It's most likely just an error in terminology. They likely mean request instead of packet as the user-agent isn't in every packet.

If it was packet level it would likely be in the IP headers, I don't imagine it would be that difficult to rewrite the packets with optional fields and then put a token in the optional headers.