Local area detection of incoming war dial activity

Two techniques for functional detection of local area incoming war dial are described. One technique employs a dedicated workstation looking for evidence of incoming war dial. We describe our experimental implementation of this technique, including alarm generation to a Cisco NetRanger(R) intrusion detection system. The second technique involves simple parsing of private branch exchange (PBX) call records for characteristic patterns of war dial. Baseline heuristics driving our algorithms are discussed. The non-terminated call detection limitations of this parsing technique for our Lucent Definity G3 PBX are discussed