It seems that your understanding of the client-server communications for HTTP are a bit inaccurate. All that the server sees when a user goes to the site is "give me xxxxxx" followed possibly by "Give me yyyyyyy". You might interpret that to mean that the user spend the time between viewing xxxx and yyyyy looking at the page, but that isn't neccesarily the case. Another point is that it is impossible to tell when a user "closed the browser", however you can assume that they have left your site after they don't request a document for a given length of time. The whole here being that you have to make reasonable assumptions in order to hopefully get an idea about what might have happened.

As for solving your problem, I would probably split the log files up by IP address (which may or may not stay the same for a given user, but that is another discussion). then set a length of time that you consider to be too long to view one page, say 1 hour. Then whenever one hour goes by for a single user between page request you interpret that to mean the person quit surfing.

I hope this helps you out some. ;-)

-caedes