The Official Phreaker's Manual

   This article is meant to provide an explanation of Automatic Message
Accounting (AMA) and how it was/is used in the past and present.

   All information included in this file is correct to my knowledge, however,
if anyone notices any errors or has anything interesting to add, try to get in
touch with me one way or another and let me know.

   Hopefully this article will clear up any misconceptions about AMA that
have been circulating around on bulletin boards and by word of mouth. Keep in
mind, however, that the information here may not be applicable to your
specific area or telco. The information contained herein generally applies to
the BOC's, and if you are served by an independent telco, your method of
billing may differ.

   This article is aimed more towards the more experienced telecommunications
enthusiast. People with limited knowledge may have a hard time understanding
the information presented here. However, if you can contact me I will try to
answer any questions or clarify anything included in this article that isn't
understood.

   Information will be included in this article concerning the use of AMA in
the past. This is being done for people in older areas or areas served by an
independent telco that may still be using the old technology.


HISTORY

   In the past, Call Detail Record (CDR) information was collected and
recorded by cordboard operators in a process known as manual ticketing. The
operator recorded this information by writing it down manually upon a
formatted record called a ticket. These tickets were sent to the appropriate
office where billing was handled. This manual ticketing process was
time-consuming, and was phased out with the introduction of electromechanical
switching.









                                   Page 47




                       The Official Phreaker's Manual


   Before the advent of AMA, a magnetically operated counter called a message
register was associated with each subscribers line in a given central office.
This counter was responsible for counting the number of calls that each
subscriber made, for billing purposes. This message register was caused to
operate one or more times when the called party answered the telephone. The
way this works is when the called party answers, a reverse battery signal was
sent back over the trunk circuit to activate a relay in the originating office
which was responsible for the application of a 48-volt battery to advance the
message register the appropriate number of units. A local call is/was usually
one message unit, regardless of how long the call lasted.  Local calls to
further away areas were/are usually two message units.  Long distance calls
were handled either by cordboard operators, using manual ticketing, or by a
method not involving operators known as zone registration. With zone
registration, calls to different zones would cause the message register to
operate two or more times per time period. This would make the cost higher for
longer calls, and less for shorter calls.

   At the end of the billing period, each message register had to be manually
photographed to keep track of the number of calls made by that specific
subscriber. These photos were taken by a 35 millimeter camera that was known
as a Traffic Usage Recorder, and then sent to the same place that manual
tickets (prepared by operators) were.  However, this method of billing soon
grew costly and inefficient, so a new method, LAMA (Local Automatic Message
Accounting) was developed. Additional and more specific information shall be
included later in the article.

   In the late 1940's, the Bell System developed LAMA, which recorded the
billing information in a much more efficient manner. However, some end offices
did not have enough call traffic to warrant the installation of LAMA
equipment.  To solve this problem, CAMA (Centralized Automatic Message
Accounting) was developed in the mid 1950's. CAMA was different from LAMA in
that it was based in a toll or tandem office and could record the AMA
information for every end office that it served. More on LAMA and CAMA will be
included later in the article.

   Another development concerning AMA is the computerization of the system,
named LAMA-C or CAMA-C, for 'LAMA-Computerized' or 'CAMA-Computerized'. CAMA
had used paper tape perforators for a time before the magnetic tape method was
introduced with CAMA-C. LAMA-C is a computerized version of LAMA which also
uses magnetic tape (LAMA-C is still used today). LAMA and LAMA-A (previous
versions) used paper tape, although LAMA-A was more efficient.

   LAMA, LAMA-A, CAMA, and CAMA-C were all part of the AMARS, the Automatic
Message Accounting Recording System. However, a newer term for more modern
setups is the AMACS, for Automatic Message Accounting Collection System. The
AMACS includes end office AMA systems, a recent introduction called the AMARC
(AMA Recording Center), AMARC sensors from end offices to the AMARC, the data
links used to transmit billing information, and data recievers located at the
AMARC site. The AMARC is a product of the new age of computerized technology
as it applies to the telecommunications systems used in our society.  Still,
LAMA and CAMA and their different versions shall be described and explained to
help people understand how they were/are used.






                                   Page 48




                       The Official Phreaker's Manual


LAMA

   LAMA is described by Notes on the Network (1983) as 'A process using
equipment located in a local office for automatically recording billing data
for message rate calls and for customer-dialed station to station toll
calls'.  What this is means is that if your CO uses LAMA, and you are on a
single party line (most people are), all 1+ toll calls will be billable by
LAMA equipment, and all calls coming from message rate lines. A message rate
line, for those of you not familiar with the term, is a telephone line that
has the ability to receive incoming calls, but all outgoing calls will cost
the subscriber. The subscriber pays for basic service (the ability to receive
calls) with the consideration that all other calls (even local ones) will cost
a certain amount of money per call. Many subscribers in several major cities
get this feature automatically, and thus phone bills are generally higher in
these areas.

   LAMA originally recorded billing information on punched paper tape, in a
version known as LAMA-A, but now magnetic tape is generally the format used in
places where LAMA-C equipment is used.  The paper tape perforators that
recorded the CDR data in LAMA-A were noisy, and they needed maintenance due to
their electromechanical construction. The magnetic tape method is much more
reliable, and quieter as well.

   If a persons End Office uses LAMA, then all toll calls from all lines and
all local calls from metered rate lines are recorded on the LAMA tape, with a
few exceptions. LAMA can only be used to record AMA information for one and
two party lines. On other party lines such as three and four party, the
originating caller has his/her number identified by an operator via the ONI
(Operator Number Identification) method. It is not been determined by the
author if the BOC (Bell Operating Company) operators such as TOPS (Traffic
Operator Position System, made by Northen Telecom Inc. of Canada) or MPOW
(Multi-Purpose Operator Workstation, by US West) operators would be used for
this ONI or not. I would guess that AT&T TSPS operators would handle an
inter-LATA toll call, and that the BOC TOPS/MPOW operators would handle the
ONI for an intra-LATA call (my reasoning behind this statement is the fact
that whenever I have had an ONI due to equipment failure, which is similar to
ONI needed, only the ANI outpulsing was garbled, the called number was still
transmitted in the correct fashion.  I am assuming that the end office
switching system would route the call to the correct operator position by
matching the NPA-NXX with some sort of internal table which makes a
distinction between intra and inter-LATA calls). Anyway, these calls had their
AMA information sent from the appropriate operator position to the toll office
that served the 3+ party line, onto CAMA tape.  Another instance in which a
LAMA office may use CAMA instead is when an ANIF (ANI Failure) occurs. If the
ANIF is sent to TSPS, then that TSPS will record billing information upon CAMA
tape by using ONI. It seems that AMA information that has been recorded by an
operator is buffered and stored until it is time to send the information to
the appropriate places for processing. In the case of AT&T TSPS operators, the
TSPS had it's own magnetic tape which was sent to the RAO (Regional Accounting
Office, formerly called Revenue Accounting Office) on a regular basis. I am
not sure if this method is still used or if TSPS AMA has been updated or
enhanced in some way.






