Thank you very much for help in finding the log.

I have the log now.  I'd like to know what to look for in trying to figure out how the calls are getting originated.  I'd be happy to shere all the information.  I just don't want to post information on this public list that might show other people how to get in to our box.

Thanks you,

Gary Kuznitz


On 22 Nov 2010 at 13:11, Danny (Danny Nicholas <danny@debsinc.com>) commented about RE: [asterisk-users] Someone has hacked into our :

From: Gary Kuznitz [mailto:docfxit@theoffice.la]
Sent: Monday, November 22, 2010 12:20 PM
To: Danny Nicholas
Subject: Re: [asterisk-users] Someone has hacked into our system

 
Thank you for the quick response.
 
Comments below...
 
I am not familiar with navigating Asterisk.  Would you please help me understand how to see the CDR?
 
Thank you,
 
Gary Kuznitz
 
By default, Asterisk keeps the CDR as a “flat-file” in /var/log/asterisk/cdr-csv/Master.csv which you can open in Excel for easy viewing.  If you have a custom cdr (see /etc/asterisk/cdr.conf  or /etc/asterisk/cdr_custom.conf for more information), your CDR might be stored in a MYSQL table or some other place. I would start under the assumption that you have the flat file available. Once you have it open,  use this link as a guide
http://www.voip-info.org/wiki/view/Asterisk+cdr+csv
 

Fields

  1. accountcode: What account number to use: Asterisk billing account, (string, 20 characters)
  2. src: Caller*ID number (string, 80 characters)
  3. dst: Destination extension (string, 80 characters)
  4. dcontext: Destination context (string, 80 characters)
  5. clid: Caller*ID with text (80 characters)
  6. channel: Channel used (80 characters)
  7. dstchannel: Destination channel if appropriate (80 characters)
  8. lastapp: Last application if appropriate (80 characters)
  9. lastdata: Last application data (arguments) (80 characters)
  10. start: Start of call (date/time)
  11. answer: Answer of call (date/time)
  12. end: End of call (date/time)
  13. duration: Total time in system, in seconds (integer)
  14. billsec: Total time call is up, in seconds (integer)
  15. disposition: What happened to the call: ANSWERED, NO ANSWER, BUSY, FAILED
  16. amaflags: What flags to use: see amaflags::DOCUMENTATION, BILL, IGNORE etc, specified on a per channel basis like accountcode.
You will want to see if there are any “peculiar” src fields on your international calls (dst).