Suspicious DNS exfiltration
A security team sees repeated DNS spikes from one client without a corresponding business application pattern.
Runtime is an estimate for this small public sample, not an enterprise performance commitment.
Customer question
Does the capture support DNS tunneling or exfiltration, and which domain and client should the team investigate?
Capture profile: ~5 MB · security · dns · exfiltration · investigation
Repeated encoded-looking labels and TXT activity to one domain are the strongest tunneling indicators.
Query length, frequency, direction, and response behavior form a consistent DNS tunnel pattern in the sample.
Exact evidence
- Repeated long labels to one domain
- High-rate TXT query sequence
- Small responses with persistent client retries
Ruled-out alternative
Ordinary resolver retries alone do not explain the sustained encoded-label pattern.
Recommended action
Contain the client, block or sinkhole the suspect domain, and correlate the time window with endpoint and resolver logs.
Investigation prompt
Check for DNS tunneling or exfiltration; call out suspect domains and byte counts.
Case narrative
Security team observes sporadic DNS spikes. The capture shows a client sending frequent TXT queries with long, encoded labels to a single domain, hinting at tunneling.
How this was captured
- Client-side packet capture with display filter
dnsfor 3 minutes during the spike. - Optional edge capture on the resolver interface with
port 53to validate volume and destinations. - Saved as pcapng; timestamps noted for correlation with DNS logs.
What to look for
- Repeated long queries to the same domain, often with base32/64-like patterns.
- Byte counts and timing that suggest steady outbound data with small responses.
- Any accompanying TCP/HTTP traffic to the same host that could confirm staging.
Expected outcome
Flag the domain as suspicious for DNS tunneling and recommend blocking/testing alongside endpoint investigation.