                                   Page 49




                       The Official Phreaker's Manual


EXAMPLES OF LAMA USAGE

   The following is the call flow procedure in a LAMA-A (paper tape) system.

   After a customer completes dialing, the dialed number (the called number),
the originating class of service, Line Equipment Number (LEN), and call type
are sent from the switch to the AMA equipment.  Translations, such as figuring
the billing telephone number from the Line Equipment Number, are done. The
information that comes from the translations procedures determines which paper
tape perforator shall be used to record the data for this specific call. A
record of the initial information gathered is called the initial entry. The
last line of the initial entry contains a two digit code called a Call
Identity Index, which identifies telco equipment such as the trunk or district
junctor that will be used for that call.

   When the call is answered, another entry is made, called the answer
entry.  This entry is a single line on the paper tape and has the CII and the
exact time that the call was answered on it.

   The last entry on the paper tape is known as the disconnect entry.  This
entry contains the CII and the exact time that the call ended.

   The CII is important because it is what the RAO used to group together all
the data about a given call. Entries are recorded at different times in a LAMA
system, they are not in sequential order, so the CII makes it easier to find
all three entries for a specific call.

   This method of recording AMA information required the RAO to 'unshuffle
the deck' when it came time to organize the AMA information. The variations in
the AMA recording formats used by different switching systems eventually led
Bellcore to develop a standard AMA format, named the Bellcore AMA Format
(BAF).  More information will be included about this format later in the
article.

   In a No. 5 Crossbar switching system, the AMA setup used special purpose 3
inch wide paper tape on which AMA records were recorded by CO equipment. This
method of recording is for the stone ages, as it has been phased out by almost
every BOC. Similar to the LAMA-A call flow, this method of AMA used three AMA
entries. The first one was the customers service information, which included
the calling and called telephone numbers, the second one was recorded when the
telephone was answered, and the third one was recorded at disconnect.  This
also made the job at the RAO a bit harder, as again, they had to 'unshuffle
the deck'.

   The No. 2 ESS introduced the latest magnetic tape recording technology
that was available at that time. The 2E used 200 BPI, 7 track mag tapes, and
it introduced special data coding conventions.  It's technology and
conventions are still in use today, but I think that the BPI and number of
tracks have been increased. The 2E mimics the No. 5 Crossbar AMA method by
recording three entries and interleaving them on the magnetic tape. Data
common to all calls on a tape (such as date, CO info, etc.) are recorded in
special tape headers. The No. 2B ESS was introduced with the same AMA
technology as the 2E, but a 2B that provides equal access capabilities for
interexchange carriers adds a new data entry to the three used by the 2E. This
new entry reports the time of connection of a carrier to the local network,
which is needed for carrier access billing.


                                   Page 50




                       The Official Phreaker's Manual


   The No. 1 ESS modernized the AMA process even more. The 1E used 200 BPI,
nine track tape. The 1E provides data collection memory registers for AMA
information on applicable calls. A register is assigned to an AMA call and
kept open for the call's duration. This register collected most of the billing
data that was needed. The AMA information was then written to magtape at the
time of disconnect.  This made it easier for the RAO to process. The AMA
format used by the 1E uses variable length records whose fields occur for the
most part in a general, preset pattern. Eventually, though, even the 1E AMA
method was found to be slightly faulty. This was due to high processing costs
at the RAO and the problem of tape headers getting erased from the tape. The
BAF was made to solve the problems that are associated with other AMA setups.
An update to the BAF is called the EBAF, or Extended Bellcore AMA Format. The
main difference between the BAF and EBAF is that EBAF is more flexible and can
be used easier, as the BAF uses a defined structure for storing data. The EBAF
can append other information to the end of an AMA record, and this makes it
more flexible.


ANI FORMATS

   The ANI formats outpulsed in a LAMA arrangement are as follows (assume
that the call being shown for an example is being dialed from a home
telephone, as dialing from coinphones would cause different ST signals to be
sent; also the type of signaling in this case is SF in-band):


                     CALLED number:KP+(NPA)+NXX+XXXX+ST

                      CALLING number:KP+I+NXX+XXXX+ST


   The second format is the ANI associated with LAMA and is sent to the LAMA
equipment after the ANI receiving trunk winks. The NPA included in this
example is optional and only needed if the subscriber is making a call to a
Foreign NPA (FNPA). The complete called number is not included in all cases,
as when an AMA setup is configured for bulk-billing. In bulk-billing, the
entire called number is not recorded, but just enough for billing purposes.
The CALLING number is the number that the subscriber is dialing from.  These
two numbers are sent in Multi Frequency (MF) tones to MF receivers located
within a CO. The I in the ANI is an information digit, and these shall be
explained later in the article.

