Ghost 911 Calls, where are they coming from?

[KnowItAllmost]

Hello Gurus,

Lately there have been a few outbound 911 calls happening that no one claims to have initiated.

I delved into the CCC database and finally was able to squeeze out a report of outbound calls, their numbers and their origin.

Unfortunately, the 911 calls in question are not associated to any extension. I tried a test 911 call from the IT extension and the extension does show on the report.

So, the question is; if there is an outbound call not associated to an extension, where could it be originating? The 911 dispatcher indicated that they only hear static on the line (almost dead air).

Could the calls originate from VoiceMail? I am not sure even where to start looking.

Any help would truly be appreciated.

Thanks

IPO 412 3.2.

 

[GhostZman]

you might want to think about installing a trial version of Chronicall and having it monitor activity. Another thing you might want to do is to remove the 11 from the ARS table. I had people dialing 9 for an outside line, then 1 and then advertly hitting the 1 a second time. It dials 911 then.

 

[CarGoSki]

run sysmon and save traces

 

[telemarksman]

Is there DSL on one of the lines, and or an alarm system?

Sometimes those items will cause phantom 911 calls.

alwayslearning

 

[KnowItAllmost]

Hello Gurus,

I have figured out how to track those pesky 911 calls. It is just a SQL statement executed against the SDXArchiver database. You do have to have admin access to the db (Windows or sa).

USE SDXArchiver

select top 1000 _tblIndex.DateID, CCS, CDUR, NDBO, tblNames.DN, tblNames.strName from _tblIndex
left outer join tblCallFlow on _tblIndex.RecordNum = tblCallFlow.RecordNum
join tblNames on tblNames.intNameID = tblCallFlow.LRN
where NDBO = '911' OR NDBO = '9911'
group by _tblIndex.DateID, CCS, CDUR, NDBO, tblNames.DN, tblNames.strName
order by dateID desc

This will result in a nice list of 911 calls and their origin.

 

[IPGuru]

dis you locate your phantom caller & resolve the issue?

Computers are like Air conditioners:-
Both stop working when you open Windows

 

[KnowItAllmost]

Hi IPGuru,

I did locate those calls, because the above SQL query does return the extension and user that originated the calls, and there was no phantom caller, just various slightly confused users.

It is basically user error. People are going just a little too fast and hitting the one twice when they dial 9 for secondary dial tone and then are going to dial long distance (9,11, oops!).

They try to hang up right away, but it only takes a couple of seconds for the 911 system to get the ANI, and ALI 4 seconds or so after that, so most misdials of this nature get through and trigger a callback or response.

 

[amriddle01]

Change to a different prefix, is kind of a symptom of a silly emergency services number though

http://www.ipoffice.tel