Method and apparatus for real-time collection of information about application level activity and other user information on a mobile data network. A collector device communicates with a router in a mobile data network so that the collector can obtain substantially all of the data coming from the router in real-time and correlate the data to specific users. The collector device comprises a user identity subsystem, filter, and data transfer subsystem. The user identity subsystem inspects the data for source IP addresses and correlates them to corresponding mobile phone numbers. The filter then inspects the collected data and retains only application-level data. Lastly, the data transfer subsystem transfers the filtered data to a data reporting and analysis system.