David Bombal #551: DNS Command & Control: Detecting Malware Traffic
Feb 23, 2026
Chris Greer, Wireshark expert and packet analysis educator, walks through DNS traffic as seen on the wire. He explains why 92% of malware uses DNS for command and control. Short demos break down DNS packet anatomy, the TCP vs UDP debate, recursive lookups, and a live capture of a real site lookup.
AI Snips
Chapters
Transcript
Episode notes
Why DNS Is A Malware Superhighway
- DNS is heavily leveraged by malware for command-and-control, with Infoblox reporting 92% of malware using DNS for C2.
- Chris Greer highlights this as both a detection opportunity and a frequent cause of outages tied to breaches.
Inspect DNS Headers End To End
- Capture DNS packets to inspect the IP, UDP, and DNS headers: check source/destination, client ephemeral port, and UDP port 53.
- Chris inspects Ethernet/IP, UDP (8 bytes) and points out the client ephemeral port and UDP length.
Filter DNS Queries Fast In Wireshark
- Use Wireshark to filter DNS queries by the query/response flag to view only client requests.
- Chris drags the single-bit QR flag into the display filter to isolate queries quickly during packet analysis.