Skip to content

Instantly share code, notes, and snippets.

@spirosoik

spirosoik/dns_tunneling_length_name.sql

Last active September 29, 2018 09:43
Show Gist options
  • Save spirosoik/f561ff9843d823f01e2726e5959c01d2 to your computer and use it in GitHub Desktop.
Save spirosoik/f561ff9843d823f01e2726e5959c01d2 to your computer and use it in GitHub Desktop.
Download ZIP
DNS Tunneling Length Name Exceed
Raw
dns_tunneling_length_name.sql
SET autocreate=true;
INSERT INTO dns_tunneling_length_name
SELECT STREAM * FROM DNS_DHCP_TRAFFIC
WHERE LEN(dns.dns_question[0].name) > 60
GROUP BY dns.dns_question[0].name, ipv4.srcAddr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment