3 Replies Latest reply on Dec 21, 2009 3:54 PM by jswan

    See what web sites user is going to

    sotherls

      Is it possible, using NTA, to see what web sites a specific IP is browsing to?

        • Re: See what web sites user is going to
          Andy McBride

          Yes. This can be accomplished by a Search by Endpoint. DNS will resolve the hosts in conversations from that endpoint.

          1 of 1 people found this helpful
          • Re: See what web sites user is going to
            Jesquitin

            You can use "Search by Endpoint" resource to find the conversations for a specific IP address

            1 of 1 people found this helpful
              • Re: See what web sites user is going to
                jswan

                I would be careful about inferring too much information from this technique. Many web servers host multiple sites on the same physical hardware and differentiate them with HTTP host headers; thus the PTR record that NTA resolves for the IP address might return a hostname different from the website that was actually visited.

                If you need accurate information on actual hostnames you will need to use a tool that tracks HTTP requests rather than just layer 3/4 information.

                One of the most common places I see this is with content distribution networks. On most days well over half of our HTTP download traffic is from CDNs like Akamai and LLNW, but it's impossible to tell exactly what websites are being visited without other tools.