DNS Tunneling Client Detection (SMTP)
Info Nessus Network Monitor Plugin ID 4976
SynopsisThe remote client appears to be tunneling traffic over a DNS server.
DescriptionThe remote client appears to be tunneling traffic over a DNS server. There are a number of DNS tunneling clients that allow internal hosts to bypass firewall and proxy inspection.
SolutionManually inspect both the traffic and the client to ensure that such usage is in alignment with existing policies and guidelines.