DNS Tunnel Detector

If somebody’s tunneling data out through DNS, they’re probably hoping you won’t look too close. This tool does.

It scans .pcap files for DNS queries with long domain names or excessive dots—two dead giveaways for DNS tunneling. It won’t catch everything, but it’ll sure as hell catch the lazy stuff. And most of it is lazy.

Each flagged query is timestamped and printed. No bloat, no GUI. Just field-ready tunnel sniffing for folks who don’t have time to babysit a SIEM all day.