Trunk usage monitor and alert

[GregKeys]

Ethan, over on the green site, has put together a package to monitor trunk usage and alert on abnormal usage. It can be found at http://www.trixbox.org/forums/trixbox-forums/open-discussion/hacked-120000-phone-bill

My question is, has anyone tried this on a PIAF distro? I do not have a test box set up at the moment and am reluctant to put this on a production system blindly.

Something like this would really lower my stress level about someone hijacking my SIP trunks

Greg Keys

 

[wardmundy]

I plan to test it this weekend. Keep in mind that it would have reduced the company's bill from $120,000 to about $60,000. I guess that's better than nothing, but much more needs to be done. We'll cover it all on Nerd Vittles early next week.

 

[GregKeys]

I suspect that with a little modification it could be run on an hourly basis. That combined with my limited bandwidth and max channels on my trunk would keep me out of trouble

Greg

 

[wardmundy]

Haven't looked at the code but, from the way it was written up, it sounds like the processor overhead to do the calculations is quite substantial. So I'm not sure you'd want to be running it during times when you're actually using your phones unless you have a very beefy machine.

 

[krzykat]

Why not alternately set a max number of minutes that is tracked per hour or per day that if reached sends out the alerts. I think most people could know real quick what is norm for their PBX and just set a max value per hour or per day.

 

[tel0p]

interesting

I think the term that's was thrown around some years ago for this kind of thing is 'fuzzy logic'. It makes really good sense. This is also similar to what Visa/MC use to detect 'strange' usage patterns on your credit card...

Looking at the src it appears to be just a single PHP script run on a cron that make's 2 or 3 DB (SQL) queries to the CDR. In theory, this could probably be run from a 'master fraud detector box'..hmmm

Would like to hear the test results..cheers.

 

[jroper]

Hi

Always using pre-paid VoIP carrier is sensible where possible - yes you can lose money, but at least it stops when the credit runs out.

If you are really nervous about this, putting in A2Billing in the trunk path would also work. There is a feature to automatically top up an account daily, weekly or monthly via a cronjob.

Thus you set up a rate table - it does not have to be absolutely accurate, and work out what the daily spend is likely to be - set the credit limit to be a little more than that, and if someone starts firing an unusual number of calls via your system, (assuming they have not hacked it via the network, and bypassed A2Billing), then A2Billing will stop the outbound calls when the money runs out. You can investigate the cause and deal with it.

The next morning, the cronjob tops up the account, and away you go again.

Joe