DNS traffic is the network communication used to resolve domain names into IP addresses and other records. Because almost every application depends on DNS, this traffic is usually treated as normal background activity. That makes it valuable to attackers: malicious commands, configuration data, or beaconing patterns can be hidden inside DNS queries and responses, blending into routine resolver chatter.
In real intrusions, DNS traffic may carry command-and-control data through encoded subdomains, frequent lookups, or unusual record types. Defenders watch for patterns such as high-volume queries, domains that look random, and hosts making DNS requests that do not match their software behavior. Correlating DNS logs with endpoint activity helps spot malware that uses DNS for stealth, persistence, or remote control.