9. The Alarm Filters
(Toll Fraud Detection)
The Alarm Filters allow NetLink II to monitor call records, and check for
characteristics of Toll Fraud or other forms of phone abuse. When suspect
calls are detected, NetLink II can send an SNMP Trap or an email message,
contact a local PC via the Console Port, or dial a modem or pager. The
Alarm Filter has priority over the Data Filter; even if a call is rejected by
the Data Filter, it will still be counted and stored if it matches an
NetLink II features two separate Alarm Filters. Each ﬁlter has its own
format, variables, and alarm criteria and separate operating hours and
counter reset schedules can be deﬁned for each ﬁlter. When two dissimilar
PBX units are connected to the NetLink II, this provides a separate Alarm
Filter for each. Each Alarm Filter includes a "Format", and one or more
"Clues" with associated "Actions". The Format describes the location of
speciﬁc data items within each call record. Alarm Filter Clues deﬁne the
criteria that determine whether or not a record will be ﬂagged and counted.
"Actions" determine how NetLink II will react when an alarm is generated.
• When the NetLink II is connected to two different types of PBX
units, it is recommended to deﬁne a separate Alarm Filter for
• An Alarm Filter deﬁned for one type of PBX may not function
correctly if applied to another type of PBX.
• Note that the Alarm Filter and Data Filter are two separate
features, and are conﬁgured independently from one another.
The function of the Alarm Filter is to provide notiﬁcation when
speciﬁc types of data are detected, and the function of the Data
Filter is to screen out irrelevant data.