How to identify the origin of a invalid connection with sql1060 I am getting a message similar to the next one:

2007-08-08-09.28.41.745208-240 I10292373A694 LEVEL: Error 
PID : 1720384 TID : 1 PROC : db2agent (DPADB) 0 
INSTANCE: XXXXX NODE : 000 DB : DPADB 
APPHDL : 0-154 APPID: GA381C80.O107.00D748132841 
DATA #1 : SQLCA, PD_DB2_TYPE_SQLCA, 136 bytes 
sqlcaid : SQLCA sqlcabc: 136 sqlcode: -1060 sqlerrml: 8 
sqlerrmc: YYYYY 
sqlerrp : sqlrrait 
sqlerrd : (1) 0x8012006D (2) 0x00000000 (3) 0x00000000 
(4) 0x00000000 (5) 0x00000000 (6) 0x00000000 
sqlwarn : (1) (2) (3) (4) (5) (6) 
(7) (8) (9) (10) (11) 
sqlstate: 


I want to know from which machine the connection is being tried.
Do I have to use a sniffer, or does DB2 have a tool to identify this point?
The APPID in the diagnostic log entry contains the IP address and port, albeit encoded in a weird manner (see note 11). The APPID is formatted address.port.timestamp. When the connection is local the "address" portion will be something like "*LOCAL" but obviously in this case it's remote.

The remote address and port are encoded in hexidecimal but the first character (of each) is munged so that "0" maps to "G", "1" to "H", etc. (there's probably some internal requirement for APPIDs to appear non-numeric). So in this case the remote address is:

GA381C80     -- original
GA 38 1C 80  -- split it up into the octets
0A 38 1C 80  -- de-munge the first char
10.56.28.128 -- convert to decimal


Same story for the port (O107 = 0x8107 = 33031). How the timestamp is decoded I can't recall (the page linked above claims it's the "unique identifier" portion but I could swear I remember it being a timestamp, or timestamp-based).