Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?

share|improve this question
    
The target machine is a Tomato router, but I'll accept answers regarding generic unix/linux systems –  Jader Dias Feb 6 '12 at 23:08
1  
I setting up a DNS server and forcing users to use it an option? –  Lekensteyn Feb 6 '12 at 23:51
    
@Lekensteyn everybody uses my router as the DNS already. –  Jader Dias Feb 7 '12 at 13:40
add comment

1 Answer

up vote 1 down vote accepted

Since you only want to get the domains accessed via http you could setup up a transparent http-proxy with Polipo or Privoxy and evaluate the log file.

  1. Set up the proxy
    Install and configure the proxy, that he listen for example on the address 127.0.0.1:8080 and enable logging.
  2. Set up the firewall rule
    Write a firewall rule, which redirect all outgoing traffic to the port 80 to the address of proxy 127.0.0.1:8080, which then forwards the traffic to requested domain.
  3. Parse the log file
    Set up a parser to extract all the accessed domains from the log file.

This solution has it's up and downs:

  • UP's:
    • your users don't have to change something on their system, browser, ...
    • you gain some capabilities, like caching, filtering, ... depending on the used proxy
    • you can expand it to log other protocols like https, ftp ... when the proxy supports it
  • DOWN's:
    • it's another system you to have manage and that's maybe failing
    • it's raises some legal/privacy issues, when you keep extensive logs on your users browsing habits
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.