0

I have a HTTP sniffer application which runs on C++ , when I am getting the user agent field I get something like : 

Mozilla/5.0 (Windows NT 6.1; WOW655970812; fr=0ea2JbE8UfOtMxCAb.AWUSc_K0DPt0NpgvgWvZVDCZzug.BSHX4S.8d.FIo.AWUtAj4s; xs=1%3AFOApj11sTU3NXA%3A0%3A1378405752%3A6395; sub=128; p=129; act=1378934556224%2F153; presence=EM378935116EuserFA21655970812A2EstateFDsb2F1378934519166Et2F_5b_5dElm2FnullEuct2F1378934511240EtrFA2close_5fescA2Etwlocale=tr_TR; c_user=1655970812; fr=0ea2JbE8UfOtMxCAb.AWUSc_K0DPt0NpgvgWvZVDCZzug.BSHX4S.8d.FIo.AWUtAj4s; xs=1%3AFOApj11sTU3NXA%3A0%3A1378405752%3A6395; sub=128; p=129; act=1378934556224%2F153; presence=EM378935116EuserFA21655970812A2EstateFDsb2F1378934519166Et2F_5b_5dElm2FnullEuct2F1378934511240EtrFA2close_5fescA2EtwF4219503720EatF1378934899190EwmlFDfolderFA2inboxA2Ethread_5fidFA2user_3a626679213A2CG378935116367CEchFDp_5f1655970812F195CC

This doesn't happens often, but still enough to cause problems in my customer's database. It seems for sure I need to make a sanity check while getting this field and after getting this field.

My question if the user agent information above somehow meaningful. If not what might be the cause for such strange user agent field in request header.

Improve this question
4
  • 2
    Either a fake UA ... or your app somehow got it wrong -- it looks more like a cookie data...
    – LazyOne
    Commented Sep 16, 2013 at 9:30
  • Similar to your saying I read that crawlers uses fake UA maybe that is my case. Or I am thinking there wasn't any crlf in the end of the useragent line so may application(which read until it finds crlf )take more than it should.
    – Kadir Erdem Demir
    Commented Sep 16, 2013 at 11:04
  • Another possibility: such request was done programmatically (not a real browser but custom program, e.g. PHP/Python/Java script or whatever) where all request headers were built manually .. and some of them were built wrong (due to programmer error .. or buggy library that was used). In any case -- this should fall under "fake UA" case.
    – LazyOne
    Commented Sep 16, 2013 at 11:31
  • Thanks alot , can you please list the reasons you wrote as an answer I will mark it as solution.
    – Kadir Erdem Demir
    Commented Sep 16, 2013 at 12:39

1 Answer 1

Reset to default
1

This UA string definitely looks broken -- I can say that this gibberish looks similar to content of the cookie header.

Most often reasons:

  • Fake UA (either used on purpose by some bot/script ... or it's a programmer mistake (or buggy library that was used) when whole request body and headers were assembled manually;
  • Your app got it somehow wrong.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.