Member Avatar for prem2

Dear all,

I am using linux . My system is connected to local network and i have local address as . There are more number of systems in my organization.I want to list out,

Ip address = list of sites used today.

For example,
=>google.com,yahoo.com etc.
Is there any command in linux .


Thank you,

With Regards,
Prem

  • 2 Contributors
  • 2 Replies
  • 202 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by prem2

Dani AI

Generated

— goal: produce a per-client list of sites visited (e.g. 192.168.1.2 -> google.com, yahoo.com) from a Linux gateway. ’s DNS-logging suggestion is a good low-effort start, but DNS logs alone miss direct-IP requests, some CDN hostnames, and increasingly may miss hostnames protected by encrypted client hello. Below are practical, complementary options ranked by ease vs. completeness, with short commands you can apply and tweak.

Run a proxy on the gateway (best for HTTP, simple per-IP logs)

  • Install Squid (or another proxy) on 192.168.1.1 and force clients through it (transparent or explicit). Squid’s access.log includes client IP and requested host/URL.
  • Example parse (adjust fields if your logformat differs):
    awk '{print $3 " -> " $7}' /var/log/squid/access.log | sort | uniq -c | sort -nr
# per-client filter:
awk '$3=="192.168.1.2" {print $7}' /var/log/squid/access.log | sort | uniq -c

Capture TLS SNI for HTTPS (when you cannot/should not intercept SSL)

  • You can extract the TLS SNI (server name) from live traffic and tie it to client IPs. This works unless clients use ECH/ESNI.
    tshark -i eth0 -Y 'tls.handshake.extensions_server_name or ssl.handshake.extensions_server_name' \
-T fields -e ip.src -e tls.handshake.extensions_server_name -e ssl.handshake.extensions_server_name \
| awk '{host=($2!="")?$2:$3; print $1 " -> " host}' | sort | uniq -c | sort -nr

Flow-export / firewall logging (low-level; higher volume)

  • Enable netflow/sFlow on the gateway and use ntopng/nfdump/pmacct to map destination IPs to domains where possible.
  • Or add targeted iptables logging (beware log volume) and post-process:
    iptables -I FORWARD -s 192.168.1.0/24 -p tcp --dport 80 -j LOG --log-prefix "HTTP: "

Notes and cautions

  • If you do not control the gateway, you need a span/mirror port or host-based logging on each client.
  • Logs can be large; use rotation and tools (ulogd, logrotate).
  • Respect privacy and legal rules: inform users or obtain authorization before monitoring.
  • Best result: combine DNS logs + proxy access logs + SNI capture for near-complete hostname mapping per IP.

Recommended Answers

All 2 Replies

Member Avatar for nonshatter

There's no command that I know of that will do this. Unless you can find a tool/log analyser to do the leg work, you'd have to write some scripts yourself to achieve what you want, and it may require a considerable amount of work to implement.

This maybe of some help (Taken from this thread):

"Another option would be to set up BIND (DNS server) on the Linux system. Internal to BIND, you can turn on logging for all DNS querries. In a typical environment, most of the DNS querries are for web pages, so most of what you would see would be the web sites visited. However, if they were accessing news servers, chat rooms, etc., you will see that too.

In my case, I have 4 PCs at home in a network. 3/4 run WinXP, and the 4th runs SUSE v9. The SUSE system runs BIND, and is set up as the primary DNS server for the other 3 PCs, and has full logging turned on. 2/4 of the WinXP machines belong to my teenagers. Since the SUSE system is the primary DNS, and has logging enabled, I can see everything they do, without them knowing that I'm watching. I use Norton Internet Security on all of the WinXP systems, and have parental controls enabled, so the kids aren't able to get to much in the way of "bad" stuff, but I can still see what they are doing any time I need to.

Hope this helps. If you are interested in setting up BIND, a quick Google on "Linux DNS BIND" will get you all sorts of info on how to install & configure BIND. With SUSE, YAST will get you 99% of the way there, but at least in my case, I had to edit one of the conf files to turn logging on."

Member Avatar for prem2

Dear nonshatter,

Thanks for your information.

prem

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.