The logged-in counter is real. The lurker counter is bogus. I clicked on the link. Am I there, or not? Not, as it turns out, but because I clicked once, I'm counted as "online." If you invent a standard like that you can toss around any number you want.
The point is that there is NO WAY to know whether someone is really "on" a Web site. All you know for certain is that they requested a page. All else is guesswork.
Here's how to implement the guesswork, if you regard guesswork as good enough:
Give unlogged visitors a session cookie. When you do, record that event with a timestamp.
For a cookied request, refresh the record.
To compute the number of anonymous users online, count the number of records where the timestamp is no older than N seconds, where you invent N.