   One may wonder how a CO knows which lines it serves are message rate lines
and which are flat rate. On electromechanical switches such as Step by Step,
No. 1 and No. 5 Crossbar (it should be noted that there are no remaining panel
switches within the Bell System), there is an electronic line card associated
with each Directory Number which holds information relevant to that line.
These cards have to have any type of change hardwired into them. However, in
digital/ electronic switching systems, there are Line Class Codes which
reflect information about each subscribers line. There are many, many of these
codes.  Some of the more common and interesting ones are listed below:







                                   Page 51




                       The Official Phreaker's Manual



   LCC                                          EXPLANATION
   ---                                          -----------

   1FR                         Single party Flat rate Residential
                               line

   1MR                         Single party Metered rate residential
                               line

   1CF                         Single party Coin First coin
                               telephone

   1OF                         Single party Official (telco) line

   1FB                         Single party Flat rate Business line

   1MB                         Single party Metered rate Business
                               line


   These codes can be found for a line in several places, such as certain
fields in telco computer output reports. COSMOS and LMOS are two such
computers that hold this information. If you find COSMOS printouts or have
access to COSMOS, these Line Class Codes will be listed under the 'LCC' field
in an ISH, INQ, or other inquiry.  Sometimes the data in the LCC field will
match or be similar to the data in the US field, which is a USOC (Universal
Service Order Code).  A USOC and an LCC aren't the same thing though.


CAMA

   CAMA operates along the same basic principle that LAMA does, except that
CAMA is based in a toll or tandem office (class 4). CAMA is made to be used in
areas where it would be costly to implement a LAMA arrangement for each and
every class 5 office. This is because some end offices did not have enough
traffic to warrant the cost and work required to install LAMA equipment. LAMA
setups can/could be found in abundance in rural areas near large cities.

   The first letter in each of the acronyms (L)AMA and (C)AMA describes the
usage of each. (L)AMA, for Localized, in a local central office, and (C)AMA
for Centralized, in a toll office.

   The outpulsing formats to CAMA are similar to the LAMA ANI outpulsing. The
outgoing trunk to the serving CAMA office from the end office sends the called
DN in the format of KP+(NPA)+NXX+XXXX+ST.  Next, the incoming CAMA trunk
requests the end office to send the calling number. This is sent as
KP+I+(NPA)+NXX+XXXX+ST, where the I is an information digit which gives
information about the status of the process, and the NPA may or may not be
needed, depending upon the setup. The information digits that follow are used
in ANI outpulsing to Local and Centralized AMA. They are:







                                  Page 52




                       The Official Phreaker's Manual


   0-Automatic Identification (a normal call, with no special
     treatment);

   1-Operator Identification (ONI-call is sent to an operator who
     requests the customer to give the number they are calling from);

   2-Identification Failure (ANI Failure, handled the same way as
     ONI).


   The ONI due to ANIF and normal ONI which is used on certain party lines
are kept track of. If too many ANI Failures happen, then a report will be
generated indicating this fact. ONI needed is more standard and ordinary, and
thus safer for the telecommunications enthusiast. This information can be put
to a good use, as if you find an outgoing CAMA trunk when you are boxing, you
can place calls over it by using the above CAMA formats. The only limiting
factor is that the NXX of the calling number that you sent for ANI must be an
office that is served by the particular CAMA offices trunk that you are using.

   Note that CAMA is not used much anymore, it was mainly used with Electro-
Mechanical toll switches such as the No. 4A Crossbar, and the Crossbar Tandem
(XBT). I don't think there are any XBTs or 4As in operation in the AT&T toll
network, but CAMA may be used by independent telcos, or by telcos in rural
areas that serve only a small number of central offices. In an independent
telco setup, a CAMA arrangement may be used, but not in the same way as AT&T
has used it. The centralized location may not be a toll office, it may just be
the largest CO in that companies network. There can be several variations.
CAMA was originally introduced to work with and in conjunction with ANI, thus
the original term for the process, CAMA/ANI. For a complete description of ANI
in electromechanical switching systems, see one of the older issues of Phrack
Inc. newsletter for a file written by Doom Prophet and myself, titled
'Automatic Number Identification'. I have seen CAMA mentioned in recent telco
information, so I assume that CAMA is still in use, at least in some places.
Supposedly a way to determine if you are on CAMA is to dial local numbers, and
send 2600Hz.  If you can seize a trunk, then it is likely that you are served
by CAMA. You can then pick local exchange codes, (NXX), dial them, seize a
trunk, and then MF using the CAMA format included above, sending a false ANI
for one of the local exchanges. If you do this, I suggest that you don't send
the ANI of a resident. Use non-working numbers, disconnected numbers, payphone
numbers. I am not sure if there is any check done upon the number sent in ANI
by the toll office or not, but it is probable that the local switch is
responsible for screening out invalid numbers and such. So if you can get on a
CAMA trunk then you have the power to bill calls to anyone else who is served
by a CO that homes in on the same toll office and uses the same CAMA
equipment.













                                   Page 53




                       The Official Phreaker's Manual


                        AUTOMATIC MESSAGE ACCOUNTING

                                    (AMA)

                                 An overview

                         Written by Phantom Phreaker


                             


    The standard AT&T Toll office switch, the No. 4 ESS, is also equipped to
handle CAMA if necessary. The CAMA procedure is as follows: Call data for the
CAMA call is kept in a buffer (technically called an Accounting Block (AB))
which then stores the entry upon a nine track 800-bpi (bits per inch) AMA tape
(note: the information used in research for this part of the article was
rather old, so the bits per inch has probably increased). The data that are
kept in this buffer and put on the tape are as follows: the calling DN, the
called DN, answer and disconnect times accurate to 0.1 second, and other misc.
information. The callers DN can be entered into the 4ESS in two ways, ANI or
ONI. ANI is of course the normal method for identifying a callers DN for
billing purposes. ONI is used when there is an ANIF, or when it is needed (the
other equipment cannot get the DN with ANI). When the 4E gets an ANIF or an
ONI needed, it sends the call to a TSPS operator, who should ask the caller
for their number. When an operator gets an ONI situation 'from' a 4E, she uses
two types of trunks, a talking trunk, and a keying trunk. The talking trunk is
what the subscriber comes in upon and is the line over which the operator asks
for the callers DN. The keying trunk originates at the 4E and terminatates at
TSPS, and is what is used to send the callers DN (in MF) to the 4ESS office.
The operator has access to both trunks at the same time, thus she can enter
the number in a quick and orderly fashion.

