Executive Summary
This sample Agent report shows a likely DNS tunneling case. The strongest evidence is not the presence of DNS alone; it is the combination of long encoded labels, repeated TXT queries, low-value responses, and steady client retries.
Findings
- The client sends high-volume TXT queries with labels that look encoded rather than human-readable.
- Responses are small and do not explain the outbound byte volume.
- Timing remains steady enough to look like staged transfer instead of normal resolver noise.
Recommended Actions
Block or sinkhole the suspect domain while the endpoint is inspected. Preserve the original capture, export resolver logs for the same time window, and compare host process telemetry for DNS client activity.
Evidence Anchors
| Anchor | Packet evidence | Reproduce |
|---|---|---|
| DNS-1 | Frames 104-388 show repeated long TXT queries from one client. | dns.qry.type == 16 && dns.qry.name contains "example" |
| DNS-2 | Frames 112-402 show low response payload relative to outbound query volume. | dns.flags.response == 1 && ip.addr == 10.12.4.18 |
| DNS-3 | Frames 221-244 show retry behavior around delayed responses. | `dns.retransmission |
Buyer Note
This is a public sample report. It demonstrates the output structure buyers should expect from Agent Pro: clear finding, confidence boundary, and packet-level anchors another analyst can reproduce.
