Device Detection

The Redwood Filter Engine supports logging User Agent (UA) strings which are parsed by the Device Detector App of the Log Cabin Console.

User Agents

A combination of Application, Operating System and Device & Brand information can often be extracted from User Agent (UA) strings, as can be seen in the examples below.

Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405
Brave/8.0.6 CFNetwork/720.5.7 Darwin/14.5.0 (x86_64) (Linux; U; Android 5.1.1; en_US; SM-T280; Build/LMY47V) (Linux; U; Android 5.1.1; en_US; SM-T280; Build/LMY47V; Cronet/64.0.3282.137)
Acrobat/10.1.16 CFNetwork/720.5.7 Darwin/14.5.0 (x86_64)

The Realtime Log Viewer displays the UA string if Redwood is configured to log UAs, and the app passes the User-Agent header.


Application Detection powers the Applications Section of Usage Reports.

Case insensitive regular expressions can be used to match the User-Agent value in the header request header, so that the network administrator can create an Application Group and assign it to an Access Policy to control access by application.

This technique will only be effective for apps that include the User-Agent header on all http methods.

Devices and Brands

Many mobile device types and brands can be detected by parsing the UA string. At this point, the Device data is not used for either filtering or reporting.

Operating System

The Operating System of devices on the network can usually be determined after parsing the UA string. The Operating System data is only used for convenient grouping of Applications.