1

I am reading a log of my Learning Management System. I found two lines that look very odd.

2012-11-14 16:10:31 0.0.0.0 "<PERSON NAME>/<CITY>/<COMPANY>" do.<ADDRESS>.ru - GET /pics/mm_item_sel.gif - - - - - "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)+;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+InfoPath.2)"

2012-11-14 16:10:32 0.0.0.0 "<PERSON NAME>/<CITY>/<COMPANY>" do.<ADDRESS>.ru - GET /view_doc.html?doc_id=5300698214580765893&object_id=5808787579917258666&course_id=5766800087662725234&mode=learning_proc - - - - - "Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Trident/4.0;+Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)+;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+InfoPath.2)"

I have removed first and last names, but both lines were generated when the same person from the same account from the same computer talked to the LMS. The odd part is that user agents descriptions look exactly the same, except it is MSIE 8.0 in the first case and MSIE 7.0 in the second.

How could that possibly be? Is it some kind of bug?

Ivan Zamylin
  • 1,668
  • 2
  • 19
  • 35

1 Answers1

1

The visitor was most likely using IE8 and switched on compatibility mode, which changes the user agent to IE7. The Trident part of the user agent is only sent by IE8+, which gives it away.

Here's a detailed discussion of how to differentiate between IE7 and a browser running in IE7 compatibility mode .

Community
  • 1
  • 1
Kelvin
  • 4,909
  • 21
  • 35
  • I had the same thought, but how could the user switch on compatibility mode within 1 second? – Ivan Zamylin Nov 15 '12 at 21:15
  • 1
    The browser may have done it automatically - there are quite a lot of factors that can cause it to be triggered, but it's usually invalid HTML or a missing `doctype`. If it's a concern, [this question](http://stackoverflow.com/questions/637039/how-to-avoid-ie8-compatibility-button) covers how to prevent compatibility mode being triggered. – Kelvin Nov 15 '12 at 22:32