   When a line classification does not fit into the 'one information digit'
(KP+I+NNX+XXXX+ST) category, two information digits are used. When two are
used, they are called screening codes. Screening codes are outpulsed along
with the ANI for certain types of telephone lines, and when ANI is being sent
to an alternate carrier via 'Equal Access' (Feature Group D, 1+ dialing).
These screening codes are two digits and precede the subscribers DN. An
example of screening code outpulsing is as follows:

                              KP+II+NNX+XXXX+ST

   The II represents two information digits that precede the callers number.
Some of the more common screening codes are as follows:

     KP+00+NXX+XXXX+ST     Normal telephone call, identified POTS line;
     KP+01+NXX+XXXX+ST     ONI needed on a multiparty line;
     KP+02+NXX+XXXX+ST     ONI needed due to ANI Failure;
     KP+07+NXX+XXXX+ST     Hospital, inmate type telephone;
     KP+08+NXX+XXXX+ST     Line restricted from dialing inter-LATA;
     KP+10+NNX+XXXX+ST     Telco test call;
     KP+20+NNX+XXXX+ST     Automatic Identified Outward Dialing centrex call;
     KP+27+NNX+XXXX+ST     Coin telephone call.




                                   Page 54




                       The Official Phreaker's Manual


   These double digit outpulsing formats are used in Equal Access areas, and
a similar method of outpulsing is used when customers deal with TSPS
operators.
   For more information, see the July, 1987 issue of 2600 Magazine, an article
entitled 'How phreaks are caught'.

AMARC

   The AMARC, or Automatic Message Accounting Recording Center, is a fairly
modern development toward recording billing information. It offers the telco
several advantages to the older electromechanical setups, such as increased
revenue (always a plus in their eyes), reduced RAO processing costs, a new
computerized format that stores data on 1600 bpi, industry compatible magnetic
tape, elimination of loss due to paper tapes being destroyed, and elimination
of per-office paper tape pickup and delivery.


THE NO. 1 AMARC

   The first version of the AMARC was the No. 1 AMARC, which received billing
data on a real-time basis over dedicated data links. It was based on two DEC
PDP-11/40 minicomputers. The No. 1 AMARC controls and recieves data from a
maximum of thirty dedicated channels. A channel consisted of a dedicated line
(probably a Private Line service) equipped with a 202T data set, operating
asynchronously at 1.2 kbps. The No. 1 AMARC had a feature which allowed it to
call, over the DDD network, a backup channel in case one of the normal
channels experienced a failure. This backup channel could be reached by anyone
who had the phone number. It has not been determined by the author if there
was/is any security on these backup channels.


THE NO. 1A AMARC

   Eventually, it was decided that more data channels were needed, and that
the AMARC computer could be centralized, and not clustered in administrative
centers, as was the procedure. The No. 1A AMARC fulfilled the telco's needs.
The No. 1A AMARC uses a higher capacity minicomputer, the DEC PDP-11/70, and
Western Electric peripheral equipment to provide ninety input channels,
improved maintenance capabilities, and room for growth in several areas. The
first No. 1A AMARC began operation in 1981 in the Chicago area.

   An important feature common to both the No. 1 and No. 1A AMARC was the
ability to recieve billing information electronically over dedicated lines
from central office switches. Equipment located in central offices called
sensors send this data. There are different types of sensors for different
types of switching equipment, but the most common AMARC sensors shall be
listed here.











                                   Page 55




                       The Official Phreaker's Manual


   The Call Data Transmitter (CDT). The newest AMARC sensor. The CDT is a
microprocessor based system which is used to collect data from No. 5 crossbar
offices. It is designed to be used in systems that do not have LAMA-A and do
not have enough traffic to warrant the expense of installing the No. 5 ETS.
It can be used with other sensors, and is not the only kind used in No. 5
crossbars. The first one was cut over in Illinois in 1980.

   The Call Data Accumulator (CDA). Similar to the CDT, but uses wired logic
control. The CDA, which collects AMA information from SxS switches, was the
first sensor to be made for use with the AMARC. This sensor is connected to
the ring, tip, and sleeve leads in a SxS switch, probably at the MDF. The
first CDA was cut over into service in New York in 1975.

   The Billing Data Transmitter (BDT). Used in electromechanical offices,
such as the Nos. 1, 5, 4, and 4A Crossbar, SxS CAMA, and the Crossbar Tandem
(XBT).  The BDT replaced up to 10 paper tape perforators that were previously
used.  Provides a newer alternative to LAMA-A. The BDT recieves billing data
from the older LAMA-A paper tape recorder circuits and sends them to the
AMARC. The first BDT was cut over in New York in 1976.

   The No. 5 Electronic Translator System (ETS). The No. 5 ETS was added to
No. 5 Crossbar systems to provide some electronic switching functions that
were not present before. These functions are things such as line, trunk, and
routing translations provided by software methods rather than wired cross
connections.  The No. 5 ETS consists of duplicated Western Electric 3A
auxillary processors with associated scanners and distributors. The first No.
5 ETS was installed in Ohio in 1977.

   VIDAR, a special sensor used in Crossbar No. 1 offices. VIDAR does not
interface with the AMARC but instead sends data to it's own tape. This tape is
then sent to the RAO on a regular basis.

   These various sensors are specially designed electronic units which are
part of or connected to class 5 offices. These sensors collect and generate
billing data from the office they are used with. The billing data consist of
answer and disconect times, call type, and the amount of measured local and
toll calls made.

   Some offices have added sensors, but exceptions include several ESS
systems which use SPC (Stored Program Control) to send data to the AMARC. SPC
means that the sensor is built into the switch software and that no other
equipment is needed. An example of this is the NTI DMS-100 switch. Nos. 2, 2B,
3, 3B, and No. 5 ESS also do not have special AMARC sensors, but send data to
the AMARC over a synchronous connection via a SPUC/DL (Serial Peripheral Unit
Controller /Data Link) at speeds of 2.4 and 4.8 kbps. There is another part in
the 2B ESS AMARC data link, called the AMARC Protocol Converter (APC). The APC
is a medium between the SPUC/DL and the AMARC.
   The No. 4 ESS, TSPS, 1ESS, 1AESS, and 2ESS switches don't have AMARC
sensors, and aren't even connected to the AMARC. These switches all have their
own AMA systems, from which the data is sent to the RAO regularly. Another
exception is the DMS-10 Remote Switch, which is connected to a device at the
RAO called a collector.
   There are other options possible when dealing with AMA collection, such as
the Distributed Call Measurement System (DCMS) made by a telco equipment
vendor, which acts like a mini-AMARC, and Northern Telecom's Distributed
Processing Peripheral system, which is used to collect billing data from NTI's
DMS switches. These systems can be used where applicable.

