{"id":22480172,"url":"https://github.com/netrack/dnstun","last_synced_at":"2025-10-16T13:30:39.524Z","repository":{"id":57519602,"uuid":"212816059","full_name":"netrack/dnstun","owner":"netrack","description":"DNSTun is a CoreDNS plugin for detecting DNS tunneling","archived":false,"fork":false,"pushed_at":"2020-03-29T15:20:36.000Z","size":65,"stargazers_count":6,"open_issues_count":2,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-12-06T15:19:56.103Z","etag":null,"topics":["coredns-plugin","dns","dns-tunneling-detection"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/netrack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-10-04T13:00:40.000Z","updated_at":"2024-11-24T18:21:41.000Z","dependencies_parsed_at":"2022-08-29T23:41:39.752Z","dependency_job_id":null,"html_url":"https://github.com/netrack/dnstun","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netrack%2Fdnstun","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netrack%2Fdnstun/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netrack%2Fdnstun/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netrack%2Fdnstun/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/netrack","download_url":"https://codeload.github.com/netrack/dnstun/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":236721400,"owners_count":19194426,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["coredns-plugin","dns","dns-tunneling-detection"],"created_at":"2024-12-06T15:19:57.773Z","updated_at":"2025-10-16T13:30:34.124Z","avatar_url":"https://github.com/netrack.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dnstun\n\n_dnstun_ - enable DNS tunneling detection in the service queries.\n\n[![Build Status][BuildStatus]](https://travis-ci.org/netrack/dnstun)\n\n## Description\n\nThis is a [CoreDNS](https://coredns.io) plugin that enabled DNS tunneling\ndetection within submitted queries. It analyzes payload of the DNS query\nand either forward the query to the configured resolver (`8.8.8.8` by default),\nor returns refuse code.\n\nWith `dnstun` enabled, users are able to detect data exfiltration through DNS\ntunnels.\n\n## Syntax\n\n```txt\ndnstun {\n    runtime  HOST:PORT\n    detector DETECTOR:VERSION\n    [mapping  forward|reverse]\n}\n```\n\n* `runtime` specifies the endpoint in `HOST:PORT` format to the remote model\nruntime. This runtime should comply with e.g. `tensorcraft` HTTP interface.\n\n* `detector` is a directive to configure detector. Option `forward` instructs\nthe plugin to treat higher probability in the second element of prediction tuple\nas DNS tunnel, while `reverse` tells that first element in the prediction tuple\nidentifies DNS tunnel.\n\n* `mapping` is an optional directive to instructs plugin how interpret the\nresponse from detector: `forward` treats higher probability in the _second_\nelement of prediction tuple as DNS tunnel, while `reverse` tells that _first_\nelement in the prediction tuple identifies DNS tunnel. Default is `forward`.\n\n## Examples\n\nHere are the few basic examples of how to enable DNS tunnelling detection.\nUsually DNS tunneling detection is turned only for all DNS queries.\n\nAnalyze all DNS queries through remote resolver listening on TCP socket.\n```txt\n.  {\n    dnstun {\n        # Connect to the runtime that stores model and executes it.\n        runtime 10.240.0.1:5678\n\n        # Choose detector and it's version.\n        detector dns_cnn:latest\n    }\n}\n```\n\n## Usage\n\nOne of the possible ways to run experimental resolver is to use [docker-compose](https://github.com/docker/compose).\nIn order to run the environment, simply clone this repository and run the following\ncommand:\n```sh\n% git clone git@github.com:netrack/dnstun.git\n% docker-compose up\n```\n\nAfter that, resolver will be accessible at port `53`:\n```sh\n% dig @localhost google.com\n% dig @localhost q+aJ3on2BA.hidemyself.org.\n```\n\n[BuildStatus]: https://travis-ci.org/netrack/dnstun.svg?branch=master\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetrack%2Fdnstun","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetrack%2Fdnstun","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetrack%2Fdnstun/lists"}