You kan look at my Splunk for Mikrotik project here: http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/1
With this you can log all DNS request that every client does. (look at picture for DNS logs)
Requesting DNS does not actually means that the client do visit a site, but gives a good idea of what is going on.
Remember that when a client visit a site like ex www.cnn.com it opens loots of tracker when opening the cnn.com
As you see below, when you do visit on site in your browser, you open actually at least 20+ sites.
It will also be DNS request for all this.
This I do always use Ghostery plugin for Chrome, to get a control of this and block most of this site.
Eks for www.cnn.com
Advertising
- Quantcast
- Amazon Associates
- DoubleClick
- NetRatings SiteCensus
- Bing Ads
- Outbrain
- KruxDigital
- Integral Ad Science
- ShareThrough
- Bounce Exchange
- Twitter Advertising
- Outbrain Amplify
Comments - Livefyre
Customer Interaction - Gigya Socialize
- Usabilla
Site Analytics - Omniture (Adobe Analytics)
- Chartbeat
- Optimizely
- Index Exhchange
- Gigya
- Optimizely Geographical Tracking
Social Media - Facebook Connect
PS for this forum (Mikrotik), you also visit Google Analytics.