<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting DNS Tunneling — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-dns-tunneling.

## Tools

### `zeek`

Network traffic analyzer — DNS protocol parsing

**Usage:**
```bash
zeek -r capture.pcap protocols/dns
```

**Key Flags:**
  - `-r: read PCAP`
  - `-C: disable checksum validation`
  - `--load-seeds: reproducible UIDs`

---

### `suricata`

IDS/IPS with DNS app-layer detection

**Usage:**
```bash
suricata -r dns.pcap -S dns-tunnel.rules -l /tmp/output/
```

**Key Flags:**
  - `-S: rule file`
  - `-r: read PCAP`
  - `-l: log directory`

---

### `tcpdump`

DNS traffic capture

**Usage:**
```bash
tcpdump -i eth0 -w dns.pcap 'port 53'
```

**Key Flags:**
  - `-i: interface`
  - `-w: write PCAP`
  - `-c: packet count limit`

---

### `zeek-cut`

Zeek log field extractor

**Usage:**
```bash
zeek-cut query qtype_name < dns.log
```

**Key Flags:**
  - `-d: convert timestamps`
  - `-D: custom timestamp format`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
