I posted an explanation and some tricks here:
Referer explanationTo give you an example, here is a typical web server log entry:
127.0.0.1 - - <16/Aug/2005:04:53:00 +0200> "GET /barry2.jpg HTTP/1.1" 200 87353 "http://localhost/barry.html" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050324 Galeon/1.3.20 (Debian package 1.3.20-1)" "-"
As you can see, it consists of multiple fields, separated by spaces (some of the fields contain spaces and thus are quoted or bracketed).
The first field is the IP address of the request. The above request is local, but if you access a remote web server, this will identify your computer in the world wide web (either statically, or, if your IP address is assigned dynamically by your ISP, your ISPs log files are needed in addition to the IP address to identify you).
The second and third field can contain user names and are only interesting for authentication.
The fourth field is the time. The fifth field is the actual request string. In this example, the file barry2.jpg was requested. The sixth field is the status code (200 means OK. Another common status code is 404, file not found). The seventh field is the document size.
The eighth field is the referer. In this case, the file barry2.jpg was linked from the local file barry.html.
The ninth file is the user agent string and identifies your browser (if your system is honest :) ).
Some of these fields are provided by the client, some by the server. The IP address, the request string, the referer and the user agent string (plus the authentication information) are provided by the client. The other fields are provided by the server and give further diagnostics.