Phone Callsbeign made from an unknown DID

[altolabado]

A number is being called that we are being billed for
and upon investigating it is possible that it is fraud.
I was wodering is there a way I could see this number in the ssytem at all it is a normal 7 digit NPA
Funny though is comes up as a number listed with the carrier as an actual number but I checked for a DID of this number and
non listed, I know I have seen it as a possible route Number. You know when someone makes an outgoing call
it shows on other parties call display. Is there a way I can see what possible extensions would be going out on this number?

Anything on this would be great help and deserves some serious stars!!

 

[ibceptor]

If you have a CDR running it would be easy. Just set up a PC running procomm as a tty and configure it for CDR.

 

[johnpoole]

when you print the dn in load 20 does it come back as a vacant number (no act no date)?.. if so check your clid table and make sure it's not their.. the clid table can show any number you perfer, not just a used number.. cdr on procomm is a sure catch.. easy to have a capture file turn off and on every 4 to 24 hours, then just do a search for *.cap files with the ext number as part of the txt

john poole
bellsouth business
columbia,sc

 

[Nortellian]

if these are copper trunks maybe someone has a phone cross connected to your trunks. Check all the wiring from bell's d-mark to your switch and look for any jumpers.

 

[johnpoole]

chances are if someone is using your trunk, the dual jumper is not in the switch room but at a crossbox down the road.. but if it's a did trunk, that is not the case, most people don't know how to jump on a trunk with no dial tone and place a call.. not real hard but you would need to either ground or wink start MOST did analog trunks...

john poole
bellsouth business
columbia,sc

 

[Nortellian]

Please explain a little more. It sounds to me like you are talking about trunk bills.

 

[johnpoole]

someone suggested that you may have an intruder on a trunk as opposed to an internal user, i don't think that is a very viable possibility.. if the number is not in your switch or clid table i would track cdr

john poole
bellsouth business
columbia,sc

 

[ArchTelecom]

If you don't have CDR turned on, temporarily turn it on and direct it to a port connected to a PC with a comm program (like procomm) and capture on. You can either parse with a spreadsheet, database or even do a simple text search after the incident happens again.