I'm in charge of the network in my company and i have to check the visited websites.
We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.
DPI (as is it implemented in the edgeMAX router) is not accurate enough for watching which websites people visit.
I have installed nfdump on my imac and it's working well, i have retrieved lot of detailed information such as: protocol, source/destination addresses and so on.
And now i'm looking for getting the website names from IP addresses.
For that purpose i've tried whois command but the output is not easy to parse and for some cases, i can't get a name.
So my question is: is there other tools with a more human readable output ?
asked Mar 24, 2016 at 18:30
-
1You could always do a reverse domain lookup on each address. But product recommendations are off-topic for this forum.– Ron TrunkMar 24, 2016 at 18:35
-
thank you for the advice, i am going to gather further information about it.– Andriniaina Andy Nkili MeyongMar 25, 2016 at 8:17
Add a comment
|
1 Answer
You cannot get the website trough the IP address since behind a single IP there can be many web sites.
What you need to do in order to get the web site is to inspect the content of http packets.
Be aware that there may be strong legal issue about this, depending on the country.
-
Thanks for the legal issue warning. Concerning IP addresses, i wasn't aware that one address could be shared by several websites. But some readings link pointed the same direction as you did. I will try to check the http packets content. Thx Mar 25, 2016 at 11:07