Mobile data is downloaded by system

[TheSchmidt]

I have tried the LineageOS 15.1 build (lineage-15.1-20180915-UNOFFICIAL-ks01ltexx.zip) on my ks01lte and at first I was really enthusiastic about the fact that it worked so great and without problems.

But then I noticed that the phone kept downloading data constantly via the mobile network, even though it was registered into a WIFI network. According to the stats in the settings it was the Android OS itself (combining several activities) that downloaded about 100 MB/day!
I then tried the 16.0 build (lineage-16.0-20181006-UNOFFICIAL-ks01ltexx.zip), but that did not seem to change anything.

Since I had to stop the phone eating up mobile data, I had to revert to the last official 13.0 build for the device, which had worked without issues for the last months. Just without any security updates...

Is this a known issue for this build?

I tried changing the developer settings, but this did not seem to have any effect. Any help is appreciated. I'd be willing to provide additional information.

[Immortalin]

Have you tried running a network logger? E.g. Wireshark

[SubZero7748]

This might help (if you can temporary set selinux to permissive (using setenforce 0 in shell), or use los16.0 version, as it's using selinux permissive): https://play.google.com/store/apps/details?id=com.googlecode.networklog

[TheSchmidt]

Have you tried running a network logger? E.g. Wireshark

Is it possible to run wireshark on the device to monitor the traffic it sends? Otherwise it would be necessary to hack into the connection between phone and mobile network, and I do not know how to do that...

[TheSchmidt]

This might help (if you can temporary set selinux to permissive (using setenforce 0 in shell), or use los16.0 version, as it's using selinux permissive)

Well, I tried LOS16.0 and that did not change the amount of data downloaded.
Do you have a theory on why selinux should be connected to the problem?

[SubZero7748]

This app functions a lot like wireshark, but it won't work properly with selinux enforcing (los15.1 for ks01ltexx), but los 16.0 for ks01ltexx has selinux permissive, therefore you can try out the app (it works great with selinux permissive) on the los16.0 buil to try to narrow down the problem (requires root): https://play.google.com/store/apps/details?id=com.googlecode.networklog

I'm not saying selinux has to do with the issue itself.
Sorry if i was unclear about this in my previous post