Copy Link
Add to Bookmark
Report
Phr33k4z0iD Issue 2
Well we finally got some stuff to actully release the zine. Hopefully
Next issue will be easyer to get out on time. I had a computer problem that
killed my hard drive witch had the only copy of the zine. Anyways I'm still
working on the number directory. I've got quite a few number to call and make
sure they work.So if you plan on sending number please call them and make sure
they work. Thanks to everyone who help us get our 2nd issue out. Hopefully there
will be alot more.
ic0n
Table Of Content (TOC)
Verizon's Expanded Announcement System............ by captain b and ic0n
Exchange Scanning............................................ by decoder
ANI vs. ANAC What are they, and what's the difference?.......... by ic0n
Loop Maintenance Operations System (LMOS)............... by Brisk Attivo
How To Datu............................................ by Majestic 1/12
Maritime Telecommunication Network aka MTN...................... by ic0n
Frame Operations Management System (FOMS).................. by Anonymous
Verizon's Expanded Announcement System
Audio file portion by ic0n - Text file by Captain B
To skip directly to listening to the supplemental audio file first, which will
let you hear the menu prompts from inside the Expanded Announcement System, go
to:
http://goblin.crappyhosting.com/Expanded_Announcement.mp3
Telco error messages... We've all heard one at some point. An atypical error
message usually starts off with those 3 tones, known as S.I.T. (Special
Information Tones) followed by, "We're sorry. The number you have reached...
etc". But, have you ever wondered about the recording process for phone company
error messages, or how they're stored, accessed, modified, or deleted when need
be? Well, if you happen to live in my part of Verizon's service area, Verizon
maintains a phone system they call their Expanded Announcement System. Now, due
to the fairly potent nature of this system, I won't be disclosing certain
important specifics here, such as the phone number to dial, or the passcode to
enter in. But, I will tell you that once inside the system, you can listen to,
record, modify, or delete error messages. The thing I was kind of surprised to
learn about is that a single telco error message is usually 2 or more individual
recordings pieced together to form a single error message. And actually, the
system refers to those individual recordings as a "message". And, an entire
error message put together from those individual message recordings is called an
"announcement". Each individual message in an announcement is stored in a slot,
which the system refers to as a "position". And, every other position in an
announcement seems to be blank. (Doesn't contain a message). I think this is
because it contains a "message function" instead. Which, I believe tells the
system whether to play another message for the next position in the
announcement. And, if so, it would also tell it which one to play. Otherwise,
the announcement is deemed finished, and therefore ends if no message function
is contained in the next position. In other words, a message function serves as
the parameters within an announcement. And, as you probably guessed, there
exists a feature in the menus to "define a message function". And, although I
didn't mess with that feature to play it safe, I imagine it could be a fairly
involved process. By the way, if you were to record over an existing message
with one of your own, all announcements that used that particular message within
it would now feature your re-recording of that message. However, the system
seems to not allow for any recorded messages assigned for use in many
announcements to be recorded over. Apparently, this is some sort of failsafe
measure. However, you can always re-record a message that's hardly assigned much
for use within announcements, or Isn't assigned for use in any announcement.
Also, you can record a brand new message within any blank "message number" that
doesn't already contain a recorded message. Or, just use option 5 from within
the message administration menu (accessible from the main menu) to create a new
message/message number from scratch. The system information feature in the main
menu lets you listen to a list of open announcement numbers, message functions,
and open or unused message numbers. Unused message numbers are recorded, but
unassigned messages. Different announcements and message functions are stored
seperately in individual announcement numbers, and message function numbers on
the system. Just like how the different messages are stored seperately in
individual message numbers. All in all, Verizon's Expanded Announcement System
is pretty complex and vast, with a storage of thousands of messages, and lots of
announcements and message functions. And, an almost limitless number of ways to
combine them all. As a result, I would guess it could take a pretty good amount
of time to put together an entire announcement. Especially if It's all done from
scratch, rather than through modifying or using any existing messages, message
functions, or announcements. But, I don't think I recommend spending long
sessions logged into the Expanded Announcement System in the first place.
Especially not during regular Verizon business hours. (It's just good common
sense). Also, I don't know whether this system is logging ANI, either. Besides,
It's pretty obvious that they intended this system to be for telco tech
personnel use only, anyway. By the way, you don't have to live in my local or
regional area to access the Expanded Announcement System, since It's dialable
through a standard 10 digit phone number.
Shout outs: ic0n (as always), Hopping Goblin, OldSkoolPhreak.com and all the
Agents of Freedom, Dual Parallel, Stankdawg.com and all the forum krew over
there, all the people behind the screens at hackerhost.com, CueBiz and the
Telco Insiders, Decoder, Unity, Phreakblaze, White Raven, Bagel, Reaver, and all
the old LPH krew. And, the countless people who've helped me an ic0n make our
site www.hackerhost.com/lph what It's grown into.
Exchange Scanning
by decoder
August 7th, 2003
This is not a complete guide to exchange scanning. There are plenty of
files on the topic of scanning the full 10,000 block. I will be focusing
on the 'test' areas, most commonly found on the 'high end' (99xx) and 'low
end'(00xx) of an exchange, as well as 'special' exchanges. This should be
a useful guide for the beginner, but also interesting and informative for
even the most seasoned phreak.
Note: Many people say that the telco has equipment in every central
office to detect sequential dialing and excessive calls to toll-
free numbers. I do all of my scanning from home, by hand. I
encourage everyone to use their own discretion.
Introduction.
-------------
I happen to live in New York, where exchange scanning is pretty easy. All
of the test numbers can usually be found without too much time and effort,
which is good because I am lazy. My regional calling area consists of the
following NPA's:
212 Manhattan
917 originally NYC wireless, now also includes land lines in Manhattan
646 new Manhattan land lines and wireless
718 Brooklyn, Queens, the Bronx and Staten Island
347 overlap for 718
516 Nassau County (Long Island)
631 Suffolk County (Long Island) *(home of 2600)
914 Westchester County *(where the X-Men are from)
845 Rockland & Putnam Counties (and the southern part of Orange County)
203 Greenwich & Byram Connecticut
*[phreak phact: three of these NPA's (212, 914, & 203) are original
area codes from 1947. back then, customers didn't use the area codes,
they were only for operators.]
The most commonly know test number in these area codes is the 'verification'
number, which can be found on (NPA)NXX-9901. Keep in mind that this format
only applies to Verizon owned, land-line exchanges. (although there are a
few exceptions) These verification numbers give you the location of the
central office, and usually list most of the exchanges handled by that
particular c.o. Many people know of the 'Elvis' verification number
(718 238-9901). If you've never heard it, give it a call, it's always good
for a laugh. There is also a verification number that lists an exchange
that begins with a one (914 375-9901), which is apparently some kind of
'inward' exchange. (when you call it, the first exchange listed is 146!)
Most of these recordings are pretty old so some exchanges listed may not
work anymore and, of course there are some new ones as well. Sometimes, in
places where there has been an area code change, the verification message
will still give the old one.
