Hello,
If you have active auditing policies in your system check if it is capturing invalid connection attempts. If so and if CONNECT statements are being audited you can check on yourauditing trail for that sort of info. If not, an option is to audit that sort of scenario.
An output of syslog with that sort of policy would look like:
[...]
Jul 27 16:25:02 <connect_to_host> HDB[31612]: 2015-07-27 16:25:02;indexserver;<hana_host>;YPE;00;30003;;10.2.125.96;<source host>;12148;64643;configuration change;INFO;CONNECT;SYSTEM;;;;;;AA_USER;UNSUCCESSFUL;;;;;;invalid username or password at ptime/query/catalog/userinfo.cc:958;;401858;<application user>;
[...]
Check the auditing documentation for more info: Activate and Configure Auditing - SAP HANA Administration Guide - SAP Library
Not sure if this is the best option though.
Any other options community?
BRs,
Lucas de Oliveira