also you don't count hfs working on lans that are not open to wan.
HFS would be the first if it were able to count its instances running on non-WAN LAN's.. or something
idea:
Create 2 tables in the database called period1 and period2. You store all the ip addresses of the first day into period1.
The next day, you store all the ip addresses in period2. At the end of that day, you search for duplicates in both tables. This result would be the user count. Clear period1 and start filling period1 with the information of the third day.
At the end of that day, search for duplicates and then clear period2, and start re-filling it with the information from the fourth day. etc.. etc..
for more accurate readings (as not all of us leave their fileserver online the whole day) you could make it check every 2 - 3 hours with the same method.