When the exchanges are listed in non-sequential order, the first ones listed
are usually the oldest. This is what should be of interest. I have noticed
that in my area that the oldest exchanges in a c.o. are where you will find
most of the test messages, tones, payphone recordings, DATU's, etc. In New
York, these are found in the 'high end' (99xx) of an exchange, although
sometimes they hide the good stuff. There is a list of DATU's in NPA 718
making its way around the net, and they are not located in the 'high end',
they're all on random numbers. The list has been out for a while and all of
the numbers and codes still work. (most codes in 718 are NOT default, but
the codes are kind of simple anyway) This information originated on the PLA
(phonelosers) forums, and was posted by an ex-employee of Verizon. But
finding a DATU shouldn't be the main objective of exchange scanning. There
are many other cool things you can find.
Other areas.
------------
New York isn't the only place where the test numbers are in the 'high end'
of the exchange. Michigan, D.C., Maryland and many other places work the
same way. There are also areas where you should scan the 'low end'(00xx).
This seems to be the format in California and Pennsylvania. In Illinois, a
good place to look is in 12xx, and I've even found an exchange in Texas
where the tests are in 31xx. Although the 'high end' and 'low end' are the
most common, don't hesitate to check other sections. If you find a 1000 hz.
tone on NXX-6715, then scan out 67xx.
If you want to know all the exchanges in your central office, I'm sure that
there are websites where you can find such information. If you can't find
one, read a file on how to use a search engine. Sometimes you can just open
up your local phone book, and if you're lucky, the information will be in
there. One trick I use to find out which exchanges are the oldest is to
check what the Government numbers are. (police station, court house, library,
etc.) It stands to reason that these places will have their numbers on the
oldest exchange. After all, the police station has obviously been there for
a while, and I'm sure they wouldn't ever need to change their phone number.
If you live in a small town and your central office only has one or two
exchanges, then you don't have much work to do at all.
The Scan.
---------
I was inspired to do this scan when reading an old text file on exchange
scanning. (it can be found in 'BIOC's Guide to Basic Telecommunications vol.
one', as well as many other places) First of all, the area code has changed
since the file was written.(1980's?) Also, some of the numbers worked, but
most didn't, so I decided to scan the 100 numbers myself. I found that a few
of the original recordings were still there, but on different numbers. I
also found a few other cool things, so here is the updated and expanded
version of that old text-file. (find the old scan, you'll see it's not much
different than mine) This should prove that 15 or 20 year old text files are
still worth reading, not only to know your history, but they can also be
semi-useful. The old skool is alive and well.
1(845)268-99xx:
9901 welcome to the Congers DMS-100 central office, using codes 268,
267, 261 and 979. (261 and 979 don't seem to work anymore)
9903 rings once, then plays six DTMF tones
9909 we're sorry, your call did not go through. will you please hang up
and try your call again? this is a recording. (repeats, then rings
again...) please hang up and try your call again. if you need
assistance, dial your operator. please hang up now. this is a
recording.
*this is the most common recording on this number, but if you call
it a few times, you'll get a few different things. try it out.
9910 DATU (default user code)
9911 DATU (default user code)
9922 excuse me, please deposit five cents for the next two minutes or
your call will be terminated. this is a recording.
9926 (914) 268, 267, 261 Congers DMS-100 verification. (also will play
the message on 9901 sometimes) *note the old NPA
9933 {sit tones} we're sorry, the long distance company access code you
dialed must be preceded by the digits 950. please hang up and try
your call again. (I don't think they even use 950 anymore)
9940 {sit tones} we're sorry. private calls are not accepted by this
number. to complete your call, hang up, pick up again, dial *82 or
on rotary phones 1182, then dial the number. if call id or call id
with name are in use, your name and number may be displayed. this
message is free. (this one was very informative. I'm surprised that
they didn't tell me which end of the phone I should speak into)
9947 {sit tones} we're sorry, you call cannot be completed as dialed.
please check the number and dial again, or call your operator to
help you. (also plays a similar message in a different voice)
9960 loud tone (1000? hz.)
9963 loud tone (1000? hz.)
9967 rings once, then silence
9977 {sit tones} we're sorry, your call cannot be completed as dialed
from the phone you are using. please read the instruction card and
dial again.
9978 the call you have made requires a coin deposit. check the
instructions on the payphone for the appropriate rate, and dial
your call again.
9999 rings, then low hum (weird)
Comments.
---------
Now lets see what I've found. Two different verification numbers, a number
that plays DTMF tones, a few of payphone recordings, some old error messages,
tones, and two DATU's. Don't ask me why there are two DATU's, I'm assuming
that they don't do anything different. I usually find twice as many test
recordings in a New York 'high end' scan, but that old 'call id' message was
something I haven't encountered before. Even when you don't find much, you
find something.
All numbers not listed either ring out, are a fast busy, or play the regular
disconnect message. (we're sorry,...268-99xx has been disconnected or is no
longer in service...) I usually do my scans at night, well after business
hours, but I have reason to believe that 9900 is the direct number to the
central office. Sometimes when I scan during the day, someone will answer at
9900 and say the name of the central office (as in where it is located,
268=Congers, NY) I've only encountered this a few times. I never talked to
them because I'm usually about to scan out the next 99 numbers, and I'm not
looking for trouble. Maybe one day when I'm bored, I'll try to social them.
Special Exchanges.
------------------
Most of the time, numbers such as the ANAC, time and weather, ringback and
various other things are kept on special exchanges. Almost all special
exchanges can only be reached from that particular area, except for time and
weather numbers, which can usually be reached from anywhere. In New York,
958-xxxx and 990-xxxx are ANAC's and 660+ your 7-digit phone number is the
ringback. In New Jersey, the ringback is 550. Many states use 200 for the
ANAC, from what I have heard. In California, you can get the time by dialing
767-xxxx (which most people call 'popcorn', 767-2676 spells popcorn), or
853-xxxx. The 767 exchange is used in Northern California NPA's, and the 853
is for Southern Cali. There are a lot of places, like Boston and D.C., that
still use 936 for time and weather. 976, 540, and 550 are also special
exchanges, but they are all premium pay services, kind of like 900 numbers,
so I wouldn't suggest scanning them unless you are beige boxing. You're
probably not going to find anything that interesting, but you never know.
The time and weather numbers in NY are on the 976 exchange, so If I want to
know the current weather conditions, it'll cost me 99 cents. What a bargain!
There is also the little known 959 exchange, which is very different from
other special exchanges. It is owned by AT&T, and it is accessible from
almost any area code. (except NY for some reason) If you get lucky, you might
hear things like test messages and different tones, just like you would when
scanning the high and low end of any other exchange. Try common numbers such
as 1000, 1111, 1234, etc. Sometimes the test numbers will be different in
different area codes and sometimes they're the same. I think that 959-1000 is
the same everywhere. Because these are AT&T's numbers, they can only be
reached through AT&T. The way to do this is to use AT&T's dial-around,
10-10-288. (another one is 10-16-111, which also works the same for
op-diverting, by the way) Simply dial 10-10-288+ 1(NPA)959-xxxx. You will
not be charged for this call because it is a test exchange. I can personally
attest to the fact that it is free, but I can also personally attest to the
fact that AT&T might get pissed off if you do it too much because they blocked
my use of 10-10-288. Don't feel too bad for me. I can still use 10-10-288-0
to op-divert to toll-free numbers, I just can't use it to make long distance
calls or to call 959 numbers. Oh well.
Conclusion.
-----------
Exchange scanning is fun and most of the time, it's free! The telco doesn't
charge you when you reach an error message, so you can call these numbers
from a payphone without paying for it. If you're scanning your exchange from
home, then it's either free or just the price of a local call,(if you get the
odd business or residence here and there). I do strongly suggest getting an
unlimited long distance plan so you can scan exchanges all over the country.
