If I sniff packets or DNS requests using Wireshark, OpenDNS, or a similar tool, will I only see (via wireshark) that a TOR user has connected to a TOR entry node, or will I be able at all to determine *which* website is ultimately being requested on the part of the user. Additionally, isn't it true that TOR does not use DNS resolution, and therefore tools like OpenDNS could not even detect TOR traffic?

I am currently under the impression that Wireshark can only detect that one is connecting to TOR, and not what data is actually being accessed/transacted on the web.