                                   Page 56




                       The Official Phreaker's Manual


RECENT DEVELOPMENTS

   In places where magnetic tape has been phased out, a new method of storing
the AMA data called AMA TeleProcessing Systems (AMATPS) has been implemented.
AMATPS overcomes the disadvantages of magnetic tape (such as the sequential
way the data is recorded, the high-density data losses that may happen, and
the sometimes unseen problems with the tape unit) by using random access disk
drives. AMATPS also adds some new system parts which can make the job easier.
Still, some AMATPS are not used to their full capability and can still present
problems to the telco.

   One of the parts that AMATPS adds to the overall AMACS is the use of AMA
Transmitters (AMAT's). These transmitters are added to the sensors, and
increase the power of the overall setup by providing things such as temporary
storage areas and programming applications. AMAT's are generally PC-sized
machines with two disk drives, and 50-150 megabyte hard disks.

   The second important addition is the collector. The collector acts like
the AMARC by polling the AMAT over data links. The collector, like AMARC, is a
centrally located computer system, usuallly running on an IBM Series 1, an
HP-1000, or an AT&T 3B5.

   Teleprocessing systems are made to understand a common AMA language format
made by Bellcore, the Bellcore AMA Format and Extended Bellcore AMA Format.
These were mentioned in part A of this article.

































                                   Page 57




                       The Official Phreaker's Manual


BOC/AT&T INTERACTION

   Since the majority of people are served by AT&T, one may wonder how inter-
LATA call data gets to the given Inter-LATA Carrier (IC), in this case, AT&T.
AT&T has its own AMA collection system, which is called BILDATS (BILling DATa
System), and this is what collects the AT&T data. I would guess that each AT&T
toll office has some sort of interface with this computer system, but I have
no solid proof of this. It has also been suggested to me from a reliable
source that AT&T sends each BOC their own magnetic tapes, which the BOC's then
fill with AT&T's billing information. I am not sure which of these methods is
used.

   The BOC billing information takes a different route, however. On a regular
basis (I believe each day), AMARC tapes are sent to the Regional Accounting
Office (RAO) or billing office, where each customers intra-LATA traffic is
calculated and their telephone bill printed and mailed. The customer then
recieves the bill and goes about whatever method of payment he chooses.
Telephone bills can usually be paid in person in many different places in
large cities, or they can be mailed in directly if the customer wishes. In my
area, the customer pays once, which is a total of his AT&T and BOC bill. This
is payable to the BOC, and AT&T then gets their payment from the BOC. In the
case of independent carriers such as US Sprint, MCI, ALC Communications, and
the like, I cannot say for sure what they all do as there seems to be no
standard procedure for this interaction, but in two instances, two specific
RBOC's (US West and BellSouth) handle FG-D Equal Access style billing for MCI
throughout their serving areas. There is a computer system involved in this
alternate carrier billing cycle, called the Carrier Access Billing System
(CABS). This system calculates the prices bases on tariffs in use, and bills
the carriers on a monthly basis accordingly. I am not sure how widespread the
use of this sytem is, though. When the customer receives his MCI bill along
with his BOC bill he can pay them both at once. I would imagine that the
larger long distance services would be able to afford getting this service
from the RBOC's, while the smaller ones with less money would do it by
themselves, which would probably be a slow, drawn out process. In some cases,
dialing via an alternate carrier (other then your primary one) will cause the
billing cycle to take anywhere up to three months to complete, or even more.
Another interesting note about alternate carrier dialing, some carriers do not
start billing until a specific amount of time has elapsed. This is known as
buffer-zone billing. I know of one company that uses a 45 second buffer zone,
but I am not sure what the other companies use. You can find this information
out by talking to a customer service department, however some companies CS
departments either don't know, or they do not wish to tell the customer (or
'potential' customer). With buffer zone billing (assume 45 seconds in this
case), you will be billed for the call if you let the phone ring, listen to a
busy signal, etc. if the duration of the call is greater than or equal to 45
seconds. Many of the ICs that use this type of billing do not have the
equipment to detect answer supervision, so if you can keep a conversation very
short, you may get away with a free call, without breaking any laws.










                                   Page 58




                       The Official Phreaker's Manual


CALL CREDITING

   When you receive credit for improperly placed long distance calls from an
operator or a telco business office (after you receive your phone bill)
certain things happen.

  Operator crediting involves the operator entering a special flag on an AMA
tape to deduct the specific amount of given charge from the subscriber's
telephone number. I believe that this process involves (with AT&T TSPS) the KP
TRBL key, and (with NTI's TOPS) the KP TRBL and the CHG ADJ (charge adjust)
keys.

  Business office crediting happens when you call the business office and
talk to a BOC 'service representative'. This person will then enter your
telephone number into a terminal, using the DOE (Direct Order Entry) system,
which is in use in my area. The billing record information comes from a
computer called CRIS (Customer Record Information System), which is accessed
by BOSS (Billing and Order Support System). BOSS has a link to computer
systems at the RAO, as this is how the customer's toll data gets to the
business office. A service representative can then pull up your toll charges
and correct them with appropriate credit entries.


