10.10.14.3:32761
[socks -> direct]

如果说有大量这个日志，可能是局域网流量都进入了，你可以在设置 VPN 是否绕过局域网 为绕过

这个是针对这个日志的可能性。

短时间获取不到日志，需要时间来获取 更新：怀疑是追加HTTP代理的问题，关闭后已连续运行五个小时无异常

追加HTTP代理 有可能让很多 APP 的处理模式改变了吧，是不建议开启这个功能的。

[ryqryq]

版本1.10.5，设置了绕过，软件使用2小时后出现异常占用，日志还是大量的udp socks -> direct。

[patterniha]

tun interface range is 10.10.14.1 with netmask 255.255.255.252.
So 10.10.14.3 is in this range and always route to tun and Does vpn bypass LAN has no effect for this IP.

///

Also, i don't know where this ip come from? You manually set a LAN with 10.10.14.0/24 ip? or you have a router with this range?

///

Anyway, you should change your LAN address or block 10.10.14.3 in routing.

[ryqryq]

tun interface range is 10.10.14.1 with netmask 255.255.255.252. So 10.10.14.3 is in this range and always route to tun and Does vpn bypass LAN has no effect for this IP.

///

but your config bypass this IP correctly and it shouldn't be a problem.

Also, i don't know where this ip come from? You manually set a LAN with 10.10.14.0/24 ip? or you have a router with this range?

没有设置10.10.14.0/24，wifi和数据流量都会出现这个情况。换回1.9.*版本，就没有发生这个问题。

[patterniha]

See your log, Do you see a domain resolve to 10.10.14.3 in your log?

Set loglevel to debug

[patterniha]

Also, your phone is root? As far as I know we can't get CELL-connection information in a non-root android. How did you take this screenshot?

[ryqryq]

Also, your phone is root? As far as I know we can't get CELL-connection information in a non-root android. How did you take this screenshot?

我的小米15pro已经root。
一出现cpu异常占用后，瞬间会出现很多log信息，翻到log底部时已经被大量重复的错误覆盖。
这次的debug错误是这样的：

06-08 20:54:36.708 |/GoLog
[Debug][103507998] transport/internet/udp: dispatch request to: udp:10.10.14.3:32761
06-08 20:54:36.708 |/GoLog
[Debug] [103507998] proxy/socks: send packet to udp:10.10.14.3:32761 with 88 bytes
06-08 20:54:36.708 l/GoLog
[Debug] [103507998] transport/internet/udp: dispatch request to: udp:10.10.14.3:32761
06-08 20:54:36.708 |/GoLog
[Debug] [103507998] proxy/socks: send packet to udp:10.10.14.3:32761 with 88 bytes
06-08 20:54:36.708 |/GoLog
[Debug] [3233821810] transport/internet/udp: dispatch request to: udp:10.10.14.3:32761
06-08 20:54:36.708 |/GoLog
[Debug][3233821810] proxy/socks: send packet to udp:10.10.14.3:32761 with 88 bytes
06-08 20:54:36.708 |/GoLog
[Debug][3233821810] transport/internet/udp: dispatch request to: udp:10.10.14.3:32761

[patterniha]

you can block 10.10.14.3 in routing.
you should add an ip-rule and place it before "geoip:private-direct" rule.

///

this temporary solve your problem, but you need to find which app is sending these requests.

It could be malware or a buggy app.

///

anyway, blocking 10.10.14.3 solve your problem, but you need to find out where these requests are coming from.

copy your log to a txt file and send, maybe some information can be found.

[ryqryq]

you can block 10.10.14.3 in routing. you should add an ip-rule and place it before "geoip:private-direct" rule.

///

this temporary solve your problem, but you need to find which app is sending these requests.

It could be malware or a buggy app.

///

anyway, blocking 10.10.14.3 solve your problem, but you need to find out where these requests are coming from.

copy your log to a txt file and send, maybe some information can be found.

谢谢，我会继续研究尝试是否是由第三方插件引起的。同时看看其他有类似情况的反馈，有何规律可循。
不过在老的版本，这个问题并没有发生过。并且现在的v1.10.*版本，这个异常占用在重新开关节点后，会消失一段时间。异常的UDP包也没有通过wifi或数据流量发送到手机外部网络。
logcat因为保存条数的限制，导致无法看到发生异常前的log信息。

[patterniha]

the old version used 10.10.10.1/30 for tun, so 10.10.14.3 was bypassed(It only causes the network to be occupied)

the new version used 10.10.14.1/30 for tun, so 10.10.14.3 cannot be bypassed, although Xray-core bypasses it later, but make a connection for each request and this takes a little RAM, But thousands of requests will eventually fill up the RAM and cause the app to crash.

As I said, blocking-this-ip solve your problem, but you better find the sender-app.