vanilla android emulator spams rtsp in wireshark

Question

I'm dealing with some pretty insidious hacks on both my phone and computer(fedora 41). A lot of it has to do with Google, but more than that, I'm still a little lost. I plugged my compromised Android into my usb port and probably compromised my computer more than it already was. When setting up a simple blank activity in the emulator with wireshark running, I'm seeing A BUNCH of RTSP packets signifying consistent streaming. I'm guessing it to be real time sound data. The microphone icon is on on the toolbar of my desktop too, see attachment. Attached is a screen shot of the RTSP spam from wireshark. Is this normal behavior? This doesn't seem correct to me, but as I don't have a known safe baseline to compare I can't determine "appropriate" behavior.

To clarify, is this expected default behavior, and if so, what is it? Why does Android need to open a persistent RTSP channel and seemingly fire EVERYTHING over the wire?

Answer 1

This is not an answer but i wanted to share that it also happens with me and this is normal behavior for sure ( it happens in every PC ), i am running kubuntu on my desktop. Noticed this issue on fedora, Debian, Pop OS, Ubuntu etc... When i start my emulator it starts using the microphone