SECURITY  (EVERYONE READ THIS PART)

   There have been several rumors going around about AMA and it's relation to
people who commit toll fraud, and I will attempt to clarify these rumors. It
is possible that a billing tape could be used to try to find out who called a
certain number at a given time. Another way AMA tapes/disks could be used as a
record of someone committing toll fraud would be if this person would happen
to be under a newer switch, such as the DMS-100, and they attempted to use a
blue box without knowing the dangers of it (I will speak only on the DMS-100
because when a older switching system is replaced with a new one, the most
common replacements are the AT&T No. 5 ESS and the Northern Telecom DMS-100
Family of switching systems). DMS-100 does indeed have the capability to
record a blue boxer's MF tones in an AMA record if the boxer doesn't know what
he is doing.  1AESS also has blue box detection features. I am not sure about
other switching systems, but I would guess that most of the newer switches
have some sort of blue box fraud detection features, of course the end user of
these switches (the telco) does not have to use them. However it is difficult
to find out if your CO uses anything of this nature unless you are a good
social engineer or have access in some way to the switch or switch output
messages and know what to look for. For instance on the Northern Telecom
DMS-100 switching system, there are a series of reports known as BLUEBOX
reports which (if in use) will inform the telco of blue boxing activity. The
DMS-100 also has AMA options that can detect certain forms of electronic toll
fraud, such as black and blue boxing. These options can be set any way the
telco wants. These AMA options can be printed on a DMS-100 switching
system,onto hardcopy terminals, or onto a data channel which may send the
Output  Messages (OMs) to a telco computer system such as the Switching
Control Center System (SCCS). These options are printed in an AMA118 OM at
midnight. If an AMA option is in use by that particular switching system,
after the name of the option will be a data field that says ACTIVE. If the
option is not in use, the field will say INACTIVE. An example of an AMA118 OM
is reproduced here.



                                   Page 59




                       The Official Phreaker's Manual


 AMA118 JUL23 12:00:00 2234 INFO AMA-OPTIONS
    AUDIT:       ACTIVE
    CALL-FWD:    ACTIVE
    CDAR:        INACTIVE
    CHG411:      ACTIVE
    CHG555:      ACTIVE
    COIN:        INACTIVE
    DA411:       ACTIVE
    ENFIA-B-C:   INACTIVE
    FREECALL:    INACTIVE
    HIGHREV:     INACTIVE
    INWATS:      ACTIVE
    LNID:        INACTIVE
    LOGAMA:      INACTIVE
    LOGOPT:      ACTIVE
    LONGCALL:    ACTIVE
    LUSORIG:     INACTIVE
    LUSTERM:     INACTIVE
    OBSERVED:    INACTIVE
    OCCOVFL:     ACTIVE
    OCCTERM:     ACTIVE
    OUTWATS:     ACTIVE
    OVERFLOW:    ACTIVE
    SST:         ACTIVE
    TIMECHANGE:  ACTIVE
    TRACER:      ACTIVE
    TRKID:       INACTIVE
    TWC:         INACTIVE
    UNANS-LOCAL: INACTIVE
    UNANS-TOLL:  ACTIVE




























                                   Page 60




                       The Official Phreaker's Manual


   The most important ones for phreaks to know about are INWATS, LONGCALL,
SST, UNANS-LOCAL, and UNANS-TOLL. INWATS means that calls to 800 numbers are
noted in an AMA record. As far as I know, this option is a required one, at
least since Bulk Change Supplement 23 (BCS23). LONGCALL will flag long calls
in an AMA record. So if it seems to the switch that someone has been on the
phone for a long time, this will be logged. A possible use for this would be
to detect trouble conditions. This option, used in past switching systems, may
have been the cause of many blue box busts. Someone would box for several
hours using the same number (for instance, Directory Assistance) and this may
have been noted by the switch. Another way I think old time boxers may have
been nailed is from boxing off of DA. As you can see in the above listing,
there are several options that probably make AMA entries for calls to DA. If
the length of a call to DA lasts longer than a certain amount of time, the
telco could possibly detect this and attach a monitoring device upon the
suspected persons telephone line. The AMA option 'SST' may also be responsible
for blue box busts in the recent past. SST stands for Short Supervisory
Transition, and an SST is known to the phreak world as a wink. SSTs are
generated when a blue boxer seizes a trunk. The switch can detect these and
log them in an AMA record if the option is set to ACTIVE. SSTs are not solely
caused by boxers, though, as equal access offices can generate a lot of SSTs
in normal operation. I believe that trunking arrangements with ICs (InterLATA
Carriers) are often responsible for triggering these. One toll office I knew
of had thousands of SSTs on a plant measurement report, so if this option is
ACTIVE, it may not be EXTREMELY dangerous, but it can't hurt to know about
this. One possible way around the SST detect is to make your 2600Hz tone last
several seconds. I do not remember the exact figure, but after a certain
number of seconds an SST ceases to be an SST ceases to be an SST. I am not
sure if these longer transitions are logged or not, or if there is even an
option for this. However I believe that the BLUEBOX feature could not be
fooled by doing this. BLUEBOX, if activated, will detect any foreign winks
after a necessary one (necessary for call completion) occurs. Of course you
can always avoid having your DN associated with anything like this by
re-directing your call flow, which can be accomplished easily.

   Another AMA option that could be used to catch black boxers is the
UNANS-TOLL option. When this option is ACTIVE, toll calls ringing longer than
a specific period of time can be logged in an AMA record. Someone calling toll
from a DMS-100 to a person using a black box (does anyone still use devices
like the black box anyway?) in a no. 5 crossbar may trigger this option to be
logged. I say 'may' because I am not positive about this, the option could
also be used in other ways, I imagine.

   The ENFIA-B-C option is one that could possibly present a problem to a
telecom enthusiast. I have seen the term ENFIA (Exchange Network Features for
Interstate Access) associated with a Feature Group A (POTS dialup) long
distance service. ENFIA-B and C mean FG-B and FG-C service. FG-A and B (POTS
and 950+1/0xxx respectively) could possibly be used to record information
concerning toll fraud. For instance, I know of one service (FG-D and FG-B)
that has the ability to check a telcos' magnetic tape to see what numbers have
been accessing their service. If a large amount of fraud became a problem, the
carrier could get the AMA information to try and determine who is committing
toll fraud. I'm not sure if other companies have this option, I would guess
that almost all of the major companies (MCI, Sprint, Allnet, etc.) have the
ability to use something of this nature to track down security problems.




                                   Page 61




                       The Official Phreaker's Manual


   Have you ever wondered why many of the old blue boxers were caught? It is
due to the use of AMA. AMA records can reveal boxing patterns, and this info
can be used by the telco to track down blue/red/black box users. So if you are
a person who practices any of these methods, be aware of what you are up
against. Boxing has been around for a very long time and the telco knows all
about what goes on and the different methods that people use. So use care. An
informed phreak is a free phreak.


