Wireshark 中的 LLMNR AAAA wpad 和 A wpad 条目是否正常，还是网络问题？
这是正常的 Windows 行为还是恶意软件或机器上的其他东西？
Wireshark 纯文本输出：
Frame 3: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59762 (59762), Dst Port: 63065 (63065), Seq: 0, Len: 0
No. Time Source Destination Protocol Length Info
4 0.097359000 192.168.0.40 192.168.0.255 NBNS 92 Name query NB WPAD<00>
Frame 4: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
5 0.109102000 192.168.0.56 192.168.0.40 TCP 58 59763 > 9268 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
Frame 5: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59763 (59763), Dst Port: 9268 (9268), Seq: 0, Len: 0
No. Time Source Destination Protocol Length Info
6 0.109763000 fe80::e9c8:ef0:d851:4841 ff02::1:3 LLMNR 84 Standard query 0x30c2 AAAA wpad
Frame 6: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 57886 (57886), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
7 0.109777000 fe80::e9c8:ef0:d851:4841 ff02::1:3 LLMNR 84 Standard query 0x3db1 A wpad
Frame 7: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
8 0.109896000 192.168.0.40 224.0.0.252 LLMNR 64 Standard query 0x3db1 A wpad
Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv4mcast_00:00:fc (01:00:5e:00:00:fc)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 224.0.0.252 (224.0.0.252)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
9 0.110017000 192.168.0.40 224.0.0.252 LLMNR 64 Standard query 0x30c2 AAAA wpad
答案1
这是“正常”流量，因为 WPAD 是一个通过自动配置脚本寻找代理的浏览器。
但这是一个已知的安全漏洞 - 中间人攻击很容易欺骗自动配置脚本，并成为您的代理。
我会用 Google 搜索 WPAD，然后通过 DHCP 进行配置，或者完全关闭它并通过其他方式设置你的代理。
希望这可以帮助！