Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?

share|improve this question
The target machine is a Tomato router, but I'll accept answers regarding generic unix/linux systems – Jader Dias Feb 6 '12 at 23:08
I setting up a DNS server and forcing users to use it an option? – Lekensteyn Feb 6 '12 at 23:51
@Lekensteyn everybody uses my router as the DNS already. – Jader Dias Feb 7 '12 at 13:40
up vote 1 down vote accepted

Since you only want to get the domains accessed via http you could setup up a transparent http-proxy with Polipo or Privoxy and evaluate the log file.

  1. Set up the proxy
    Install and configure the proxy, that he listen for example on the address and enable logging.
  2. Set up the firewall rule
    Write a firewall rule, which redirect all outgoing traffic to the port 80 to the address of proxy, which then forwards the traffic to requested domain.
  3. Parse the log file
    Set up a parser to extract all the accessed domains from the log file.

This solution has it's up and downs:

  • UP's:
    • your users don't have to change something on their system, browser, ...
    • you gain some capabilities, like caching, filtering, ... depending on the used proxy
    • you can expand it to log other protocols like https, ftp ... when the proxy supports it
  • DOWN's:
    • it's another system you to have manage and that's maybe failing
    • it's raises some legal/privacy issues, when you keep extensive logs on your users browsing habits
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.