(not to mention call up all the 'l33t phreaker confs) It's always cool to be
able to tell your friend who lives 1000 miles from you what his DATU and ANAC
numbers are.
Appendix.
---------
I was planning on adding a few scans to this file, but I thought it would be a
better idea to give people the chance to do some scanning for themselves. To
give you guys a starting point, I've added some numbers from scans I have done
in the past. If you take a look around in these exchanges, you will find many
interesting things.
(313)849-9906 due to weather conditions, all Ameritech circuits are
busy. please try your call again later.
(313)324-9901 you have reached AT&T local services. DT RT MI BA DS0
(570)387-0000 thank you for calling Bell Atlantic. due to an emergency
condition, we are operating with a reduced staff, and if
you stay on the line you may experience a delay. you may
find it more convenient to call us back at another time
for assistance.
(570)387-0083 DATU (default codes) *(this one has a different voice, so
far it's the only one I have found like it)
(202)965-9970 you have just de-activated this feature
(916)440-0017 we're sorry, your service has been interrupted. for
fire, medical and police emergencies, dial 911. to
discuss your account, please contact you local service
provider. thank you.
(916)440-0031 {sit tones) we're sorry. due to telephone company
facility trouble, your call cannot be completed at this
time. will you try your call again later.
(212)967-9999 this is a test announcement. this is a test announcement
for use at anytime in emergency cases. thank you.
(this will also play a citibank message sometimes)
(646)674-9901 you have reached Bell Atlantic office of west 36th st.,
serving codes (646)674, (212)594, (917) 339.
(914)345-9935 excuse me, please deposit 5 cents for the next two
minutes or your call will be terminated. thank you for
using Nynex. this is a recording.
(415)499-0091 DATU (default user code)
(618)654-1206 ANAC (this can be reached from anywhere, but it only
reads back your 7-digit number)
(409)724-3137 {sit tones} the call you have made requires an initial
deposit. please hang up momentarily, listen for
dialtone, deposit the amount specified on the
instruction card, and dial your call again.
(215)979-0045 (AT 629) welcome to the ATX long distance network.
please contact customer service at 1(800)220-4900 to
activate service.
(215)979-0028 -(hold music)- thank you for calling Bell Atlantic. all
of our lines are busy right now, but your call is
important to us. please hold on, our next available
representative will be with you shortly.
-(more horrible hold music with singing!)-
ANI vs. ANAC What are they, and what's the difference?
By: ic0n
Email: ic0n@oldskoolphreak.com
URL: www.hackerhost.com/lph/
Since I showed up on the phreak scene, I've seen many phreaks mix up ANI and
ANAC. In this article, I'll explain what both are, what they're used for, and
the diffrence between the 2. Ill start with ANI.
ANI means Automatic Number Identification
This is a service that is mainly found on toll free numbers. But any telco
related number in your area might also have ANI.Larger Companys will also have
ANI on their networks. If they have an outdial feature there are very good
chances that will have ANI. I've read on quite a website that ANI is not offered
to the public, I think that if you have the money your local telco will be able
to help you out with getting this very expensive feature added to your wire pair
(your telephone). ANI information is transmitted as part of the digital stream
in the signaling protocal. At the end of each month the subcriber will be mailed
a log of every phone call they got for that given month. Included in the log are
the numbers of each caller along with the full name of who the number belongs
to. ANI may also be used to refer to any telephone number. Ani is used to bust
people doing toll fraud or anything else illegal over the telephone. Ani is a
service that is on an ANAC. Hotels and motels use something called ARI.
ARI stands for Automatic Room Identification which will allow the front desk to
see who's calling. There's also something called Ani 2 witch will give even more
information about you. The major thing about it is that you get a 2 digit code.
To find out if your area code is under ANI 2 op-divert threw a local operator to
an ANAC that has ANI 2. Example: 00 Pots (plan old telephone service) This 2
digit code will identify your line. Ani 2 will also identify The line number,
ARU, and DNIS.
ARU, Audio Response unit. Aru device that provides synthesized voice responses
to dtmf signaling input by processing calls based on the call-originator input
information received from a host data base information in the incoming call,
such as the time of day.
Line Number, The line you are accessing on their system.
DNIS, Dialed Number Identification Service Is a telephone service that
identifies for the receiver of a call the number that the caller dialed. It's a
common feature of 800 and 900 lines. If you have multiple 800 or 900 numbers to
the same destination, DNIS tells which number was called. DNIS works by passing
the touch tone digits (dual tone multi-frequency or MF digits) to the
destination where a special, facility can read and display them or make them
available for call center programming.
Here's a list of every 2 digit code...
00 Plain Old Telephone Service (POTS) - non-coin service requiring no special
treatment
01 Multiparty line (more than 2) - ANI cannot be provided on 4 or 8 party lines.
The presence of this "01" code will cause an Operator Number Identification
(ONI) function to be performed at the distant location. The ONI feature routes
the call to a CAMA operator or to an Operator Services System (OSS) for
determination of the calling number.
02 ANI Failure - the originating switching system indicates (by the "02" code),
to the receiving office that the calling station has not been identified. If the
receiving switching system routes the call to a CAMA or Operator Services
System, the calling number may be verbally obtained and manually recorded. If
manual operator identification is not available, the receiving switching system
(e.g., an interLATA carrier without operator capabilities) may reject the call.
03-05 Unassigned
06 Station Level Rating - The "06" digit pair is used when the customer has
subscribed to a class of service in order to be provided with real time billing
information. For example, hotel/motels, served by PBXs, receive detailed billing
information, including the calling partys room number. When the originating
switching system doesn't receive the detailed billing information, e.g., room
number, this "06" code allows the call to be routed to an operator or operator
services system to obtain complete billing information. The rating and/or
billing information is then provided to the service subscriber. This code is
used only when the directory number, (DN) is not accompanied by an automatic,
room/account identification.
07 Special Operator Handling Required - calls generated from stations that
require further operator or Operator Services System screening are accompanied
by the "07" code. The code is used to route the call to an operator or Operator
Services System for further screening and to determine if the station has a
denied-originating class of service or special routing/billing procedures. If
the call is unauthorized, the calling party will be routed to a standard
intercept message.
08-09 Unassigned
10 Not assignable - conflict with 10X test code
11 Unassigned
12-19 Not assignable - conflict with international outpulsing code
20 Automatic Identified Outward Dialing (AIOD) - without AIOD, the billing
number for a PBX is the same as the PBX Directory Number (DN). With the AIOD
feature, the originating line number within the PBX is provided for charging
purposes. If the AIOD number is available when ANI is transmitted, code "00" is
sent. If not, the PBX DN is sent with ANI code "20". In either case, the AIOD
number is included in the AMA record.
21-22 Unassigned
23 Coin or Non-Coin - on calls using database access, e.g., 800, ANI II 23 is
used to indicate that the coin/non-coin status of the originating line cannot be
positively distinguished for ANI purposes by the SSP. The ANI II pair 23 is
substituted for the II pairs which would otherwise indicate that the non-coin
status is known, i.e., 00, or when there is ANI failure. ANI II 23 may be
substituted for a valid 2-digit ANI pair on 0-800 calls. In all other cases, ANI
II 23 should not be substituted for a valid 2-digit ANI II pair which is forward
to an SSP from an EAEO.
