Hacker Detection

You can monitor attempted server break-ins with CDR. If the termination type (Field 15 or TT) equals 4 (Caller/user disconnected by the server), then the mailbox fields (FMBX and TMBX) will have invalid numbers you can examine. The invalid mailbox and passcode fields (Fields 16 and 17, ME and PE) would have entries. FMBX, TMBX and TNUM then contain the three invalid numbers. Fields names are specified in the CDR Fields table, and termination types in the CDR Termination Types table. An example of how the CDR output might look is shown here:

275284 071892 025236 025422 0401 0000 0106 00000000000 00000019999 00000012345 00000000000 00000054321 12 01 04 02 01 00 00 00 00 00 01 00 00 00