SUMMARY

   Hopefully this article has helped clear up any misconceptions about AMA
that anyone might have had, as well as provide a reference to be looked back
on. The information contained in this article can also be used for social
engineering purposes, if you so desire. However, I do not intend for any of
this information to go into harmful purposes, such as billing calls to other
people, or causing confusion and disorder at any internal points in the telco.
Such actions do not make a person a phone phreak. However, if you find out
anything interesting concerning AMA that isn't included here, or anything
about independent telcos billing systems, feel free to let me know.

   If you wish to contact me concerning this article, you can find me on a
few BBS's. I will attempt to answer any questions anyone might have, and would
like to hear from anyone who has a valid interest in the workings of the phone
systems.


===============================================================================
Thanks go out to all the people (too many to mention) who have contributed any
information (no matter how small or large) to this article. Other information
for this article has been taken from switching system messages, Bell System
Technical Journals, Bell Labs RECORDs, Bellcore documents, and various other
technical literature and information. I hope someone likes this article
because it took a very long time to complete.
===============================================================================























                                   Page 62




                       The Official Phreaker's Manual


                                  Chapter 8


                   An Overview of the Teradyne 4Tel System

   4TEL is a loop testing system mainly used by General Telephone (GTE) that
consists of a Voice Response System and a Craft Dispatch Section as well as
the facilities and equipment used for testing functions. The following text
will attempt to dispell many of the 4TEL myths that have been created in the
past years, such as the idea that it can be used to eavesdrop on lines within
its serving area. The information provided has been gained from company
publications and from personal experience. A 4TEL is not the same thing as a
REMOBS, which stands for REmote service OBservation System.



   The portion of the system that some of the phreak/hack population is
familiar with is the Voice Response System, which has normal POTS dialups.
This system greets the user with an announcement message and then asks for a
password, which is entered in DTMF tones. The legitimate use of these dialups
are for outside craft personnel (linemen) to call in, perform tests and
receive the results for subscribers' lines. The VRS is provided so craft
personnel can access the 4TEL system at times when no one is at the testboard
(at nights or weekends). Through the VRS, up to 8 craft/technicians can access
4TEL at the same time, enabling them to get more done in a smaller amount of
time.



   After a password has been accepted by the system, the electronic voice
will ask for the line number that the user wishes to be tested. The number
entered will be read back to ensure correct entry. The system will then ask
for the user to enter the mode. The modes are:


   1: Calling on other line
   2: Calling on test line
   3: Line test results




















                                   Page 63




                       The Official Phreaker's Manual


   It is possible on some VRS's to get a listing of the modes by dialing 0
when the voice prompts. Line tests are possible from both modes 1 and 2 by
dialing the octothorpe (#) key. The results of the test will be announced
along with the length of the cable in miles. Bridged ringers, if any, will
also be noted. Mode 3, the line test results section, will tell the user there
are no test results available unless they have beeen previously entered. The 7
key is the monitor command from both test modes. If there is speech on the
line, it will be detected electronically but will NOT be heard by the user.
The monitor command is not 'REMOBS' (Remote Observation) but a method of
determining if the line is busy due to normal means (conversation) or due to
some trouble condition at the switch. When the system asks for the ID code for
a monitor command, the system will accept the line number as well as the
initial password, and even a secondary password before dialing, but it has not
been determined by the author if this is a standard for every 4TEL. Not just
anything will work for the monitor password however as it will announce if the
ID code entered is invalid or not.


   If mode 1 is entered, these commands are available:


MODE ONE COMMANDS:


   1-Fault location
   2-Other Testing
   7-Test OK, monitor
   8-Hang up
   9-Enter next line number


   If option 7 is chosen, another menu will be available if the line tests
busy.


   2-Monitor test
   3-Overide and test
   4-Wait for idle


   If suboption one (Fault location), mode one, is chosen, these commands are
available:


   1-Open location
   3-Short location
   4-Cross location
   5-Ground location
   8-Hang up









                                   Page 64




                       The Official Phreaker's Manual


   If suboption two (Other testing), mode one, is chosen, these commands are
available:


   2-Loop ground Ohms
   3-Dial tone test
   4-Pair ID
   8-Hang up



MODE TWO COMMANDS:


   2-Other testing
   7-Test OK, monitor
   8-Hang up
   9-Enter next line number


   If suboption 2 (Other testing), mode two, is selected, these commands are
available:


   2-Loop ground Ohms
   8-Hang up



   The 4TEL system's main use is for standard testing, which is done nightly
upon every line in an exchange. This locates faults and problems before they
have to be reported by customers. All lines that have trouble detected upon
them are printed out in a report at the repair center the next morning where
the proper fault location and dispatching can be done. The measurement and
test unit of the 4TEL system is called a COLT, Central Office Line Tester,
which performs all nightly and on demand testsupon the exchange through local
test trunks.


   There are a few different types of COLTs. The standard version will serve
any CO for up to 10,000 subscribers. The COLT RS is used in rural step by step
offices (referred to as 'steppers' also) for up to 1,300 lines. The Digital
COLT is used for digital Central Offices. These can have remote Colt
Measurement Units (CMU's) for remote switches which are controlled by the Colt
Computer Unit (CCU) at the host switch. The CMU speed calls the CCU at night
to start the testing and direct the operations. The CMUs in regular end
offices have digital links (over the normal telephone network) with the SAC,
which is how the line test results are distributed to the repair center.










                                   Page 65




                       The Official Phreaker's Manual


   The 4TEL system can also test lines upon command by a human operator at
the SAC (Service Area Computer). The CRT operator enters the line number in
the proper field and 4TEL runs a full series of tests as well as displaying
past line history, fault summary, volts and current information, and the cable
length. The results of the testing are displayed in plain english, as opposed
to decimal or other format, on the screen. A dispatch decision is also
displayed after every line test to determine if a dispatch is needed.


   SAC's


   The SAC is the centralized focal point for 4TEL control and reporting.
This computer is located in the repair center and distributes test/work
information between CRT's and COLT's. The SAC formats the results of routine
testing into a daily advisory report as mentioned earlier.



