The following chart shows the top protocols that 172.16.44.52 is using to scan the network:
The chart shows that the behavior has been consistent for at least the last hour. In additionally there are large numbers of ICMP:3 (Destination Unreachable) messages, often associated with scanning behavior.
Finally, it is often useful to look at how the activity is distributed across the network.
