DNS.TXT.Records.Tunneling

Description

This indicates an attempt to tunnel traffics via DNS TXT Records.
The signature detects for such requests at a rate of 100 requests within 1 second. The rate can be adjusted in the CLI.

Affected Products

DNS Record Tunnelling

Impact

Network Policy Bypass

Technology

Browser-Based, Network-Protocol, Client-Server, Peer-to-Peer, Cloud-Based, Mobile-Device

Behavior

• Evasive
• Tunneling

Default Ports

• TCP/53
• UDP/53