You kan look at my Splunk for Mikrotik project here: viewtopic.php?t=137338
With this you can log all DNS request that every client does. (look at picture for DNS logs)
Requesting DNS does not actually means that the client do visit a site, but gives a good idea of what is going on.
Remember that when a client visit a site like ex www.cnn.com
it opens loots of tracker when opening the cnn.com
As you see below, when you do visit on site in your browser, you open actually at least 20+ sites.
It will also be DNS request for all this.
This I do always use Ghostery plugin for Chrome, to get a control of this and block most of this site.
Eks for www.cnn.com
* Amazon Associates
* NetRatings SiteCensus
* Bing Ads
* Integral Ad Science
* Bounce Exchange
* Twitter Advertising
* Outbrain Amplify
* Gigya Socialize
* Omniture (Adobe Analytics)
* Index Exhchange
* Optimizely Geographical Tracking
* Facebook Connect
PS for this forum (Mikrotik), you also visit Google Analytics.