I am currently working on a project related to packet sniffing which has been implemented using the concept of raw sockets. I am using C language.
I am able to decode the following details from the packets received from a local network,like:
source and Destination Mac Address
source and Destination IP Address
source and Destination port no

But I am having trouble in decoding the domain name when an user in the local network is logging onto internet.For eg. if a user in the local network is trying to log on to web using his browser say if he has logged on to www.google.com then from the packet I need to get the following details

source Mac Address from which user had logged on
source IP Address from which user had logged on
domain name

I'm afraid it isn't usually that simple. To accomplish this, you would need to look for a few different things.

Namely, when a user connects to www.google.com in their browser, the browser will attempt to resolve the name to an IP address using DNS. Provided the machine doesn't have a cached value for the domain in question, the machine will send out a DNS request to it's configured DNS server and await a reply. This request is simply a UDP packet sent to port 53 so it too is something you can glean out of a traffic capture.

That being said, HTTP does actually pass the page requested by the user's browser in the GET request it makes. This will be the "Host:" attribute you see in the packet and is likely the easiest way to determine what domain the user was attempting to connect to.

Once you have determined the packet you are interested in looking at, you can pull the source MAC address out of the Ethernet header and the source IP address from the IP header.

Does that answer your question or help?

Jon Hannah
Sr. Network Engineer
jhannah@hostmysite.com
HostMySite.com