In which configuration mode is show users used?

The show users command is entered in Privileged EXEC mode on Cisco IOS devices.

SystemPrivileged EXEC

show users

Displays active user sessions on the router, including line type, idle time, and remote IP addresses, useful for monitoring who is logged in and troubleshooting connectivity issues.

Definition: show users is a Cisco IOS privileged exec command. Displays active user sessions on the router, including line type, idle time, and remote IP addresses, useful for monitoring who is logged in and troubleshooting connectivity issues.

Overview

The 'show users' command is a fundamental diagnostic tool in Cisco IOS that displays active user sessions on a router or switch. It provides a real-time snapshot of who is logged into the device, how they are connected (console, VTY, AUX), how long they have been idle, and the remote IP address for network-based connections. This command is essential for network administrators to monitor administrative access, detect unauthorized sessions, and troubleshoot connectivity issues related to remote management.

The output includes the line type (e.g., 'con' for console, 'vty' for virtual terminal), the user ID (if authentication is configured), the idle time in minutes, and the remote host IP address for Telnet/SSH sessions. Unlike 'show sessions', which shows outgoing connections from the device, 'show users' focuses on incoming sessions. It is often the first step in a troubleshooting workflow when a device is unresponsive or when multiple administrators are making changes, as it helps identify who might be causing configuration conflicts.

The command requires privileged EXEC mode (enable) and does not affect the running configuration. In some IOS versions, the output may be buffered, meaning it reflects the state at the time of the command rather than a continuous stream. Understanding this command is crucial for CCNA and CCNP candidates as it ties into security best practices, access control, and network management protocols like SSH and Telnet.

Syntax·Privileged EXEC

show users

When to Use This Command

Check if unauthorized users are connected to the router via Telnet or SSH.
Verify your own session details when troubleshooting a hung connection.
Identify idle sessions that should be terminated to free up VTY lines.
Confirm remote IP addresses of administrators accessing the device.

Command Examples

Basic show users output

show users

    Line       User       Host(s)              Idle       Location
*  0 con 0                idle                 00:00:00   
   2 vty 0     admin      idle                 00:05:23   192.168.1.100
   3 vty 1                idle                 00:12:10   10.0.0.5

Line: line number and type (con=console, vty=virtual terminal). User: username if authenticated, blank if not. Host(s): connection state (idle, active). Idle: time since last keystroke. Location: source IP address for remote connections. The asterisk (*) indicates your current session.

Show users with active SSH session

show users

    Line       User       Host(s)              Idle       Location
   0 con 0                idle                 00:00:00   
*  2 vty 0     jdoe      idle                 00:02:15   192.168.1.50
   3 vty 1     admin      idle                 00:10:30   10.0.0.1

Your session (marked with *) is vty 0 as user jdoe from 192.168.1.50. Idle time shows 2 minutes 15 seconds since last activity. Other sessions can be cleared with 'clear line vty 1' if needed.

Understanding the Output

The 'show users' command output lists all active user sessions on the router. The first column 'Line' indicates the line number and type: 'con 0' is the console port, 'vty 0-4' are virtual terminal lines for remote access (Telnet/SSH). The 'User' column shows the username if login authentication is configured; blank means no username required.

'Host(s)' typically shows 'idle' or 'active'—idle means the session is waiting for input, active means a command is being processed. 'Idle' time is the duration since the last keystroke; a long idle time (e.g., >15 minutes) may indicate an abandoned session. 'Location' is the source IP address for remote connections; for console, it's blank.

The asterisk (*) next to a line marks your current session. In a real network, use this command to verify who is accessing the device, especially after configuration changes or security incidents. High idle times or unknown IP addresses may indicate a security risk.

If you need to disconnect a session, use 'clear line <line>' in privileged EXEC mode.

Configuration Scenarios

Monitoring Remote SSH Sessions on a Branch Router

A network administrator suspects that an unauthorized user has gained SSH access to a branch router. The administrator needs to verify all active sessions and identify the source IP addresses.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2
Admin PC (192.168.1.100) --- SSH --- R1 (10.0.12.1)

Steps

1.Step 1: Access the router via console or SSH: Router> enable
2.Step 2: Enter privileged EXEC mode: Router# show users
3.Step 3: Review the output. Look for lines with 'vty' (virtual terminal) and note the remote IP addresses.
4.Step 4: If an unknown IP is found, use 'show ip ssh' to verify SSH configuration and 'debug ip ssh' for detailed session info.
5.Step 5: To disconnect a suspicious session, note the line number (e.g., 2) and use 'clear line vty 2'.

Configuration

! No configuration needed for show users; it is a monitoring command.
! To enable SSH for remote access:
Router(config)# ip domain-name example.com
Router(config)# crypto key generate rsa modulus 2048
Router(config)# username admin secret cisco
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local

Verify: Command: show users Expected output: Line User Host(s) Idle Location * 0 con 0 idle 00:00:00 2 vty 0 admin idle 00:05:23 192.168.1.100 3 vty 1 admin idle 00:02:10 10.0.12.2 This shows two SSH sessions from 192.168.1.100 and 10.0.12.2.

Watch out: The 'Idle' time shows how long the session has been idle, not the total connection time. A session with high idle time may indicate an abandoned connection that should be cleared.

Identifying Console Session Conflicts During Configuration

Two network engineers are simultaneously configuring a core switch. One engineer is on the console, the other via SSH. They need to ensure they are not overwriting each other's changes.

