Well, the only thing I can think of when RECEIVING UNSOLICITED packets is to use reverse DNS. However, since you are "sniffing" HTTP, then it is simply a matter of catching all of the HTTP GET request headers, and mapping (an associative array) the actual IP address:port to the requested URL from the HTTP GET request header. Then, as packets come in from that IP, you retreive the URL by looking up the IP in your array... The thing is, in order to GET a TCP packet (using HTTP), you have to have made a GET request at some point: no unsolicited pushing of files onto your computer here. Every image and other resource on an HTML page is the result of a separate GET request. By the way, Sniffer80 is a piece of crap. It is not a sniffer. It is a cheap facade using URLMon. It is tied directly into IE. The source code is unnavailable, probably out of shame due to it's lame-ness. You could do the same by writing an IE add-in that copies the contents of the address bar... Anyhow, if I am way off the mark here, let me know. It seems like a simple solution to me though, since you already have all the information at hand before the TCP packets even start flowing.
