Change conn-tree to two-layers, first layer is keyed with the attacker's
IP, second layer is keyed with the attacker's port. Presence of the
attacker's IP on the first layer indicates it's an active attacker on
one of our targets. Second layer holds connection.