DNS.TXT.Records.Tunneling

Description

This indicates an attempt to tunnel traffics via DNS TXT Records.
The signature detects for such requests at a rate of 100 requests within 1 second. The rate can be adjusted in the CLI.

Affected Products

DNS Record Tunnelling

Impact

Network Policy Bypass

Technology

Client-Server

Behavior

• Evasive
• Tunneling

Default Ports

• TCP/53
• UDP/53