Wireshark 中的 LLMNR AAAA wpad 和 A wpad 条目是否正常,还是网络问题?

Wireshark 中的 LLMNR AAAA wpad 和 A wpad 条目是否正常,还是网络问题?

Wireshark 中的 LLMNR AAAA wpad 和 A wpad 条目是否正常,还是网络问题?

这是正常的 Windows 行为还是恶意软件或机器上的其他东西?

Wireshark 纯文本输出:

    Frame 3: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59762 (59762), Dst Port: 63065 (63065), Seq: 0, Len: 0

No.     Time           Source                Destination           Protocol Length Info
      4 0.097359000    192.168.0.40          192.168.0.255         NBNS     92     Name query NB WPAD<00>

Frame 4: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service

No.     Time           Source                Destination           Protocol Length Info
      5 0.109102000    192.168.0.56          192.168.0.40          TCP      58     59763 > 9268 [SYN] Seq=0 Win=1024 Len=0 MSS=1460

Frame 5: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59763 (59763), Dst Port: 9268 (9268), Seq: 0, Len: 0

No.     Time           Source                Destination           Protocol Length Info
      6 0.109763000    fe80::e9c8:ef0:d851:4841 ff02::1:3             LLMNR    84     Standard query 0x30c2  AAAA wpad

Frame 6: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 57886 (57886), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      7 0.109777000    fe80::e9c8:ef0:d851:4841 ff02::1:3             LLMNR    84     Standard query 0x3db1  A wpad

Frame 7: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      8 0.109896000    192.168.0.40          224.0.0.252           LLMNR    64     Standard query 0x3db1  A wpad

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv4mcast_00:00:fc (01:00:5e:00:00:fc)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 224.0.0.252 (224.0.0.252)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      9 0.110017000    192.168.0.40          224.0.0.252           LLMNR    64     Standard query 0x30c2  AAAA wpad

答案1

这是“正常”流量,因为 WPAD 是一个通过自动配置脚本寻找代理的浏览器。

但这是一个已知的安全漏洞 - 中间人攻击很容易欺骗自动配置脚本,并成为您的代理。

我会用 Google 搜索 WPAD,然后通过 DHCP 进行配置,或者完全关闭它并通过其他方式设置你的代理。

希望这可以帮助!

相关内容