They know that someone accessed resource X from IP address Y from browser Z with language preferences A, encoding preferences B, SSL cipher suites C (when https is used), DNT preferences D, sometimes also protocol support E (when upgrading to SPDY or HTTP/2.0), having a TCP/IP fingerprint of OS F. I guess I still haven't covered it all.