Are LLMNR AAAA wpad and A wpad entries in Wireshark normal or is it a network issue?

Question

Are LLMNR AAAA wpad and A wpad entries in Wireshark normal or is it a network issue?

Is it normal Windows behavior or is it malware or something else on the machine?

Wireshark plain text output:

    Frame 3: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59762 (59762), Dst Port: 63065 (63065), Seq: 0, Len: 0

No.     Time           Source                Destination           Protocol Length Info
      4 0.097359000    192.168.0.40          192.168.0.255         NBNS     92     Name query NB WPAD<00>

Frame 4: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service

No.     Time           Source                Destination           Protocol Length Info
      5 0.109102000    192.168.0.56          192.168.0.40          TCP      58     59763 > 9268 [SYN] Seq=0 Win=1024 Len=0 MSS=1460

Frame 5: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface 0
Ethernet II, Src: HewlettP_57:cf:35 (c8:cb:b8:57:cf:35), Dst: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5)
Internet Protocol Version 4, Src: 192.168.0.56 (192.168.0.56), Dst: 192.168.0.40 (192.168.0.40)
Transmission Control Protocol, Src Port: 59763 (59763), Dst Port: 9268 (9268), Seq: 0, Len: 0

No.     Time           Source                Destination           Protocol Length Info
      6 0.109763000    fe80::e9c8:ef0:d851:4841 ff02::1:3             LLMNR    84     Standard query 0x30c2  AAAA wpad

Frame 6: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 57886 (57886), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      7 0.109777000    fe80::e9c8:ef0:d851:4841 ff02::1:3             LLMNR    84     Standard query 0x3db1  A wpad

Frame 7: 84 bytes on wire (672 bits), 84 bytes captured (672 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv6mcast_00:01:00:03 (33:33:00:01:00:03)
Internet Protocol Version 6, Src: fe80::e9c8:ef0:d851:4841 (fe80::e9c8:ef0:d851:4841), Dst: ff02::1:3 (ff02::1:3)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      8 0.109896000    192.168.0.40          224.0.0.252           LLMNR    64     Standard query 0x3db1  A wpad

Frame 8: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Ethernet II, Src: d8:50:e6:d5:19:d5 (d8:50:e6:d5:19:d5), Dst: IPv4mcast_00:00:fc (01:00:5e:00:00:fc)
Internet Protocol Version 4, Src: 192.168.0.40 (192.168.0.40), Dst: 224.0.0.252 (224.0.0.252)
User Datagram Protocol, Src Port: 50687 (50687), Dst Port: llmnr (5355)
Link-local Multicast Name Resolution (query)

No.     Time           Source                Destination           Protocol Length Info
      9 0.110017000    192.168.0.40          224.0.0.252           LLMNR    64     Standard query 0x30c2  AAAA wpad

Answer 1

This is "normal" traffic, in that WPAD is a browser looking for a proxy via an auto-configuration script.

This is a known security vulnerability, though - it is very easy for a Man-In-The-Middle attack to spoof an auto-configuration script, and become your proxy.

I'd Google WPAD, and then either configure it through DHCP, or turn it off completely and set your proxy through other means.

Hope This Helps!