Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?

  • The target machine is a Tomato router, but I'll accept answers regarding generic unix/linux systems
    – Jader Dias
    Feb 6, 2012 at 23:08
  • 1
    I setting up a DNS server and forcing users to use it an option?
    – Lekensteyn
    Feb 6, 2012 at 23:51
  • @Lekensteyn everybody uses my router as the DNS already.
    – Jader Dias
    Feb 7, 2012 at 13:40

1 Answer 1


Since you only want to get the domains accessed via http you could setup up a transparent http-proxy with Polipo or Privoxy and evaluate the log file.

  1. Set up the proxy
    Install and configure the proxy, that he listen for example on the address and enable logging.
  2. Set up the firewall rule
    Write a firewall rule, which redirect all outgoing traffic to the port 80 to the address of proxy, which then forwards the traffic to requested domain.
  3. Parse the log file
    Set up a parser to extract all the accessed domains from the log file.

This solution has it's up and downs:

  • UP's:
    • your users don't have to change something on their system, browser, ...
    • you gain some capabilities, like caching, filtering, ... depending on the used proxy
    • you can expand it to log other protocols like https, ftp ... when the proxy supports it
  • DOWN's:
    • it's another system you to have manage and that's maybe failing
    • it's raises some legal/privacy issues, when you keep extensive logs on your users browsing habits

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .