Evidence packCONSTRUCTED
DNS with something in the labels: a small constructed capture
Sixty DNS queries from one workstation, fifteen of them TXT lookups whose first label is 56 characters of base32. Small enough to read packet by packet, and generated by a script, so nothing in it came from a real network.
2.9 KB2 filesT1071.004T1048.003checked 2026-09-21
dns-long-labels.zip
- SHA-256
12d54f3274190a6b11f2c521848622f0c3a4022e6e2c9855a3d55001ae0fbb62- Verify before you open it
sha256sum dns-long-labels.ziporGet-FileHash dns-long-labels.zip- Archive password
••••••••
Handling
- Nothing in this archive is executable. It holds captures and logs, which are data.
- Treat it as evidence anyway: verify the hash, work on a copy, and open it in an analysis machine rather than on the desktop you read email on. It is the habit that matters, and the next archive you are handed will not be this polite.
- Parsers have bugs. A packet capture is untrusted input to whatever opens it, so keep your tooling current.
Provided for education and defensive research, as is, with no warranty. You are responsible for how you handle it and for complying with the law and the policies that apply to you.
what is inside
| File | Type | Size | What it is |
|---|---|---|---|
| dns-long-labels.pcap | pcap | 6.5 KB | 60 DNS queries over UDP from 10.13.5.119 to a resolver at 10.61.0.5, starting at 08:00 UTC on 2026-09-03. Queries only, no responses. |
| README.txt | other | 1.0 KB | What the capture is, how it was made, and a statement that it is constructed. |
Opens with
- Wireshark or tshark
- tcpdump -nn -r dns-long-labels.pcap
- Zeek, to produce a dns.log you can run the companion aggregation over
What to do with it
Three exercises, in the order they get harder.
- Find the odd ones out by eye. Sort by query name length. Fifteen queries separate from the other forty-five immediately. What do they have in common besides length: the record type, the parent domain, the second label?
- Decode one. The first label is base32 with the padding removed and the letters lowercased. Put the padding back, decode it, and read what it says. The second label is a counter. Why would a tunnelling tool need one?
- Write the detection. A single long label is a weak signal. Count distinct query names per parent domain per client, and see how cleanly that one number splits this capture. Then look at the aggregation in the network rule pack and compare.
What it is not
It is a script's idea of DNS tunnelling, and it is tidier than the real thing. A real capture has responses, retransmissions, caching effects, a resolver talking upstream, and ten thousand unrelated queries for every one that matters. This is for learning what the request side looks like. The walkthrough is for learning to find it in the noise.
There are no responses in the capture, by design and by limitation: it was built to show the queries, and a convincing resolver conversation is more than a short generator should pretend to.
About the password
Every archive in the zoo is password protected, this one included, even though
nothing in it can run. The password is printed above. It is there so that mail
gateways and endpoint protection do not quarantine the file in transit, and so
that opening an evidence archive is always a deliberate act. infected is the
convention malware researchers have used for that purpose for years.
Adding your own
Small archives go in public/zoo/ and are named in archive.file; the build
checks that the file exists and that its size and SHA-256 match this page.
Anything large, a memory image especially, belongs in object storage: set
archive.url instead and the panel links out to it. Set liveMalware: true on
anything that can execute, and the panel changes its warning and its colour.