# Detect DNS tunneling

**URL:** <https://discuss.elastic.co/t/detect-dns-tunneling/56587>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 28, 2016, 8:30am UTC](https://discuss.elastic.co/t/detect-dns-tunneling/56587 "2016-07-28T08:30:50Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 4:05pm UTC](https://discuss.elastic.co/t/detect-dns-tunneling/56587/7 "2016-08-04T16:05:31Z")

</div>

Looks like you have DNS data indexed in Packetbeat. Here's a sample query to look for some interesting domains.

```auto
curl http://<elasticsearch>:9200/packetbeat-*/dns/_search?pretty -d'
{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "@timestamp": {
            "from": "now-4h"
          }
        }
      },
      "must_not": {
        "terms": {
          "dns.question.etld_plus_one": [
            "akadns.net.",
            "amazonaws.com.",
            "apple.com.",
            "apple-dns.net.",
            "cloudfront.net.",
            "icloud.com.",
            "in-addr.arpa.",
            "google.com.",
            "yahoo.com."
          ]
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "by_domain": {
      "terms": {
        "size": 0,
        "field": "dns.question.etld_plus_one"
      },
      "aggs": {
        "unique_hostnames": {
          "cardinality": {
            "field": "dns.question.name"
          }
        },
        "total_bytes_in": {
          "sum": {
            "field": "bytes_in"
          }
        },
        "total_bytes_out": {
          "sum": {
            "field": "bytes_out"
          }
        },
        "high_num_hostnames": {
          "bucket_selector": {
            "buckets_path": {
              "unique_hostnames": "unique_hostnames"
            },
            "script": "unique_hostnames > 10"
          }
        }
      }
    }
  }
}'

```

---

_[View the full topic](https://discuss.elastic.co/t/detect-dns-tunneling/56587)._