# DNS and base64 woes **URL:** \ **Category:** Zeek\ **Created:** [July 6, 2015, 7:38pm UTC](https://community.zeek.org/t/dns-and-base64-woes/3689 "2015-07-06T19:38:57Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Ryan\_Kovar](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@Ryan\_Kovar](https://community.zeek.org/u/Ryan_Kovar)\ **Post date:** [July 6, 2015, 7:38pm UTC](https://community.zeek.org/t/dns-and-base64-woes/3689/1 "2015-07-06T19:38:57Z")
Howdy! I’ve been working on detecting base64 encrypted DNS exfil with Bro and noticed that the default bro\_dns.log makes all dns outbound calls lowercase. But since base64 is case sensitive I can’t decode the actual content anymore… This appears to be a function of the bif.strings.bro ([https://www.bro.org/sphinx/scripts/base/bif/strings.bif.bro.html?highlight=lowercase#id-to\_lower](https://www.bro.org/sphinx/scripts/base/bif/strings.bif.bro.html?highlight=lowercase#id-to_lower)). However, I was wondering if there is a method/switch for bro to report the DNS string as actually seen in the traffic? Example is show below: ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 6, 2015, 8:45pm UTC](https://community.zeek.org/t/dns-and-base64-woes/3689/2 "2015-07-06T20:45:53Z")
Yes, this is a suboptimal behavior that has been a historic decision for a while now. We have similar changes in one or two other places as well. I filed a ticket to make sure we address this for 2.5. [https://bro-tracker.atlassian.net/browse/BIT-1431](https://bro-tracker.atlassian.net/browse/BIT-1431)   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/dns-and-base64-woes/3689/3 "2022-05-06T15:42:49Z")