Some of the situations in which the ANI II 23 may be sent:
Calls from non-conforming end offices (CAMA or LAMA types) with combined
coin/non-coin trunk groups.
0-800 Calls
Type 1 Cellular Calls
Calls from PBX Trunks
Calls from Centrex Tie Lines
24 Code 24 identifies a toll free service call that has been translated to a
Plain Old Telephone Service (POTS) routable number via the toll free database
that originated for any non-pay station. If the received toll free number is not
converted to a POTS number, the database returns the received ANI code along
with the received toll free number. Thus, Code 24 indicates that this is a toll
free service call since that fact can no longer be recognized simply by
examining the called address.
25 Code 25 identifies a toll free service call that has been translated to a
Plain Old Telephone Service (POTS) routable number via the toll free database
that originated from any pay station, including inmate telephone service.
Specifically, ANI II digits 27, 29, and 70 will be replaced with Code 25 under
the above stated condition.
26 Unassigned
27 Code 27 identifies a line connected to a pay station which uses network
provided coin control signaling. II 27 is used to identify this type of pay
station line irrespective of whether the pay station is provided by a LEC or a
non-LEC. II 27 is transmitted from the originating end office on all calls made
from these lines.
28 Unassigned
29 Prison/Inmate Service - the ANI II digit pair 29 is used to designate lines
within a confinement/detention facility that are intended for inmate/detainee
use and require outward call screening and restriction (e.g., 0+ collect only
service). A confinement/detention facility may be defined as including, but not
limited to, Federal, State and/or Local prisons, juvenile facilities,
immigration and naturalization confinement/detention facilities, etc., which are
under the administration of Federal, State, City, County, or other Governmental
agencies. Prison/Inmate Service lines will be identified by the customer
requesting such call screening and restriction. In those cases where private
paystations are located in confinement/detention facilities, and the same call
restrictions applicable to Prison/Inmate Service required, the ANI II digit for
Prison/Inmate Service will apply if the line is identified for Prison/Inmate
Service by the customer.
30-32 Intercept - where the capability is provide to route intercept calls
(either directly or after an announcement recycle) to an access tandem with an
associated Telco Operator Services System, the following ANI codes should be
used:
30 Intercept (blank) - for calls to unassigned directory number (DN)
31 Intercept (trouble) - for calls to directory numbers (DN) that have been
manually placed in trouble-busy state by Telco personnel
32 Intercept (regular) - for calls to recently changed or disconnected numbers
33 Unassigned
34 Telco Operator Handled Call - after the Telco Operator Services System has
handled a call for an IC, it may change the standard ANI digits to "34", before
outpulsing the sequence to the IC, when the Telco performs all call handling
functions, e.g., billing. The code tells the IC that the BOC has performed
billing on the call and the IC only has to complete the call.
35-39 Unassigned
40-49 Unrestricted Use - locally determined by carrier
50-51 Unassigned
52 Outward Wide Area Telecommunications Service (OUTWATS) - this service allows
customers to make calls to a certain zone(s) or band(s) on a direct dialed basis
for a flat monthly charge or for a charge based on accumulated usage. OUTWATS
lines can dial station-to-station calls directly to points within the selected
band(s) or zone(s). The LEC performs a screening function to determine the
correct charging and routing for OUTWATS calls based on the customers class of
service and the service area of the call party. When these calls are routed to
the interexchange carrier via a combined WATS-POTS trunk group, it is necessary
to identify the WATS calls with the ANI code "52".
53-59 Unassigned
60 TRS - ANI II digit pair 60 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider and that the call
originated from an unrestricted line (i.e., a line for which there are no
billing restrictions). Accordingly, if no request for alternate billing is made,
the call will be billed to the calling line.
61 Cellular/Wireless PCS (Type 1) - The "61" digit pair is to be forwarded to
the interexchange carrier by the local exchange carrier for traffic originating
from a cellular/wireless PCS carrier over type 1 trunks. (Note: ANI information
accompanying digit pair "61" identifies only the originating cellular/wireless
PCS system, not the mobile directory placing the call.
62 Cellular/Wireless PCS (Type 2) - The "62" digit pair is to be forwarded to
the interexchange carrier by the cellular/wireless PCS carrier when routing
traffic over type 2 trunks through the local exchange carrier access tandem for
delivery to the interexchange carrier. (Note: ANI information accompanying digit
pair "62" identifies the mobile directory number placing the call but does not
necessarily identify the true call point of origin.)
63 Cellular/Wireless PCS (Roaming) - The "63" digit pair is to be forwarded to
the interexchange carrier by the cellular/wireless PCS subscriber "roaming" in
another cellular/wireless PCS network, over type 2 trunks through the local
exchange carrier access tandem for delivery to the interexchange carrier. (Note:
Use of 63 signifies that the "called number" is used only for network routing
and should not be disclosed to the cellular/wireless PCS subscriber. Also, ANI
information accompanying digit pair "63" identifies the mobile directory number
forwarding the call but doesn't necessarily identify the true forwarded-call
point of origin.)
64-65 Unassigned
66 TRS - ANI II digit pair 66 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider, and that the call
originates from a hotel/motel. The transport carrier can use this indication,
along with other information (e.g., whether the call was dialed 1+ or 0+) to
determine the appropriate billing arrangement (i.e., bill to room or alternate
bill).
67 TRS - ANI II digit pair 67 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider and that the call
originated from a restricted line. Accordingly, sent paid calls should not be
allowed and additional screening, if available, should be performed to determine
the specific restrictions and type of alternate billing permitted.
68-69 Unassigned
70 Code 70 identifies a line connected to a pay station (including both coin and
coinless stations) which does not use network provided coin control signaling.
II 70 is used to identify this type pay station line irrespective of whether the
pay station is provided by a LEC or a non-LEC. II 70 is transmitted from the
originating end office on all calls made from these lines.
71-79 Unassigned
80-89 Reserved for Future Expansion "to" 3-digit Code
90-92 Unassigned
93 Access for private virtual network types of service: the ANI code "93"
indicates, to the IC, that the originating call is a private virtual network
type of service call.
94 Unassigned
95 Unassigned - conflict with Test Codes 958 and 959
96-99 Unassigned
Now on with ANAC.. ANAC stands for Automatic Number Announcement Circuit. When
you dial up an anac it will give you the telephone number you called the anac
from. This is very useful when out field phreaking with your beige box. By far
the most important when your at a telco can. At the end of this article I'll
include a list of local anacs. Some local anacs will differ from switch to
switch. There also toll free anacs most get shutdown due to abuse or overuse.
Because of that I quit releasing anac lists. So do every phreak a favor and use
local anac when and if possible. Hopefully, you now understand both ANI and
ANAC.
