DNS queries from a PCAP, and DNS exfiltration

DNS is allowed out of almost every network, which is exactly why it gets used as a channel. A capture with hundreds of queries for distinct subdomains of one zone is not a machine resolving names; it is a machine spelling something out one label at a time.

Recognising exfiltration

• Many unique names under one parent. a1b2c3.tunnel.example.com, d4e5f6.tunnel.example.com, and so on. Real resolution repeats names; a channel never does.
• Label lengths near the maximum. A DNS label caps at 63 characters, and a tunnel packs them full.
• Base32 or hex alphabets. DNS names are case-insensitive and restricted, so an encoder that wants to survive them uses base32 (letters and digits 2-7) or hex. Base64 in a hostname is a sign of a sloppy tool, and it still happens.
• TXT queries. The answer direction of the channel. TXT records carry arbitrary text and are the natural way to send data back.
• A steady rate. Bytes going out at a constant packets-per-second is a program, not a person.

Decoding it

Concatenate the leading labels in query order, then decode. Base32 is the usual answer - and note that a tunnel often drops the = padding, so a decoder that insists on it will refuse a string that is perfectly good. Text mode's triage handles the padding and identifies the encoding for you; if the result is compressed or encrypted, it will say that too rather than showing you noise.