Follow the query trail.
An evidence report for synthetic-dns.pcap. Long, varied DNS labels can carry data—or ordinary application tokens. This workbench shows the observations behind each review signal.
Why these groups stand out
example.test
Client 192.0.2.10At least 24 distinct names with long, high-entropy subdomain labels occur within 60s; 100% of queries in that window meet the label criteria.
Alternative explanation: Telemetry IDs, anti-abuse tokens, trackers or CDN traffic can produce similar labels. Review the packet evidence and context before drawing a conclusion.
Inspect packet evidence
Packet 1: 36ca6564787eb7dc8beadbe7cbf1f42f584c37fd28407d35.channel.example.testPacket 9: 52ccf91583d0a59af6be19c408933d2aa99786b3a115994a.channel.example.testPacket 15: 538aff05c47e8d7e80b982288461effbaecda1dedda383d8.channel.example.testPacket 23: bc68bd18ca9da19b930fcf6d02ec094ecb06887ceab648a4.channel.example.testPacket 29: fb86d1bdf859e17ff667d38f0ec16fbb9cf462ec11e2c4bc.channel.example.testPacket 37: 3e7230f3873b296daf18a0cb27418a3aad134044304795da.channel.example.testPacket 43: 2ca3879226febc6f829c48bda2a2fb4e57f8198ea8eadbaf.channel.example.testPacket 51: 6616479d6829a7316a9b885bb3373efb94994c1b201fc4c6.channel.example.test
Up to eight sample questions from the strongest observed window. RCODE counts: {'3': 24}. 24 / 24 questions have a matched response within 30 seconds; missing responses may be a capture gap.
Showing 1 of 1 flagged groups. Full results are available in the JSON export.
All observed groups
| Client | Domain | Queries | Distinct names | Max label | Entropy | Result |
|---|---|---|---|---|---|---|
192.0.2.10 | example.test | 24 | 24 | 48 | 3.871 | Review |
192.0.2.10 | school.test | 20 | 2 | 4 | 0.0 | No pattern flagged |
192.0.2.20 | service.test | 20 | 1 | 48 | 3.692 | No pattern flagged |
192.0.2.10 | app.test | 10 | 1 | 3 | 0.0 | No pattern flagged |
192.0.2.30 | tenant0.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant1.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant10.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant11.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant12.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant13.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant14.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant2.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant3.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant4.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant5.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant6.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant7.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant8.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
192.0.2.30 | tenant9.github.io | 1 | 1 | 0 | 0.0 | No pattern flagged |
Showing the first 19 of 19 groups. 0 questions excluded by the configured allowlist. A no-pattern result is specific to these thresholds and this capture.
Coverage & reproducibility
UDP port 53 DNS over Ethernet/VLAN or raw IPv4/IPv6. No TCP DNS, IP reassembly, DoH, DoT or checksum verification.
- No framing or supported-parser gaps observed.
Allowlist (exact domains and their subdomains): []
Thresholds and processing limits
window_seconds: 60min_unique: 10min_label_length: 20min_entropy: 3.5min_suspicious_fraction: 0.5max_packets: 250000max_questions: 100000max_file_mib: 128
Entropy is Shannon entropy of label characters, not cryptographic randomness. At least one subdomain label must meet both the length and entropy thresholds; distinct suspicious names and their fraction are then measured in a sliding window separately for each client and registrable domain. This is a configurable heuristic, not a validated classifier.