User manual

119
What should I do about numbers that always time out?
Your response to numbers that consistently time out depends on your threat model. Typically, you should
check to see if the line is actually connected to anything. A number that always times out could be a
modem that does not pick up for a large number of rings, but this is uncommon and is not likely to be a
major security risk.
The PhoneSweep Report
Why is special handling of unprintable characters in Appendix A of the report necessary?
Unprintable characters cannot be represented in ASCII. On the Report sub-tab you can adjust the number
of non-ASCII characters that will be printed as numeric values on a single line. If this limit is exceeded,
PhoneSweep reports the number of characters not printed.
When a modem becomes disabled during a sweep, where are the errors recorded?
phonesweep.log in the top-level PhoneSweep directory.
Ethical Considerations
Can I get in trouble for using PhoneSweep?
Yes, if you use it without proper authorization, or in a manner that disrupts business or violates laws. It’s
your responsibility to understand the relevant local laws and your organization’s policies.
How do I know that PhoneSweep will not hang systems that it calls? I’m concerned about
PhoneSweep disrupting business or services being offline to customers.
The first step is to conduct scans at times when services are not in heavy use, for example at night. Divide
your first scan into per-night scans. Also, before you begin production scanning, do a test scan on non-
critical systems to ascertain how your environment interacts with PhoneSweep.
PhoneSweep has timeouts that cause it to disconnect from a remote number after a specified amount of
time has passed. If remote software is not properly configured, calling that number without the proper
protocol can result in the system crashing or leaving the phone off-hook for several minutes. While there
is potential for disruption, note that remote software configured in this way is a serious Denial Of Service
vulnerability and should be corrected.
Miscellaneous Questions
What are the advantages of the SQL database?
The SQL database is flexible. It allows for easier updates and a wide range of possible import/export
formats. It also allows users to build customized reports using criteria more specialized than those in the
PhoneSweep report and the export options.
Will an RTF PhoneSweep report fit on a floppy?
The answer depends on the options selected and the number of calls in the profile. Note that if the report
is too large in normal RTF format, most data file compression tools will reduce the size significantly.