dns-tunnels

This script is used to detect DNS tunnels, and written according to the paper Chimera: A Declarative Language for Streaming Network Traffic Analysis and the report Detecting DNS Tunneling.

It based on the count of the DNS query in a period time, the length of the DNS query, and the percentage of the numerical characters in the DNS query.

This rep is used for Bro package.