How to correctly count traffic passing through the linux gateway by url, including https?

Question

linux

There is a gateway on Linux, now everyone goes to the Internet through transparent Squid. Is it possible to account for traffic by url (at least domains only), including https (mandatory) without using Squid ? Everywhere I only see examples for http, but now at least half of the sites are https. In theory, there are two options: netflow or squid (or another proxy). Everything that is described in detail (for example, xgu.ru/wiki/NetFlow ) is considered by IP. But one IP does not go far. How do ordinary people now consider https traffic from the local network to the Internet?

Answer 1

In short, by domains
1) In HTTP, yes, one IP can have a bunch of domains
2) In HTTPS, no - there may be subdomains, but there cannot be different ones. in the certificate it is explicitly indicated there, for example * .mail.ru - i.e. suitable for your task.
Make a hybrid of the above in my opinion