Lesson 1.44: Detecting DNS tunnelling
Almost every network lets DNS out, even segments with no internet access, because the internal resolver forwards questions for them. That makes DNS a classic covert channel: malware encodes data into the names it looks up (abc123….attacker.example), and the attacker's name server receives it. In the lab you read Northwind's DNS log, notice a warehouse kiosk that can't reach the internet asking strange TXT questions, measure name length and uniqueness, and decode a query to prove it carries data.
16 min
You will learn to
- Explain how DNS tunnelling works
- Read Zeek's dns.log
- Spot unusual query types and long names
- Measure unique subdomains per domain
- Decode an encoded label
Key terms
- Covert channel
- A way to move data through a path not meant for it.
- DNS tunnelling
- Encoding data in DNS questions and answers to pass it through resolvers.
- TXT record
- A DNS record that holds free text; useful for tunnels to send data back.
- Registered domain
- The part of a name someone registered (e.g. cdn-metrics.example); subdomains under it are theirs to invent.
- Base32
- Encoding with A-Z and 2-7; case-insensitive, so it suits DNS names.
- Response policy zone (RPZ)
- A resolver feature that blocks or rewrites answers for listed domains.
← Layered models: OSI and TCP/IP · All lessons · Users, groups, root and sudo →