I am reading a log of my Learning Management System. I found two lines that look very odd.
2012-11-14 16:10:31 0.0.0.0 "<PERSON NAME>/<CITY>/<COMPANY>" do.<ADDRESS>.ru - GET /pics/mm_item_sel.gif - - - - - "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)+;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+InfoPath.2)"
2012-11-14 16:10:32 0.0.0.0 "<PERSON NAME>/<CITY>/<COMPANY>" do.<ADDRESS>.ru - GET /view_doc.html?doc_id=5300698214580765893&object_id=5808787579917258666&course_id=5766800087662725234&mode=learning_proc - - - - - "Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Trident/4.0;+Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)+;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+InfoPath.2)"
I have removed first and last names, but both lines were generated when the same person from the same account from the same computer talked to the LMS. The odd part is that user agents descriptions look exactly the same, except it is MSIE 8.0 in the first case and MSIE 7.0 in the second.
How could that possibly be? Is it some kind of bug?
The visitor was most likely using IE8 and switched on compatibility mode, which changes the user agent to IE7. The
Tridentpart of the user agent is only sent by IE8+, which gives it away.Here’s a detailed discussion of how to differentiate between IE7 and a browser running in IE7 compatibility mode .