Eu tenho perguntas sobre o resultado do meu wireshark a partir de hoje.
Normalmente, é a conduta do Windows, malware ou outra coisa na máquina?
saída de texto sem formatação wireshark:
Frame 3: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59762 (59762), Dst Port: 63065 (63065), Seq: 0, Len: 0
No. Time Source Destination Protocol Length Info
4 0.097359000 192.168.0.40 192.168.0.255 NBNS 92 Name query NB WPAD<00>
Frame 4: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
5 0.109102000 192.168.0.56 192.168.0.40 TCP 58 59763 > 9268 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
Frame 5: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59763 (59763), Dst Port: 9268 (9268), Seq: 0, Len: 0
No. Time Source Destination Protocol Length Info
6 0.109763000 fe80::e9c8:ef0:d851:4841 ff02::1:3 LLMNR 84 Standard query 0x30c2 AAAA wpad
Frame 6: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 57886 (57886), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
7 0.109777000 fe80::e9c8:ef0:d851:4841 ff02::1:3 LLMNR 84 Standard query 0x3db1 A wpad
Frame 7: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
8 0.109896000 192.168.0.40 224.0.0.252 LLMNR 64 Standard query 0x3db1 A wpad
Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv4mcast_00:00:fc (01:00:5e:00:00:fc)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 224.0.0.252 (224.0.0.252)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)
No. Time Source Destination Protocol Length Info
9 0.110017000 192.168.0.40 224.0.0.252 LLMNR 64 Standard query 0x30c2 AAAA wpad
Esse é o tráfego "normal", em que o WPAD é um navegador que procura um proxy por meio de um script de configuração automática.
Esta é uma vulnerabilidade de segurança conhecida - é muito fácil para um ataque Man-In-The-Middle falsificar um script de configuração automática e se tornar seu proxy.
Eu gostaria de usar o Google WPAD e configurá-lo por meio do DHCP ou desativá-lo completamente e definir seu proxy por outros meios.
Espero que isso ajude!