Hi,
socket ? If you look around, you can read a writing like "user online last 5 minutes " in about all "who's online" pages. This because most people are using a timed way to do this:
When a user click on a link, this link is loaded into db and a timestamp updated. A dB like that:
ID - key field, not null, unique, autoinc
USERID - id of user who click on link
LASTPAGE - text of link of last visited page
LASTTIME - timestamp
When you ask for "who's online" you get the result of a query asking for all users where now()-timestamp is 5 minutes or less.
I hope this helps you