Overview
In a capture, DNS and HTTP traffic are especially informative because they often reveal intent — what names a host looked up and what web resources it requested. This lesson focuses on reading these two protocols for useful indicators.
Learning objectives
- Identify what DNS traffic reveals in a capture.
- Identify what HTTP traffic reveals in a capture.
- Recognize suspicious patterns in each.
Core concept
DNS and HTTP are high-value protocols to inspect:
- DNS shows the names a host tried to resolve — effectively its intentions ("who did it want to talk to?"). Queries and responses reveal domains contacted, even before any connection is made.
- HTTP (when unencrypted) shows the actual web requests and responses — URLs, methods, headers, user agents, and content — a detailed record of web activity.
Together they often tell the story of what a host was doing.
How it works
Filtering a capture to DNS surfaces every domain lookup, letting you spot connections to unexpected or known-bad domains. Filtering to HTTP surfaces requested URLs and responses. Because DNS happens before the connection, malicious lookups can be an early indicator; because HTTP carries rich detail, its requests can reveal specific activity (downloads, API calls, admin pages). With HTTPS, the DNS name is still visible even though the HTTP content is encrypted — so DNS retains investigative value when HTTP does not.
Practical example
A capture from an infected-looking host shows DNS queries for a long, random-looking domain repeated at regular intervals, followed by HTTP POSTs to that domain carrying data. The pattern — periodic lookups of an odd domain plus outbound POSTs — is a classic signature of malware "beaconing" to a command-and-control server. DNS revealed the suspicious name; HTTP revealed data leaving. (Exact indicators vary; the pattern is what matters.)
Cybersecurity relevance
DNS and HTTP indicators are staples of threat hunting and incident response. Suspicious signals include lookups of algorithmically-generated or known-malicious domains, beacon-like regular intervals, unusual user agents, requests to rare paths, or large outbound transfers. Even with encryption widespread, DNS names and connection metadata remain visible and valuable. Analysts correlate these to detect compromise; the same reading skills apply to authorized testing.
Common mistakes
- Ignoring DNS because it seems mundane — it reveals intent and works even when HTTP is encrypted.
- Assuming HTTPS hides everything — the DNS lookup and connection metadata are still observable.
- Judging a single lookup/request in isolation rather than looking for patterns (intervals, volume, rarity).
Key takeaways
- DNS traffic reveals the names a host tried to resolve — its intent — and remains visible even when HTTP is encrypted.
- Unencrypted HTTP reveals detailed URLs, methods, headers, and content of web activity.
- Suspicious patterns (odd/known-bad domains, regular beaconing intervals, unusual agents/paths, large transfers) are key indicators in hunting and response.
Check your understanding
- Why does DNS traffic remain investigatively useful even when a host's web traffic is encrypted with HTTPS?
- Describe a DNS+HTTP pattern that could indicate malware beaconing to a command-and-control server.