Now here's a list of ANAC's they all worked as of 8/21/03
Patlife Anac's
800-492-0295 005736
800-857-9139 200695
800-584-9196 300265
800-300-ic0n (4206) 202622
800-877-Capt 009949
800-789-4779 201867
800-729-0059 302234
888-253-8254 411198
888-253-8253 411197
888-253-8251 411196
888-253-8249 411195
888-253-8229 411193
888-253-8227 411192
888-253-8226 411191
888-253-8225 411190
888-776-5733 409159
800-964-0221 401479
888-535-0055 507433
888-349-9971 505656
888-578-7437 kru-sher 504872
800-797-6088 200170
800-803-6514 300433
800-803-6521 300434
800-803-6527 300435
800-803-6528 301892
800-803-6594 100973
800-803-6544 300436
800-293-6924 010614
800-213-2233 008637
800-483-2975 005976
800-737-9628 002023
800-729-0056 302234
888-837-7230 503712
888-837-7231 503713
Ani2 (II)
800-555-1140
800-555-1180
800-550-3124
800-225-5313
800-225-5214
Atnt
800-532-7486 +1
Mci
800-314-4258
800-333-3232
800-444-0800
800-444-2222
800-444-3333
800-444-4444
800-444-5555
800-552-8355
800-555-1221
800-797-5207
800-967-5326 +2
Other Anac's
800-240-1411 +1 (even if blocked from area code)
800-444-0872 +1 (even if blocked from area code)
800-444-0866 +1 (even if blocked from area code)
800-666-1379 +1 (even if blocked from area code)
877-265-5343 8+1 (877-college)
800-964-0176
800-964-0221
800-223-1104 195632
888-221-0104 12345
888 324 8686
NPA ANAC number Geographic area
201 958 Hackensack/Jersey City/Newark/Paterson, NJ
202 811 District of Columbia
203 970 CT
205 300-222-2222 Birmingham, AL
205 300-555-5555 Many small towns in AL
205 300-648-1111 Dora, AL
205 300-765-4321 Bessemer, AL
205 300-798-1111 Forestdale, AL
205 300-833-3333 Birmingham
205 557-2311 Birmingham, AL
205 811 Pell City/Cropwell/Lincoln, AL
205 841-1111 Tarrant, AL
205 908-222-2222 Birmingham, AL
206 411 WA (Not US West)
207 958 ME
209 830-2121 Stockton, CA
209 211-9779 Stockton, CA
212 958 Manhattan, NY
213 114 Los Angeles, CA (GTE)
213 1223 Los Angeles, CA (Some 1AESS switches)
213 211-2345 Los Angeles, CA (English response)
213 211-2346 Los Angeles, CA (DTMF response)
213 760-2??? Los Angeles, CA (DMS switches)
213 61056 Los Angeles, CA
214 570 Dallas, TX
214 790 Dallas, TX (GTE)
214 970-222-2222 Dallas, TX
214 970-611-1111 Dallas, TX (Southwestern Bell)
215 410-xxxx Philadelphia, PA
215 511 Philadelphia, PA
215 958 Philadelphia, PA
216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH
216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH
217 200-xxx-xxxx Champaign-Urbana/Springfield, IL
219 550 Gary/Hammond/Michigan City/Southbend, IN
219 559 Gary/Hammond/Michigan City/Southbend, IN
301 958-9968 Hagerstown/Rockville, MD
310 114 Long Beach, CA (On many GTE switches)
310 1223 Long Beach, CA (Some 1AESS switches)
310 211-2345 Long Beach, CA (English response)
310 211-2346 Long Beach, CA (DTMF response)
312 200 Chicago, IL
312 290 Chicago, IL
312 1-200-8825 Chicago, IL (Last four change rapidly)
312 1-200-555-1212 Chicago, IL
313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI
313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI
313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI
313 200200200200200 Ann Arbor/Dearborn/Detroit, MI
314 410-xxxx# Columbia/Jefferson City/St.Louis, MO
315 953 Syracuse/Utica, NY
315 958 Syracuse/Utica, NY
315 998 Syracuse/Utica, NY
317 310-222-2222 Indianapolis/Kokomo, IN
317 559-222-2222 Indianapolis/Kokomo, IN
317 743-1218 Indianapolis/Kokomo, IN
401 200-200-4444 RI
401 222-2222 RI
402 311 Lincoln, NE
404 311 Atlanta, GA
404 940-xxx-xxxx Atlanta, GA
404 990 Atlanta, GA
405 890-7777777 Enid/Oklahoma City, OK
405 897 Enid/Oklahoma City, OK
407 200-222-2222 Orlando/West Palm Beach, FL
408 300-xxx-xxxx San Jose, CA
408 760 San Jose, CA
408 940 San Jose, CA
409 951 Beaumont/Galveston, TX
409 970-xxxx Beaumont/Galveston, TX
410 200-6969 A
410 200-555-1212 A
410 811 Annapolis/Baltimore, MD
412 711-6633 Pittsburgh, PA
412 711-4411 Pittsburgh, PA
412 999-xxxx Pittsburgh, PA
413 958 Pittsfield/Springfield, MA
413 200-555-5555 Pittsfield/Springfield, MA
414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 200-555-1212 San Francisco, CA
415 211-2111 San Francisco, CA
415 2222 San Francisco, CA
415 640 San Francisco, CA
415 760-2878 San Francisco, CA
415 7600-2222 San Francisco, CA
419 311 Toledo, OH
440 959-9892 East Cleveland, OH
502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY
502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY
503 611 Portland, OR
503 999 Portland, OR (GTE)
504 99882233 Baton Rouge/New Orleans, LA
504 201-269-1111 Baton Rouge/New Orleans, LA
504 998 Baton Rouge/New Orleans, LA
504 99851-0000000000 Baton Rouge/New Orleans, LA
508 958 Fall River/New Bedford/Worchester, MA
508 200-222-1234 Fall River/New Bedford/Worchester, MA
508 200-222-2222 Fall River/New Bedford/Worchester, MA
508 26011 Fall River/New Bedford/Worchester, MA
509 560 Spokane/Walla Walla/Yakima, WA
512 830 Austin/Corpus Christi, TX
512 970-xxxx Austin/Corpus Christi, TX
515 5463 Des Moines, IA
515 811 Des Moines, IA
516 958 Hempstead/Long Island, NY
516 968 Hempstead/Long Island, NY
517 200-222-2222 Bay City/Jackson/Lansing, MI
517 200200200200200 Bay City/Jackson/Lansing, MI
518 997 Albany/Schenectady/Troy, NY
518 998 Albany/Schenectady/Troy, NY
603 200-222-2222 NH
606 997-555-1212 Ashland/Winchester, KY
606 711 Ashland/Winchester, KY
607 993 Binghamton/Elmira, NY
609 958 Atlantic City/Camden/Trenton/Vineland, NJ
610 958 Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
614 200 Columbus/Steubenville, OH
614 571 Columbus/Steubenville, OH
615 200200200200200 Chatanooga/Knoxville/Nashville, TN
615 2002222222 Chatanooga/Knoxville/Nashville, TN
615 830 Nashville, TN
616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI
617 200-222-1234 Boston, MA
617 200-222-2222 Boston, MA
617 200-444-4444 Boston, MA (Woburn, MA)
617 220-2622 Boston, MA
617 958 Boston, MA
618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL
618 930 Alton/Cairo/Mt.Vernon, IL
619 211-2001 San Diego, CA
703 811 Alexandria/Arlington/Roanoke, VA
704 311 Asheville/Charlotte, NC
708 1-200-555-1212 Chicago/Elgin, IL
708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly)
708 200-6153 Chicago/Elgin, IL
708 724-9951 Chicago/Elgin, IL
708 356-9646 Chicago/Elgin, IL
713 380 Houston, TX
713 970-xxxx Houston, TX
713 811 Humble, TX
714 114 Anaheim, CA (GTE)
714 211-2121 Anaheim, CA (PacBell)
714 211-2222 Anaheim, CA (Pacbell)
716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
717 958 Harrisburg/Scranton/Wilkes-Barre, PA
718 958 Bronx/Brooklyn/Queens/Staten Island, NY
802 2-222-222-2222 Vermont
802 200-222-2222 Vermont
802 1-700-222-2222 Vermont
802 111-2222 Vermont
805 114 Bakersfield/Santa Barbara, CA
805 211-2345 Bakersfield/Santa Barbara, CA
805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF)
805 830 Bakersfield/Santa Barbara, CA
806 970-xxxx Amarillo/Lubbock, TX
810 200200200200200 Flint/Pontiac/Southfield/Troy, MI
812 410-555-1212 Evansville, IN
813 311 Ft. Meyers/St. Petersburg/Tampa, FL
815 200-xxx-xxxx La Salle/Rockford, IL
815 290 La Salle/Rockford, IL
817 211 Ft. Worth/Waco, TX
817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell)
818 1223 Pasadena, CA (Some 1AESS switches)
818 211-2345 Pasadena, CA (English response)
818 211-2346 Pasadena, CA (DTMF response)
903 970-611-1111 Denison, TX
906 1-200-222-2222 Marquette/Sault Ste. Marie, MI
908 958 New Brunswick, NJ
910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY
915 970-xxxx Abilene/El Paso, TX
