DNS.TXT.Records.Tunneling
Description
This indicates an attempt to tunnel traffics via DNS TXT Records.The signature detects for such requests at a rate of 100 requests within 1 second. The rate can be adjusted in the CLI.
Affected Products
DNS Record Tunnelling
Impact
Network Policy Bypass
Technology
Browser-Based, Network-Protocol, Client-Server, Peer-to-Peer, Cloud-Based, Mobile-Device
Behavior
- Evasive
- Tunneling
Default Ports
- TCP/53
- UDP/53