network detection

Z3R0DAY treats unauthorised internal scanner as hostile

An internal IP is scanning ports without authorisation. How to investigate, attribute the source, and identify the inbound session that established control.