Skip to content
PCAP Parser

Glossary

DNS tunnelling

DNS tunnelling carries data inside DNS queries and responses, typically in long encoded subdomains of one domain. It is detected by volume and name shape.

DNS tunnelling is the use of the DNS protocol to carry data that is not name resolution. A client encodes data in the labels of queries for subdomains of a domain whose authoritative server is controlled by the other party, and the server returns data in its answers. Because DNS is allowed almost everywhere, it can be used to bypass network controls; MITRE ATT&CK lists it under T1071.004.

Indicators in a capture include many unique, long, high-entropy subdomains under one domain, heavy use of record types such as TXT, and a steady query rate from one host. Legitimate services produce some of the same patterns, so indicators need confirmation. See DNS analysis in a pcap.