Roche Interview Question

How would you detect DNS tunneling traffic.