Unit 5: How DNS answers · Lesson 4 of 6 · 20 min
Encrypted DNS
Find a laptop that sends its lookups over HTTPS to an outside resolver and skips your DNS logs.
mission
- You are
- The analyst checking DNS coverage.
- Situation
- Your DNS logs are the first place you look in every investigation. The team suspects some laptops never show up in them.
- Goal
- Find the laptop that resolves names without using the company resolver, from egress.pcap.
- Hand in
- The laptop's address, the outside resolver it uses and how many sessions it opened.
Plain DNS and DNS over HTTPS
See who uses the company resolver
Plain DNS goes to 10.20.0.53 on UDP 53. Count the queries by sender.
tshark -r egress.pcap -Y 'udp.dstport==53' -T fields -e ip.src | sort | uniq -c
12 10.10.0.23
12 10.10.0.31
you should see Only two laptops. A third laptop is active in the capture, so where are its lookups?
List TLS sessions by server name
Every TLS session starts with a ClientHello that names the server in clear, the SNI. Grouping by SNI shows where each laptop really goes.
tshark -r egress.pcap -Y 'tls.handshake.type==1' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c | sort -rn
18 10.10.0.57 doh.resolver.example
5 10.10.0.23 www.example.com
3 10.10.0.23 chat.ai-assistant.example
1 10.10.0.31 api.llm-vendor.example
1 10.10.0.23 updates.example.org
you should see 10.10.0.57 opened 18 short sessions to a DNS over HTTPS resolver.
Confirm the shape
DoH sessions are small and frequent: one question, one answer. conv,tcp with a filter shows every session's size.
tshark -r egress.pcap -q -z conv,tcp,ip.addr==203.0.113.53 | sed -n '6,8p'
10.10.0.57:54739 <-> 203.0.113.53:443 7 3063 bytes 8 688 bytes 15 3751 bytes 5.000000000 0.0214
10.10.0.57:60773 <-> 203.0.113.53:443 7 3063 bytes 8 688 bytes 15 3751 bytes 16.300000000 0.0214
10.10.0.57:53304 <-> 203.0.113.53:443 7 3063 bytes 8 688 bytes 15 3751 bytes 27.600000000 0.0214
you should see Identical tiny sessions about every 11 seconds.
defender tip -Y does not filter -z statistics. Put the filter inside the statistic, after a comma, as shown here.
Policy options
browsers pick their own DoH DNS logs miss those lookups DNS blocklists do nothing
You lose the cheapest detection you have.
managed browsers: DoH points at the company resolver firewall blocks known DoH SNIs and outbound 53 except dns01
Lookups stay encrypted on the wire and visible in your logs.
Count the encrypted lookups
Each TLS session to the outside resolver can carry many hidden lookups.
tshark -r egress.pcap -Y 'ip.dst==203.0.113.53 && tls.handshake.type==1' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c
18 10.10.0.57 doh.resolver.example
you should see 18 sessions from one laptop to doh.resolver.example.
defender tip Block known public DNS over HTTPS endpoints for managed devices and point browsers at the company resolver through policy.
What a defender takes away
- 1DoH hides lookups inside HTTPS. The SNI still names the resolver.
- 2A laptop that never queries your resolver is a gap in your logs.
- 3Point managed devices at a company DoH resolver rather than fighting encryption.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.