Your firewall lets DNS through without looking inside it. Attackers know that. DNS tunneling smuggles data — and C2 traffic — out of your network inside DNS queries, right past controls that never inspect query length, entropy, or volume. tunneleye reads a DNS query log and flags the domains being used as a covert channel. Offline, zero dependencies.
$ tunneleye dns.log
🕳️ tunneleye — 412 domains · 6,204 queries · 1 suspected tunnel
🚨 [score 92] exfil-c2.com (CRITICAL)
842 queries · 781 unique subdomains · avg entropy 4.6 bits/char
avg subdomain length 48 · 71% TXT/NULL records · 1 client
↳ classic DNS tunneling signature (encoded data in long, random subdomains)
DNS is the internet's blind spot: firewalls forward it without inspecting content, and DNS-over-HTTPS hides it further. Commercial DNS firewalls (Infoblox, BlueCat) and SIEM dashboards catch this — but there's no quick, offline tool to triage a captured query log. tunneleye is that tool.
- 🔣 Subdomain entropy — encoded data (base32/64) looks random (high Shannon entropy)
- 📏 Subdomain length — tunnels pack payload into long labels (often 50+ chars)
- 🔢 Unique subdomains — moving data needs thousands of distinct lookups
- 📨 Record types — heavy TXT / NULL usage is a tell
- 📈 Volume — one host hammering one obscure domain
tunneleye dns.log # CSV: client,query[,qtype] — or one query per line
tunneleye queries.json --json
tunneleye dns.log --min-score 60Exit code 2 when a tunnel is found — wire it into your hunting pipeline.
pip install tunneleyeMIT