Unable to convert Destination IP into Respective URL

[rizwanfpak]

Hi,

I am also developing a software that will log all the visited websites URLs. I am facing the same problem. I have source and destination IP addresses but I am unable to convert the destination IP into respective URL. It will be highly appreciated if someone help me in this regard.

Kind Regards,
Rizwan Ahmed

[sknake]

You can't use reverse DNS to determine a website visited. A single IP address can host multiple websites and may not have a reverse DNS entry. When you visit a website your browser resolves the IP address of the host in your address bar then sends a GET request with that information in the header. Its called a host header:

GET / HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET CLR 1.1.4322)
Accept-Encoding: gzip, deflate
Host: www.apexsoftware.com
Connection: Keep-Alive

You need to parse the host value from the GET request. You should also familiarize yourself with http keep alive. Multiple web requests may be made from a single connection so you will have to continuously monitor a connection for URLs visited.

[rizwanfpak]

Hi Dear,

You are right that a single IP address can host multiple websites and it may not have a reverse DND entry which makes impossible to get URL from given IP address.

How can we read the host header in .NET application once the user specified the URL in the address bar and then pressed Enter button or the user has opened new link within the website. I just want to know that how can I get the host header in .NET application which is running at the client side. Please help me in this regard.

Kind Regards,
Rizwan Ahmed

[sknake]

Installing pcap to sniff network traffic isn't a very efficient way to monitor website traffic as its quite invasive. I have seen other applications (like the child restriction/monitoring applications) install a windows service that forces all outbound traffic through the service as a proxy. You could create a proxy service that logs all requests then simply forwards them. A number of commercial routers also have support for forcing all outbound web traffic through the router as a proxy. You could purchase one of those routers and parse the traffic log.

[rizwanfpak]

Hi Dear,

Thanks for your response. I would like to develop an application that will log the visited websites URL. As you suggested that the application needs to install a windows service that will force all outbound traffic through the service as a proxy. The proxy will log the requests and then forward those requests. I am interested in this solution. Could you please share some useful links that may help me in building all this stuff in .NET. It is very urgent for me. Please provide your feedback on it.

Many Thanks,
Rizwan Ahmed