A DNS tunnel hides stolen data inside subdomain labels of ordinary-looking DNS queries (e.g. 7fk2m9qz...evil-c2.example), because DNS traffic is rarely blocked by firewalls. Real hostnames are dictionary-like and low-entropy; base32/base64-encoded exfil payloads look statistically close to random noise. The classic detector is the Shannon entropy of the label's character distribution:
H(label) = -Σ p(c) · log2(p(c)) over each character c
p(c) = frequency of c in the label
H is measured in bits/character
uniform random alphanumeric → H → log2(36) ≈ 5.17
common English words → H ≈ 2.8 – 3.6
This simulator generates two live query streams — legit hostnames drawn from a small word list, and tunnel labels built from base32-style random characters sized by the "bytes per label" slider. Every query's entropy is computed for real and compared against the threshold at the resolver node:
- H(label) > threshold → flagged and blocked at the resolver.
- A true positive stops an actual tunnel query; a false negative lets a tunnel query slip through and its encoded bytes reach the covert server (tracked as leaked data).
- A false positive blocks an innocent query — raising the threshold trades detection rate for user-visible breakage, which is exactly the operational tension real SOC teams tune around.
Lowering the threshold catches more tunneling but starts misclassifying legitimate long/random-looking hostnames (CDNs, cache-busting subdomains); raising it lets low-and-slow exfiltration blend into normal traffic — the live detection-rate / false-positive-rate readouts show that trade-off directly as you move the slider.