The rwho command produces output similar to who, but for all machines on the local network.

This SonicWALL signature identifies legitimate Rwho traffic.