Is it the Norm?

UA changes throughout multiple requests

[idiotgirl]

I've been paying close attention to logfiles - or at least I thought I was. How "normal" is it for a visitor's user agent and IP to change from one UA to another when the requests are made in succession?

I've had some really, really strange ones turn up lately server-wide (multiple domains). They come in as IE 5.5, next request they're Mozilla/3.0 (this seems to change if the request is an image file more often than an .html file even when the image file is requested simultaneously as part of the html file.)

But it's not always images + html calls. Straight html and cgi-requests show multiple user agents from the same visitor from one page to the next - within a minute or so from each call.

Different IP's, different UA's. It isn't just like a "dual proxy" or "AOL" thing so I can determine a pattern.

I don't think I have that many imaginative users opening multiple browsers. Multiple browsers is something *I* do all the time - but that isn't my core audience. 99% percent of my audience wouldn't bother... most wouldn't know how.

Maybe this happens constantly and I never noticed before. And if so, anyone know WHY?

[dcheney]

are you _positive_ that its the same user?

[idiotgirl]

Yup. Same IP, the only visitor there at the time, logical document request pattern. Often - but not necessarily - missing a referer.

Then sometimes the IP address changes one or two digits as they're cruising through.

It's happened hundreds of times in the past week. And I never SAW so many Mozilla/3's since this last week. But the changes in UA are not exclusive to Mozilla/3.0 UA's.

[dcheney]

sounds like a multiple proxy setup.

[idiotgirl]

Multiple proxy is going to change UA's within the same document view?

[dcheney]

the proxy might be sending a dummy UA (with different proxies set different, not sure why you'd want to do that...)

[idiotgirl]

Well, it's wreaking hell with my .htaccess filters and it appears that even though the IP or UA is not banned (I've checked them against my list), that once they arrive and THEN the UA changes after the intitial page view - the server (mine) is returning a 403 on files that require local_referal (images, mainly).

But even THAT is not consistent, so again - I can't determine a pattern. I'm not sure how to deal with the problem.

And why has this happened all of a sudden, I wonder?

[mack]

Could be something as simple as a dial up conection being terminated and then reconecting... the ip adress (if not static) would change .

[idiotgirl]

Mack - I don't think so. The views are done so orderly - they're like normal visits. And the requests are so close together it would seem it's the same session. The other thing that conerns me is the sudden proliferation of the occurrences.