DNS tunnel packet capture (pcap) dataset

• This repository contains:
  • PCAP files captured from various DNS tunneling tools and benign situation
  • Snort 3 community rules
  • PCAP-to-JSON (which will be input-compatible w/ ztmb) converter

Dataset and pre-built binary

• Dataset and pre-built converter binary (ztmb-conv-json-*) are saved in /build directory.

PCAP-to-JSON converter development guide

• Install dependencies:

make deps

• Build:

make

• Convert and compress (to .tar.gz, ztmb required.)

make ztmb