The rwho command produces output similar to who, but for all machines on the local network.
This SonicWALL signature identifies legitimate Rwho traffic.