916 211-2222 Sacramento, CA (Pac Bell)
916 461 Sacramento, CA (Roseville Telepohone)
919 200 Durham, NC
919 711 Durham, NC
Canada:
204 644-xxxx Manitoba
306 115 Saskatchewan, Canada
403 311 Alberta, Yukon and N.W. Territory
403 908-222-2222 Alberta, Yukon and N.W. Territory
403 999 Alberta, Yukon and N.W. Territory
416 997-xxxx Toronto, Ontario
506 1-555-1313 New Brunswick
514 320-xxxx Montreal, Quebec
519 320-xxxx London, Ontario
604 1116 British Columbia, Canada
604 1211 British Columbia, Canada
604 211 British Columbia, Canada
613 320-2232 Ottawa, Ontario
705 320-4567 North Bay/Saulte Ste. Marie, Ontario
Australia:
+61 03-552-4111 Victoria 03 area
+612 19123 All major capital cities
12722123
United Kingdom:
175
Loop Maintenance Operations System (LMOS)
by Brisk Attivo
16.3.2. LOOP MAINTENANCE OPERATIONS SYSTEM (LMOS)
When a clerk takes a report in a repair service bureau
that uses only manual methods, a trouble ticket is filled
out. This ticket includes the customer's name, address,
telephone number, and any pertinent information that may
help to identify the trouble. All of this information is
entered on the ticket manually, with the ticket eventually
passing through many hands. In addition to this source of
information, cable pair assignment, cable makeup
information, and trouble history for each customer are
kept on file in large bins or file tubs. This information
is used by the tester to help isolate the problem. Through
the use of LMOS, all of this information can be stored in
a computer and displayed on CRTs at the 611 position and
other locations. In addition to simplifying information
retrieval, the accuracy and readability of the information
will be greatly imporved. The CRT display will alow the
RSB to advice the customer immediately of the status of
the trouble, should the customer happen to make a followup
inquiry. It also produces administrative reports including
jeopardy reports, facility status reports, cable fill
reports, and reports with respect to closed out troubles.
LMOS includes documentation such as training materials and
position practices.
LMOS can be installed separately or with the LSV or
mechanized loop testing (MLT) modules, which mechanize
important testing functions. The system economically
viable for typical groupings of repair service bureaus
that serve on-half million to five million lines.
Labor savings benefits result from:
(1) Mechanization of the line record.
(2) A mechanized service order inteface for automatic line
record updating.
(3) The ability to centralize the repair service
attendants for many repair service bureaus.
(4) A flexible report generator that produces standard
statistics or processed trouble reports and special
reports on demand.
(5) A repair force administration algorithm that optimizes
the travel time of the repair personell.
LMOS is a 3-level network interconnected by data links as
shown in Fig. 16-2. The hub of the network is an IBM 370
computer and associated peripherals. The master line
record data base is maintained in the hub, which can
support up to five million working lines.
Fig. 16-2. Loop Maintenance Operations System
The second level of the system consists of a number of
satellite locations which are linked with the central data
base. A satellite consists of a PDP 11/70 minicomputer and
associated peripheral equipment. Each satellite has an
estimated capacity of one million lines. The satellites
support almost all of the real-time transactions and
provide response times on the order of 5 seconds or less
for most transactions. Because these satellites have such
a large capacity and since the cost of the minicomputer
equipment is a minor portion of the overall system cost, a
duplexed configuration is reccomended for reliability.
The third level of the system is at the repair service
bureaus and centralized repair service attendant
locations. Each location has a PDP 11/10 minicomputer
which is linked with one of the satellite minicomputers.
The repair service attenants and other personel interact
with the system through CRT terminals, printers, and
status entry devices which are special purpose data entry
terminals that enter data with a TOUCH-TONE pad and
display data on a light-emitting diode readout strip.
The lower limit on the capacity of a LMOS installation is
based on economic constraints imposed by fixed cost items
such as software support personnel, training center costs,
and IBM 370 costs. This limit is estimated to be 500,000
lines.
16.3.2.2 Operations
The following descriptions of ways that LMOS can be used
in an operating company will further explain the
organization and functions of the system.
The Repair Service Attendant Position.
Each repair service attendant position is equipped with a
CRT terminal through with LMOS accepts trouble reports.
Following keyboard entry of a customer telephone number or
special service circuit number, LMOS responds with 5
second with a CRT display that includes:
(1) Customer name, address, and service data such as
disconnected, non-working, affiliated with a telephone
answering service, or date of last trouble.
(2) An appointment time that can be offered to the
customer if a repair visit appears to be neccessary.
(3) LSV or mechanized line testing system responses ( if
installed at serving RSB) to LMOS initiations.
(4) Information on cable and other equipment failures that
are known to be affecting the particular customer's
circuit.
(5) Information on the initial report (if the current
report is identified as a subsequent report) concering
repair status, promised appointment time, and number of
previous subsequent reports.
The appointment time mentioned above takes into account
both of the back-log of trouble reports awaiting dispatch
and the size of the craft force responsible for the
corresponding repair coverage.
The LSV or mechanized line testing system response usually
is not available at the time of the initial trouble report
transmission, but is writen into a reserved space on the
display as the repair service attendant is talking to the
customer. REsponse time of these systems is on the order
of 10 seconds and can be longer if delays are encountered
because of test equipment usage.
As in the case of the appointment time offering, the LSV
or mechanized line testing system response is made from
the RSB covering the service in question and need not be
the same RSB that contains the originating repair service
attendant position. It is the independence of the repair
service attendant from the responsible RSB that permits
one of the more significant operational capabilities:
centralization of the repair service attendant task. Such
centralization is possible because all of the repair
service attendant transactions are designed to operate
with acces to all of the line records contained within the
serving satellite minicomputer (this also implies acess to
all LSV and mechanized line testing systems covering these
lines). Thus, 24-hour coverage and other desirable
features possible with a centralized repair service
attendant location are provided within the LMOS design.
16.3.2.3 RSB Handling of the Trouble REports
Once a trouble report has been entered in LMOS, the line
record data base is accessed and a basic output report is
transmitted within seconds to a printer at the appropriate
RSB. In addition to the trouble report and line record
data, this paper document contains:
(1) Assignment information.
)2) Service and equipment information.
