You can use the Application level variables to do this stuff.
Correctly pointed in one of the posts, use the Global.asa to declare Application level variables. And also check for more info on Application.Lock, Application.Unlock, using which you can lock and unlock the application variables, before incrimenting or decriminting the value, based on Session on Start and session on End.
Say a person logs on, now you have a new session starting, so you inc the Application level variable by one (before doing that you lock it, and after inc unlock it). Now in the Session on End repeat the same routine and also dec the value of the Application variable.
Hope it helps,
Reagrds,
Vikas