Google Analytics tracks the following acquisition types (ways in which its users reached your site):
A direct link means entering a site name directly into the browser URL. A search means doing a google search and clicking on one of the results. A referral means someone clicked on a hyperlink which got them to your site.
It is obvious that since google search is run by google, clicking on a link in the google search results can submit the information of what clicked to the google analytic servers.
What is obvious is the other two cases (direct link and referrals). It seems to me that since these requests don't go through google, that google would have to own some software on interim TCP/IP routers for this to work.
So, my question is, how does Google Analytics manage to track referrals and direct links at the software level?
So, my question is, how does Google Analytics manage to track referrals and direct links at the software level?
If there is no referrer (accessible via http headers) it's a direct type-in. If there is a referrer and it's not from a list of known search engines or social networks it's a referrer.
Since the referrer is accessible via javascript (via document.referrer) (it gets it from the http headers) there is really not mystery here and they do not need to intercept traffic - source attribution works simply by way of exclusion (i.e. if it's not campaign traffic as per campaign parameters in the url it's a referrer or a direct visit).
In fact Google has a very nice flowchart to show how source attribution works. Once you realize that the referrer is public information (except for those user agent that choose not to send a referrer in the http headers) it's easy to understand how this works.