(3) Trouble history for the past 40 days.
(4) Warning of potential trouble causes such as cable
failures.
As repair action takes place following a trouble reports,
status updates, such as test results and trouble reports
closeouts, are entered into LMOS in the RSB, using status
entry devices described previously.
LMOS will aid in the dispatching of the repair force
through the use of a repair force administration module
that will provide a CRT-equipped dispatcher with a short
list of reccomended dispatches each time a member of the
repair force calls in for a new dispatch. Repair force
administration will take into account the repair work
backlog, available repair force, promised appointment
times, and travel times.
Note that since ach line record is keyed to a serving RSB,
LMOS permits functional repair operations such as coin
telephone repair centers and PBX repair centers; the basic
output report always arrives at the correct serving RSB or
repair center.
16.3.2.4 Control of Testing
Not only can the repair service attendant position trigger
LSV action against a particular telephone number, but also
RSB personnel can use LMOS to drive a LSV in an automatic
verification mode. This is done by using a RSB CRT
terminal to enter a list of telephone number, a particular
cable complement, a range of central office equipments, or
a specifc class and period of closed-out trouble reports
such as all-test-OKs for the last two days. LMOS then
acceses its data base for cross-reference lists that
provide the appropriate telephone numbers and initiates
automatic sequential line status verification against the
telephone number list. Results are printed out at the
requesting RSB within seconds of completion. The testing
capabilities of the mechanized line testing system can be
used by LMOS in the same manner.
16.3.2.5 Operational REports
Over and above individual trouble report tracking, LMOS
provides three basic classees of operational reports: one
covering open troubles, one covering closed-out reports,
and one covering the line record and equipment file.
Open trouble reports are used to aid in the hour-to-hour
administration of the RSB. An example of this kind of
reportis the jeopardy report, which flags trouble reports
in jeopardy of missing their appointment times.
Closed-out trouble reports relate to troubles that have
been closed out within the last 40 days.
Line record and equipment reports fall into three
categories:
(1) Batch reports that use the line record file as input,
for example: all circuits on temporary suspension can be
listed by telephone number.
(2) Batch reports that list unallowed multiple assignments
of cable and pair or central office equipment.
(3) Equipment reports that are fixed in format but that
are available inr elat time in response to CRT-entered
transactions, for example :cable pair versus telephoen
number by complement.
Since many of these reports can be retrieved from a
centralized location, the potential for a formal program
of centralized analysis exists under LMOS. Note that some
reports will be useful in connection with with operating
company activities other than maintenance such as business
office and network administration activities.
16.3.3. AUTOMATED REPAIR SERVICE BUREAU (ARSB)
Both LSV and LMOS initially were designed as stand-alone
systems, LSV as a manually operated line verification
system and LMOS as a mechanized line record and trouble
administration system. Recently, and interface was
provided for LSV so that it can be directed from a LMOS
operator's position to run its sequence of measurements on
a particular line. This is a first step toward a total RSB
system concept.
Developpment is under way for a mechanized line testing
(MLT) system, which is an improved version of the LSV. In
addition to improved testing capabilities, it will have
the ability to test in the presence of known terminations.
In the new arrangement, the MLT system, working in
conjunction with LMOS, will have a priori knowledge of
expected values and allowable deviations for aparticular
line being tested. For example, when testing a ground
start PBX line, it would know that -48 volts is the normal
on-hook condition, whereas this would indicate a fault for
a station line. The new system also will make routine
rapid scan measurements automatically during the early
morning hours when lines are normally idle. All of these
developments are part of what will be known as the
automated repair service bureau (ARSB).
How To Datu
By: Majestic 1/12
" ( Warning Disclaimer ) All material(s) in this text file are
intended for informational use only, it is not the authors
intent to endorse fraud or help others in the pursuit of
fraud. The author accepts no responsablity for any and
all Fraudulant Activities that may come from the viewing
of this text file. By downloading this file you the viewer
accept all resposabliity for any repercutions that may
come from abusing this information. "
" Information is free, Crime costs! " Majestic 1/12
I have come to realize that the world of Phreaking is
alot like Trial and Error, I myself hand scan all the numbers
I come to own, and feel this is the only real way to extract
all the information needed to continue on my ventures.
Like all Phreakers I set out to discover the mad world of
" ESS " and ways to make free calls. I came to discover a " PBX "
or " Diverter " was not at all hard to find. Keeping the number
secure was yet another matter! I went to all of the normal places
on the net to view text files from the old Skool Era, and found
alot of the material I had already known. It wasn't until I
actually started calling into the " Voice Bridges " that I became
really interested in the " Datu Systems ". I had friends that
were really into REMOB back in the day, telling me how much fun it
was to listen in on the conversations thier nieghbors held.
When I found my first Datu, with Passcode, I thought I was
going to be able to play phone god and take over lines,
this was my first mistake. Sure I called in, entered a random
number and was givin the prompt listed below. Being the
inexperienced lamer at the time, I started trying the Permenant
Signal Rlease, followed by a quick call back to check the line!
I was defeated, as my attempt to take out a phone was deflected
by my own stupidity! I called the Datu up again and actually
listened to the woman's automated voice.
This time when I pressed # 9, I heard " Permanent Signal Release
Disabled, ( Pause ) ... OK Audio Monitor ... " After this I was
redirected to the Datu Main Menu and I hung up! After further
investigation into the Datu functions it was brought to my attention
that along with the default codes to access the Datu, there were also
sets of Admin Defaults that were needed in order to actually set up
the functions.
So with this I give you the information needed to help guide you
to understanding the world of the Datu! Please read the information
closely, as it will indeed give you insight!
Step # 1: Dial Datu Access Number.
Step # 2: Enter Datu Password.
Step # 3: Dial Seven digit subscriber line number.
Step # 4: Datu will respond with " Connected to XXX - XXXX "
" OK "
"Connected to XXX - XXXX, Busy LIne, Audio Monitor "
Non pair gain lines proceed to Step # 7:
" Note " If the line is busy the Datu will not access the DC
by-pass pair or the Metallic Access Unit.
Step # 5: SLC lines: If the line is idle Datu will respond " Pair Gain
Line " Followed by " Processing " ( " Processing " may be
repeated for up to 25 seconds. ) Datu will voice message:
____________________________________________________________
Single PartyLine (GOOD)
Multi-Party LIne Followed by
Coin LIne " Enter RT Number "
____________________________________________________________
Channel Not available (No Bad Channel test results)
PGTC Failure/By-Pass If same recording is heard
Pair Busy repeatededly, alert supervisor
Pair Gain System Alarm (Alert Supervisor)
____________________________________________________________
step # 6: If Good ( Or Bad ) Channel test results, enter the RT number,
Dial" * " to end,( " ** " to toggle on or off the Alpha Mode. )
Enter the pair number, Dial " * " to end.
Dial " 0 * " to existing DC Test Pair. Datu will connect to the
by-pass Pair or call the Metallic Access Unit in the RT, except
when bypass is busy or Pair Gain system is in Alarm.
See Step # 7 after Connection to remote site.
