1

I'm in charge of the network in my company and i have to check the visited websites.

We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.
DPI (as is it implemented in the edgeMAX router) is not accurate enough for watching which websites people visit.
I have installed nfdump on my imac and it's working well, i have retrieved lot of detailed information such as: protocol, source/destination addresses and so on.
And now i'm looking for getting the website names from IP addresses.
For that purpose i've tried whois command but the output is not easy to parse and for some cases, i can't get a name.
So my question is: is there other tools with a more human readable output ?

  • 1
    You could always do a reverse domain lookup on each address. But product recommendations are off-topic for this forum. – Ron Trunk Mar 24 '16 at 18:35
  • thank you for the advice, i am going to gather further information about it. – Andriniaina Andy Nkili Meyong Mar 25 '16 at 8:17
1

You cannot get the website trough the IP address since behind a single IP there can be many web sites.

What you need to do in order to get the web site is to inspect the content of http packets.

Be aware that there may be strong legal issue about this, depending on the country.

| improve this answer | |
  • Thanks for the legal issue warning. Concerning IP addresses, i wasn't aware that one address could be shared by several websites. But some readings link pointed the same direction as you did. I will try to check the http packets content. Thx – Andriniaina Andy Nkili Meyong Mar 25 '16 at 11:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.