Theres a number of locations where an authentication session can be expired i.e. by clicking a log off functione.g. admin\security\logoff.aspx.vb ,components\authentication\authenticationcontroller.vb etc. Alternatively if there is a period of inactivity, then the forms authentication ticket (cookie) automatically expires. When a page is next called the user's session is no longer authenticated, so they get served the anonymous content. As the information is lost, it  very difficult to determine if a user is a brand new session (i.e. a brand new visitor), or a recently expired session (I believe this is what you're asking)

Cathal