User manual

Sandstorm does not warrant that the emergency number screening feature will block all attempted calls to

emergency numbers in your area. PhoneSweep will not attempt to automatically block calls to emergency

numbers other than those listed in the emergency number screening list. It is your responsibility to be

aware of the emergency numbers in your area, and to block them or avoid including these numbers

when creating lists of phone numbers for PhoneSweep to dial. If you are outside the United States or

Canada, please be aware of your local emergency numbers and take care not to include them during a

PhoneSweep scan.

Emergency number screening is controlled on the Setup->Dialing sub-tab. It is strongly suggested that

screening 911 and 9111 be left on the emergency number screening list and enabled in the US and

Canada.

2.13 Possible Testing Injuries

Scanning phone numbers with PhoneSweep can create undesired results. These results are collectively

known as “testing injuries.” Accepting the possibility that testing injuries may occur as a result of using

PhoneSweep is part of accepting the PhoneSweep license agreement. Happily, if you are aware of the

possible testing injuries that can result from using PhoneSweep and how to prevent them, you can

generally avoid them. Use of SCD can also reduce the risk of certain testing injuries.

Possible testing injuries include, but are not limited to:

• Calling local emergency services. PhoneSweep attempts to block (not place calls to) the

emergency number 911 and other emergency numbers specified by you on the emergency

number screening list for each profile. Be aware of emergency numbers in the area where you are

scanning, and do not include these numbers in dialing profiles. Emergency number screening can

be disabled, but Sandstorm strongly recommends that it be left enabled in North American

environments.

• Calling human-answered phones in fax mode. Scanning for fax machines requires an audible

beeping. If PhoneSweep is scanning in fax mode, people who answer the call will be aware that a

telephony device has called them. If your users don't know that PhoneSweep is being used to

conduct a security audit, this may cause complaints. Users aware of security issues and

procedures may be concerned that they are being “war dialed” by an outsider. This testing injury

is largely avoided with SCD, because when SCD hears a voice answering a call, no fax tones are

sent.

• Calling human-answered phones while scanning for ISDN-capable devices. Some ISDN-

capable devices produce a loud, audible beep when calling a voice line. We suggest you only scan

for ISDN-capable devices when there is a low probability of a human answering the call.

PhoneSweep cannot prevent this testing injury because to date, no ISDN modems support SCD.

• Repeatedly calling a single location after business hours. In some organizations, all calls may

route to a single central point, such as a security desk, after business hours. This is sometimes

referred to as "Night Service". PhoneSweep will only generate useful results when night service

is not in effect, or is switched off for the duration of the scan.

• Inadvertently making a phone call while testing COM ports. To test COM ports, PhoneSweep

employs a helper program, checkmodems.exe. Checkmodems.exe dials the digits “55” in order to

test a COM port. If your local PBX (private branch exchange) is configured so “55” is a valid

number, checkmodems.exe should not be run while any modems are connected to the telephone

switch.

• Leaving blank voicemail messages. If a voicemail system answers, PhoneSweep may not

automatically hang up before a message is recorded. If this occurs, PhoneSweep can usually be