There are a few ways you can do this.
- Use Global.asa file
Inside the Session_Start event, store the session id, username (if there is one), date/time in a table. And then, on the session_end event, delete the row by session_id. I've heard this method is highly unreliable.
- Multiple updates
When the person logs in, or comes to your site, store the session id, username, current date and time in the table. Now, on every page, update that record with the current time and delete all records where the time hasn't been updated in X minutes (i.e 20 minutes) This will get you your listing.
Hope that helps.