How to identify the origin of a invalid connection with sql1060
The APPID in the diagnostic log entry contains the IP address and port, albeit encoded in a weird manner (see note 11). The APPID is formatted address.port.timestamp. When the connection is local the "address" portion will be something like "*LOCAL" but obviously in this case it's remote.

The remote address and port are encoded in hexidecimal but the first character (of each) is munged so that "0" maps to "G", "1" to "H", etc. (there's probably some internal requirement for APPIDs to appear non-numeric). So in this case the remote address is:

GA381C80     -- original
GA 38 1C 80  -- split it up into the octets
0A 38 1C 80  -- de-munge the first char
10.56.28.128 -- convert to decimal


Same story for the port (O107 = 0x8107 = 33031). How the timestamp is decoded I can't recall (the page linked above claims it's the "unique identifier" portion but I could swear I remember it being a timestamp, or timestamp-based).