I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to give a printout of the names of the websites that a host visited as well as a timestamp of when the visit occurred.
My initial thought is to do a standard capture on the LAN with a packet filter to monitor only for "udp port 53" traffic, inspect only DNS questions, and then save them to a hashmap by ip or MAC address. However this method will give somewhat cloudy results as any asset loaded on a page will make another DNS request. Going to say, https://amazon.com, actually triggers ~20 hostname lookups. Is there any sensical method of separating hostnames visited by a browser from ones that are requested simply for assets? One method I can think of would be to employ some sort of "debounce" timer where my script listens only to the first DNS question request made every 1000 milliseconds (give or take), that way I could at least ignore the first wave of assets loaded by any web page. Any thoughts on if this is a solid method for tracking webpages visited (both http and https) or suggestions for ways to improve it?