try creating a transparent proxy ... redirect all request for port 80 to your proxy server (ipchains).... and then analyse the proxy server logs ... The existence of the proxy is transparent to the user
user machine can be windows family also ............ then?
ranjeet