1

Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?

3
  • The target machine is a Tomato router, but I'll accept answers regarding generic unix/linux systems
    – Jader Dias
    Feb 6, 2012 at 23:08
  • 1
    I setting up a DNS server and forcing users to use it an option?
    – Lekensteyn
    Feb 6, 2012 at 23:51
  • @Lekensteyn everybody uses my router as the DNS already.
    – Jader Dias
    Feb 7, 2012 at 13:40

1 Answer 1

1

Since you only want to get the domains accessed via http you could setup up a transparent http-proxy with Polipo or Privoxy and evaluate the log file.

  1. Set up the proxy
    Install and configure the proxy, that he listen for example on the address 127.0.0.1:8080 and enable logging.
  2. Set up the firewall rule
    Write a firewall rule, which redirect all outgoing traffic to the port 80 to the address of proxy 127.0.0.1:8080, which then forwards the traffic to requested domain.
  3. Parse the log file
    Set up a parser to extract all the accessed domains from the log file.

This solution has it's up and downs:

  • UP's:
    • your users don't have to change something on their system, browser, ...
    • you gain some capabilities, like caching, filtering, ... depending on the used proxy
    • you can expand it to log other protocols like https, ftp ... when the proxy supports it
  • DOWN's:
    • it's another system you to have manage and that's maybe failing
    • it's raises some legal/privacy issues, when you keep extensive logs on your users browsing habits

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .