How to check outgoing and incoming traffic from/out sip trunk provider

[camtec]

Dear All,
May you please advise how to How to check outgoing and incoming traffic from/out sip trunk provider. Currently, I am having complain that International Calls are being triggered from our 3CX system. But as verified for the problematic numbers, we do not see in our reports for the outgoing call to oversea. Anyway, customer still asking for some references like Traffic to that respective trunk providers, so we want to see in the 3CX or Linux (Cloud Linode hosted 3CX) for some reference for proof that we do not have this issue on the international call or ghost call or hacked call from our 3CX system.

Thanks so much to let us know.

Regards,
Ney

 

[YiannisH_3CX]

Hello @Ney,

One way is to run a general call report and try to identify if any of the calls are fraudulent. You can also check the call log or the activity log for some logs.

You should also check your providers portal and see if they can provide a report for inbound and outbound calls to the system.

 

[camtec]

Thanks you YiannishH_3CX. Yes, according to their sheet for the problematic number, i could not find in my reports in 3CX for Call Reports.

May I know in activity log where is the location of this log in Linux where 3CX installed?

Thanks you.

 

[YiannisH_3CX]

The activity log is located on the Dashboard and you can see it directly from the management console. You can increase the logging level to capture more details and try to cross reference a call to that log and see if it originated from the PBX.

 

[camtec]

Yes, thanks. As per checked Activity Log setting, the current log level is "Medium" and Keep backup of log files for 10 days. So it is gone as or now it is 6th Dec.
In Activity Log and log files i could see:
- Global
- Instance
- Linux Syslong
3CXCallFlow.061759.log
3CXCallFlow.213557.log
3CXConfService.2021-11-18.023738.log
3cxManagementConsole.142345.log
3CXPhoneSystem-20211126-063036.blrec
3CXPhoneSystem-20211126-225618.blrec
3cxSystemService.172737.log
3CXWebMeeting.2021-11-25.235900.log

 

[YiannisH_3CX]

Those are system logs for logging and troubleshooting the various system functionalities. Those will NOT provide any call details. If your calls happened more than 10 days ago then your only options are the call log and the reporting functionality.

 

[camtec]

Yes, from the report exported, we checked for the problematic subscribers and not found in our 3CX system/report. But customer still convey that would be triggered somewhere in 3CX and need us to spot check the traffic coming to their end. This is sip trunk with given username and password to set in our 3CX sip trunk. I am afraid those username and password has been used with other 3rd party application or the trunk provider itself used in any unauthorized pbx system and it got hacked at their end. Has this happened and been raised similar issue like this?

 

[YiannisH_3CX]

If the call is not in the reports and call log then there is nothing more to check in 3CX if your logs do not go back further enough.
For future traffic you can enable verbose logging in the Activity and run tshark to packet capture all traffic until the issue is replicated.
If the credentials were stolen then it will be really hard to detect. You can run a packet capture and capture a registration message. If you open the 200 OK message from the provider you might see 2 contact lines which will indicate that the trunk is registered on another machine as well but not all providers include this info.
If you want to be sure then you could change the trunk credentials and all relating credentials that might have been compromised.
Weak credentials or sharing information with the wrong people have caused issues in the past but it's always the administrators job to secure the PBX. 3CX provides all the necessary tools to keep you safe but the administrator has to use them correctly.