Step # 7: Line Preperation Functional Dial Codes:
2 = Audio Monitor
33 = Short Tip and Ring to Ground
37 = Short Ring to ground ( Tip Open )
38 = Short Tip to Ground ( Ring Open )
44 = High Level Tone on Tip and Ring
47 = Gigh Level Tone on Ring ( Tip Grounded )
48 = High Level Tone on Tip ( Ring Grounded )
5 = Low Level Tone
6 = Open Line
7 = Short Line ( Tip to Ring )
9 = Permanent Signal Release
# = New Subscriber Line
## = Force Disconnect"MJ Notes" When accessing a Datu Unit you must know the Passcode which
is usually a default of " 1234 or 2345 " I have noticed that
when a Datu is called it will after prompted move straight to
Step # 7 Line Preperation Function Dial Codes. The Audio
Monitor option will sound with a low level sctratch type beep
that cannot be decoded as talking to the human ear. this will
only happen if the phone line called is currently busy. It has
come to my attention that you also have to setup the Datu
through the Admin Codes in order to actually have used the Datu
correctly, otherwise you are accessing a totally dead and useless
Phone Utility. The only use for a Datu without Admin features
promted is to tell if someone is on thier phone, and yes boys and
girls you are able to do that by just dialing the persons phone
number.
Now then I have givin you enough info on how to Datu, Now
I will give you the actual Datu numbers and you can attempt to
Datu all by yourselves... Play nice now ya'll!
Datu Numbers:
rea: NPA: Datu:
Code:
Laurelton 718 528-8374
2345
-8375
-8375
L.I.C 718 472-0567
2345
-0572
-0576
Flushing 718 460-2775
2345
-4055
-2861
-4155
Forest Hills 718 520-1207
2345
-1320
-1518
-1553
Astoria 718 728-2432
2345
2345
278-
626-
204-
956-
267-
Astoria Contd... 718 726-2722
2345
2811
274-
932-
721-
545-
777-
546
Newton 718 424-0157
2345
0173
429-
639-
426-
565-
507-
936-
803-
Newton Contd... 718 651-9129
2345
9139
3308
672-
478-
779-
334-
205-
Yes Folks those are all valid Datu Numbers, enough that you could
go read " Decoder's " Exchange Scanning " Article and figure out
how you yourself can begin scanning out the local Datu's that may be in
your own Area. Be advised that not all states have Datu test Units,
Or it may be that I have just not found them yet... I hand scan all
the numbers I get, and it takes alot of time, but I do get a very good
amount of numbers that would be passed up on if scanned through a
wardialer... I recommend Hand Scanning it is Uber 1337!
" Props to Decoder, Twinkee the Kid, White Sword, ic0n, Dick
Pickleson, Lucky 225, Dialect, Dark Cube, Night Wolf, Royal
and the rest of the 31337 Phreakers doing what we know to be right..... "
" I am a 404 ... "
Maritime Telecommunication Network aka MTN
By ic0n
e-mail ic0n at houseofphreak dot org
Quite sometime ago i went on a ship, That had telephones on it.
Being the phreak i am I decided i would mess around with it since
I've never heard anyone talk about it. First off these are satellite
telephones. I don't remember the make nor the type of phone they where
using. I was on a Carnival ship that witch has phones in every 'stateroom'
(ships way of saying hotel room) All calls going back into the United States
cost around 1.50 a minute. I don't remember about the international calls.
I would guess thats around 3 bucks! Carnival blackmales anyone who goes on
a cruse because that don't allow you to calling cards,credit cards nor collect
calls. Heres what was told to everyone.
'Please note Since Communications at sea are via Satellite, guest maynot use
credit cards,calling card nor collect calls.'
What they try and make you do is use your phone in your room witch will be directly
added to your bill. If i remember correctly the system they used was called 'Shore to ship'
After going threw some old notebooks i found 2 numbers for ship to shore.
877-225-7447
732-335-3284
From http://www.carlsontravel.com
Using your credit card: 1-877-823-6000
The cost is $8.50/minute once connected*.
Billed to your telephone: 1-900-555-6000
The cost is $8.95/minute once connected*.
You will need the Cruise Line and Ship Name in order to be connected.
Refer to the cruise codes once you begin dialing.
Please remember to give your friends and family the Cruise Line and Ship
Name that you’re sailing on. Enjoy your cruise and thank you for booking
through Carlson Wagonlit Travel.
*Additional charges may be charged to the passenger depending on the cruise
line. Print this information sheer to contact future Carlson Wagonlit Travel
cruisers!
CRUISE CODES
CRUISE LINE CODE CRUISE LINE CODE
Celebrity Cruise Line 700 Princess Cruises 300
Crystal Cruises 180 Radisson Seven Seas Cruises 800
Cunard Line 340 Royal Caribbean International 200
Disney Cruise Line 900 Seabourn Cruise Line 380
Holland America Line 400 Silversea Cruises 470
Norwegian Coastal Voyage 600 Windstar Cruises 530
Norwegian Cruise Line 500 World Explorer Cruises 550
Orient Lines 360
Frame Operations Management System (FOMS)
by Anonymous
from http://www.oldskoolphreak.com
LEGAL NOTICE - YOU MUST READ
Qwest computers and the Qwest network are Qwest property.
Only authorized persons may use them for legal and proper purposes as
determined solely by Qwest. By using them, you consent to monitoring.
DESTINATION: foms
xxxxxXX UMI Destination >xxxxXX
Using DNS to resolve 'xxxxXX'...
Trying 123.45.67.89 @ TCP Port 23...
--> Connection Established <--
UNIX(r) System V Release 4 / UTS 4.5 (xxxxXX) (1)
login: xxxxxxx
Password:
UNIX System V Release 4 / UTS 4.5 (UTS Global, LLC)
xxxxXX
Copyright (c) 1984, 1990 AT&T
Copyright (c) 1990, 1993 UNIX System Laboratories, Inc.
Copyright (c) 2000, 2003 UTS Global, LLC
All Rights Reserved
UTS is a registered trademark of UTS Blobal, LLC.
Last login: <date/time>
LAST LOGIN: <date/time>
UNIX System "xxxxXX"
Release 4 500
**** UTS SYSTEM "XXXXXX" ****
****************************************************************
* Proprietary System *
* Authorized access ONLY. Users subject to monitoring. *
* ALL other use probhibited. *
****************************************************************
FOMS/SWITCH problems ??? Call the IT Unified Help Desk
All Qwest employees are directed to dial 8XX-XXX-HELP (4357)
They are there 24 hours a day - 7 day a week to help you
and determiine trouble source , soulutions and to coordinate
resolution with the appropriate support group. Password resets
require a call to the RMA Hotline at 1-8XX-XXX-XXXX
Jeopardy reason tables have been updated for all wirecenters. Below
is a list of permissible jeopardies.
a1 Assignment Error on F1 Facilities [CP or UDC]
a2 Assignment Error on Office Equipment (OE)
a3 Reserved for Future Assignment Error Category
a4 Assingment Error Tie Pair
a5 Assingment Error TRE [Reg Units, DSL]
a6 Qwest Wiring/Inventory issue [Line Sharing, DSL]
a7 Stenciling Error Splitter or DSLAM
a8 Splitter not connected to DLEC side, Splitter not avail.
a9 Load Coil Detected [Line Share only not used for DSL]
s1 Failed Synch Test [Line Share Only]
FOMS for Xxxxxxxxxx, Xxxxxxxxxx and Xxxxxxxxxx
COT Note: fnd_winback has been modified to only show uncompleted orders
COT Note: fnd_ufo can be used at wc prompt to list unprinted ords & admin
COT Note: fnd_cancel can be used at wc prompt to list canceled ords
***********************************************************************
Press RETURN KEY to continue
