Probably count tcp/http connection to sites at ISP? Of course it's not easy or accurate for us. Not NSA ;)

Another option for conspiracy theorists is to just get data from apache logs etc., because, you know, NSA has access to everything.

I don't have an answer for you, but a simple DNS lookup at the ISP wouldn't get you the whole picture. Lot's of local/LAN DNS caching.