You can view this problem differently, depending on how scalable you need it to be.

IMHO, you should be thinking of using a web proxy, and making users go through one, and logging access requests there.

The packet capture and Winsock methods will work when you have a small number of machines. Actually, you can packet-capture and filter for a larger scale, but the capture point should be close to where traffic leaves your network to go to the Internet (Unless you want to get local web browsing as well).

Anyway - I think this provides the options you asked for.