[r896neo]

I have started logging activity on my wifi network using opendns but Is there anyway to work out actual domains visited by looking at the dns logs?

 

Obviously the logs show everything displayed so more advert and link data than actual domains visited? Is there anyway to differentiate between the two? 

 

I am monitoring an employee and want to give them the benefit of the doubt and be sure they actually visited a site rather than simply a banner ad for it appeared?

 

He is the only person using the network

 

Thanks in advance

 

Here for example is a sample of the log

 

RANK DOMAIN REQUESTS 1 *.doubleclick.net 22 2 *.cloudfront.net 11 3 fbstatic-a.akamaihd.net 7 4 twitter.com 6 5 www.facebook.com 6 6 ps.eyeota.net 5 7 segments.adap.tv 5 8 fbcdn-static-b-a.akamaihd.net 5 9 pix04.revsci.net 5 10 uav.tidaltv.com 5 11 sync.adaptv.advertising.com 5 12 ib.adnxs.com 5 13 l.betrad.com 5 14 c1.adform.net 4 15 e.visualdna.com 4 16 ic.tynt.com 4 17 a.collective-media.net 4 18 de.tynt.com 4 19 match.adsrvr.org 4 20 sync.tidaltv.com 4 21 sync.adap.tv 4 22 s.cpx.to 4 23 bcp.crwdcntrl.net 4 24 b.collective-media.net

 

[Advertisements]

using those logs, it's kind of difficult to actually discern between actual views and ads. but.....the twitter.com and facebook.com ones aren't likely to be banner ads. the banner ads for those sites are to different domains. the fbcdn one is someone looking at a specific facebook image via a link. (I just assume the FB and twitter activity are the ones you're looking for the most).

 

basically, open DNS logs (or any DNS logs) aren't a good way to judge user activity since that's a DNS request....just because something is asking for an address doesn't mean you're going there in a browser.

 

perhaps the router has a better more realistic web log in it? if not, some kind of monitoring software or webfilter would need to be used.

[dsenette]

using those logs, it's kind of difficult to actually discern between actual views and ads. but.....the twitter.com and facebook.com ones aren't likely to be banner ads. the banner ads for those sites are to different domains. the fbcdn one is someone looking at a specific facebook image via a link. (I just assume the FB and twitter activity are the ones you're looking for the most).

 

basically, open DNS logs (or any DNS logs) aren't a good way to judge user activity since that's a DNS request....just because something is asking for an address doesn't mean you're going there in a browser.

 

perhaps the router has a better more realistic web log in it? if not, some kind of monitoring software or webfilter would need to be used.