Topology

Switch1 (Console port)---Serial cable---Admin1 Laptop
Switch1 (Gi0/1)---192.168.1.0/24---Admin2 PC (192.168.1.50)

Steps

1.Step 1: Connect to the switch via console: Switch> enable
2.Step 2: Run 'show users' to see all active sessions.
3.Step 3: Note the console session (line con 0) and any VTY sessions.
4.Step 4: Communicate with the other engineer to coordinate changes or use 'reload in 10' to schedule a reload if needed.
5.Step 5: If a session must be terminated, use 'clear line console 0' (for console) or 'clear line vty <line-number>'.

Configuration

! No configuration needed for show users.
! To set a timeout for console inactivity:
Router(config)# line console 0
Router(config-line)# exec-timeout 5 0

Verify: Command: show users Expected output: Line User Host(s) Idle Location * 0 con 0 idle 00:00:12 1 vty 0 admin idle 00:03:45 192.168.1.50 The asterisk (*) indicates the current session.

Watch out: The asterisk (*) marks the line you are currently using. If you see multiple VTY sessions, be careful not to clear your own session. Always verify the line number before using 'clear line'.

Troubleshooting with This Command

When troubleshooting network device accessibility, 'show users' is often the first command to run. A healthy output shows only expected sessions: typically one console session (if locally connected) and a few VTY sessions from known management IPs. Problem indicators include: unexpected remote IP addresses (possible unauthorized access), multiple sessions from the same IP (potential brute-force attack), or sessions with very long idle times (abandoned connections consuming resources).

The 'Idle' field is critical; a session idle for hours may indicate a forgotten terminal that could be a security risk. The 'Location' field shows the source IP for VTY lines; if it shows '0.0.0.0' or an unexpected address, investigate further. For console sessions, the Location is blank.

If the output shows no VTY sessions but you know SSH is configured, check if SSH is enabled and if the VTY lines are configured for SSH input. To correlate with other commands: use 'show line' to see detailed line parameters and 'show ssh' to see SSH-specific session details. For debugging, 'debug ip ssh' or 'debug telnet' can provide real-time session establishment info.

A step-by-step diagnostic flow: 1) Run 'show users' to list sessions. 2) If an unknown session is found, note the line number and source IP. 3) Use 'show ip ssh' to verify SSH configuration and 'show ip interface brief' to check management interface status. 4) If necessary, clear the suspicious line with 'clear line vty <line-number>'. 5) Monitor for recurrence; if the same IP reappears, consider ACLs to block it. 6) For console issues, check the console cable and terminal settings (baud rate, etc.). Remember that 'show users' only shows active sessions; it does not show failed login attempts. For that, use 'show login' or 'show logging'.

In high-security environments, combine with AAA logging to track all access attempts.

CCNA Exam Tips

CCNA 200-301: Remember that the asterisk (*) indicates your own session; you cannot clear your own line.

CCNA 200-301: Know that 'show users' is used to identify which VTY line to clear with 'clear line'.

CCNA 200-301: Understand that idle time is reset on each keystroke; a long idle time suggests an unattended session.

CCNA 200-301: Be aware that 'show users' does not show encrypted passwords; it only shows usernames if configured.

Common Mistakes

Mistake 1: Confusing 'show users' with 'show running-config' to see user accounts; 'show users' shows active sessions, not configured users.

Mistake 2: Trying to clear your own session (the one with the asterisk) using 'clear line'; this will disconnect you and is not allowed.

Mistake 3: Assuming 'Idle' time is the total session duration; it is actually time since last activity, not total uptime.

show users vs show ssh

Both 'show users' and 'show ssh' are used to monitor user connections on a Cisco device, but they serve different purposes. 'show users' provides a general overview of all active user sessions (including console, telnet, SSH, etc.), while 'show ssh' focuses specifically on SSH server sessions and their cryptographic parameters. Network engineers often confuse them when trying to troubleshoot SSH connectivity or verify session encryption.

Aspect	show users	show ssh
Scope	All active user sessions (console, aux, vty lines)	Only SSH v2 server sessions
Output Detail	Line type, idle time, remote IP address	Session ID, version, encryption cipher, authentication method, username
Configuration View	Does not display SSH configuration details	Shows SSH parameters (host key type, rekey timeout, etc.)
Protocol Specificity	Protocol-agnostic (includes Telnet, SSH, console)	SSH-exclusive, no non-SSH sessions
Troubleshooting Focus	General connectivity or inactivity issues	SSH authentication failures or encryption mismatches

Use 'show users' when you need to see all currently active administrative sessions (including console and Telnet) or check idle times to release stale lines.

Use 'show ssh' when you need to verify that SSH sessions are established with proper encryption and authentication, or to identify active SSH connections during security audits.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the 'show users' command syntax and output are nearly identical to classic IOS. However, IOS-XE may include additional fields such as 'Session ID' and 'Service' (e.g., SSH, Telnet). The NX-OS equivalent is 'show users' as well, but the output format differs: it displays 'USER', 'TTY', 'IDLE', 'LOGIN TIME', and 'LOCATION'.

For example: 'admin pts/0 00:00:12 10.1.1.1'. NX-OS also supports 'show session' for detailed session info. On ASA firewalls, the equivalent command is 'show who' or 'show ssh sessions' (for SSH) and 'show telnet sessions' (for Telnet).

The ASA 'show who' output shows user, connection type, and IP address. In IOS-XR, the command is 'show users' but it is used in the XR environment; the output includes 'Line', 'User', 'Host', 'Idle', and 'Location' similar to IOS. There are no significant differences between IOS 12.x, 15.x, and 16.x for this command, though newer versions may support additional parameters like 'show users all' to include all lines.

Always check the specific platform documentation for exact syntax.

Related Commands

show ssh

Displays the status and configuration of SSH server connections on a Cisco device, used to verify SSH sessions, authentication methods, and encryption settings.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions