Tracking down device when QAUTOVRT is set to zero

I have a V5R3 system on which, for security reasons,
QAUTOVRT is set to zero.  Each device that connects is
assigned a device name and those individual devices
exist on the system.  Occasionaly, I see message
CPF8940 - Cannot automatically select virtual device,
because somebody, somewhere is attempting to connect
using a device that has not been defined.
Does anybody have an easy way, (and I know that easy
is relative) to determine what the IP address is of
the device that is trying to connect.
I say IP address because no signon has been attempted
yet, (no signon screen was even presented) so no user
profile has been entered.  With IP address, I could
look in our DHCP server and see which device, (MAC
address) was assigned the IP address that is now
trying to get a virtual terminal.
I have looked in QSYSOPR message queue, QTVDEVICE
joblogs, QINTER subsystem joblogs, QTCP server
joblogs, and probably most other joblogs and QHST. 
All I ever see is the CPF8940 message that tells me
some one was denied a device but does not tell me
where they came from.
Plan C is to run a TCP communications trace but the
problem is intermittent at best and there is a lot,
(and I mean a lot) of trace traffic that I would need
to go through to find it.  I was hoping some one had a
suggestion for a plan A or a plan B before I had to go
to plan C.

Thanks

Pat


Patricia Garrity
Garrity Systems, Inc

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com