Filtering and following DNS traffic with Wireshark
You separate DNS queries and answers, read query types (A, AAAA, TXT), answer codes (NXDOMAIN) and the addresses in answers; you find and export unusually long names with len() and matches, work out the domain used to leak data through DNS and the number of queries, and write a detection filter that catches it. The leak domain differs in every lab.
Level 101 · 50 min
The data loss prevention (DLP) system raised no alarm, but Daniel suspects a workstation’s DNS traffic: "Attackers sometimes take data out not as files but hidden inside DNS queries. DNS is blocked almost nowhere." The capture: ~/ws/dns.pcapng.
DNS answers "what is the IP address of this name?". Every query has a type: A (IPv4 address), AAAA (IPv6 address), TXT (free text), MX (mail server). The answer has an rcode (result code): 0 success, 3 NXDOMAIN (no such name). The figure shows the fields of a DNS packet.
The leak pattern: data is split, encoded and asked as long, meaningless sub-names under the attacker’s domain: ojsxe43p….0.some-domain.example. Close any Wireshark windows left open from earlier lessons: the desktop runs with 2 GB of memory.
What you will do in this lesson
- Queries and answers
- The address in the answer
- Query types
- Names that don’t exist: NXDOMAIN
- Long names: len()
- The leak domain
- How many parts?
- Write a detection filter
- Short quiz
Skills you will earn
- Reading DNS queries, answers and addresses
- Telling DNS query types apart (A, AAAA, TXT)
- Reading DNS answer codes (NXDOMAIN)
- Using sets, network ranges and len()
- Exporting only the requested packets
- Finding data leaking through DNS
- Writing a behaviour-based detection filter
← Telling encrypted (TLS) from cleartext traffic with Wireshark · Wireshark fundamentals · Wireshark statistics: hierarchy, conversations, I/O →
Start for free