   There are several types of 4TEL reports that are worth noting. The
DISPATCH report lists troubles that can  have an immediate dispatch for them.
These also tell the location of the fault (cable, CO, station, etc.) and are
classified into two types, moderate and severe, relating to how service
affecting the problem may be. The CABLE report lists all new cable faults. A
Plant Status report summarizes the condition of the outside plant and totals
them per individual exchange. In these reports, trouble conditions can be
listed in a variety of ways. CROSSES and WETS refer to line insulation faults
and may indicate water penetration of the cable. SHORTS and GROUNDS are
insulation faults at the station set. OPENS refer to a broken, or 'open' Ring
or Tip lead in a Cable Pair. BACKGROUND refers to electrical noise caused by
power lines being nearby. ABNORMAL VOLTAGE indicates high voltage conditions.
There are others, but the reader will hopefully get the idea from the ones
listed above.


   CDS


   Another major part of the 4TEL system is the Craft Dispatch System, which
is a DTMF and speech response setup used to exchange report and schedule
information between the repair center staff and outside craftspersons. Linemen
call in to get dispatch information that has been previously entered by the
dispatcher. CDS plays back the info one field at a time. When the craft
personnel is ready to receive the next field of information, he simply says
'Go' and the system continues. A printer at the repair center informs the
dispatcher when a craftsperson has received a report. When the trouble is
taken care of, a completion report is done on the CDS in which it asks for the
closeout and schedule one field at a time to be entered in DTMF and in speech.
The clerk at the repair center then closes the trouble on the SAC/4TEL system
after the line is tested a final time to ensure proper operation.








                                   Page 66




                       The Official Phreaker's Manual


   CDS may also have audit trails of every transaction for a certain time
period. So to summarize the work flow for involving the CDS: Irate customer
calls the clerk at the repair center. The information is forwarded to the
dispatcher who enters it into CDS. Craft personnel call in and receive the
messages, do the required work, then file a completion report. The clerk then
closes out the trouble in SAC/4TEL.


   The Digital Concentrator Measurement Unit is another component of the 4TEL
testing equipment that is used to test lines in digital concentrators such as
the GTE MXU and the NTI-OPM. They are located inside Digital Loop Carrier
system remote terminals or huts and consist of a circuit board and measuring
system. It provides AC and DC measurements of subscriber loops, as well as all
the normal test/measurement functions such as fault description and location ,
dispatch messages, and special tests. The DCMU can test the lines of an
individual DLC remote terminal, or a group of terminals that are located
together. The capacity of terminals that the DCMU can test is determined by
analysis of test traffic and economic factors as well. Both the CRT at the SAC
and the VRS are compatible with the DCMU. These units are self calibrating,
unlike the PMU's of an LMOS supported Loop Testing System. The 4TEL CCU is
linked to the DCMU via either a 1200 baud dial up or a dedicated link,
depending upon the size of the office.



   Some of the tests that 4TEL performs are loop and ground resistance (which
detects resistance faults and sheath ground problems), dial tone test (in
which the number of times dial tone can be drawn during a certain period is
recorded) , busy line monitoring (not BLV or REMOBS), coin station tests
(totalizer, coin relay, etc), as well as all the standard tests which were
covered above. A pair identification can also be done, in which a tone is
placed on the pair to help those at terminal cabinets locate that specific
one, similar to the LMOS/MLT tone applique function.



   Miscellaneous notes


   If a user enters the number of the 4TEL system they have dialed in upon,
the system will announce an intercept. A user cannot monitor/test Directory
Assistance through 4TEL. Lines that are out of the system's NPA can be tested
also, but a 1 has to be dialed before the number just like an ordinary toll
call. The 4TEL VRS will give the user a 'beep' tone after a few seconds of
waiting for input. If the user doesn't enter anything, the VRS will
disconnect.  A version of 4TEL is also used by Rochester Telephone in New
York, and there may be other independent companies that  use the system. Try
to find out what system you're served by. If you're in a Bell area, it will
most likely not be 4TEL, but LMOS.

I  hope that this article has helped readers to better understand the way the
4TEL system operates. Again, there may be some differences depending upon the
area and the company. Thanks go to Taran King, Phantom Phreaker, and Lucifer
666 for supplying information in one way or another that contributed to this
file.



                                   Page 67




                       The Official Phreaker's Manual


                                  Chapter 9


                  Coin Service, The Central Office, and You

    In this file I will attempt to give a basic overview of how various
central offices handle coin service.  If you feel your interest grows due to
this file there are other good technical documents about coin service, i.e.
Bell System Practices, CDs, PDs ect..


    Coin service is differentiated from other services by a special class of
service.  All switching systems give -48 volt battery toward the coin phone on
the ring side of the line.  Coin-First lines have an open TIP during a normal
receiver-on-hook condition.  When a line goes off hook the central office
takes no action and in fact can not detect the off hook condition due to the
line's conditioning-for-ground start.   When the customer deposits money the
coin ground is extended to the ring side of the line. The ground signals the
line equipment in the central office as a to give a dial tone.
    Dial-Tone First offices give both the battery and ground to the coin
station, thus providing a dial tone equivalent to a POTS phone.  All coin
service is super current sensitive. (The central office must give at least 23
milliamps of line current and 41 milliamps of coin control current to the
farthest coin station.)


    The switching systems differ in the method which calls are handled.


No. 5 Crossbar

    The No. 5 crossbar coin-first offices must have a dual wound line relay
with both windings in series when dealing with a coin first situation.  If any
Coin-First lines are served in a No. 5 crossbar office the originating
registers must be able to desensitize the (pulsing) L relay by providing a
resistive ground throgh its tertiary winding via the coin class of service
relay.
    Crossbar offices can give coin return from Originating Registers,
TSPS/Cordboard trunks, Ring and Tone trunks, Announcement trunks, and Coin
Supervisory circuits.  Coin collect current is only given through
TSPS/Cordboard trunks and Coin Supervisory circuits.  The only circuit that
can handle a stuck coin test is the coin supervisory circuit.
















                                   Page 68




                       The Official Phreaker's Manual


    Crossbar offices handle coin actions on locally completed calls in the
coin supervisory circuit (CS).  All trunks must have access to the CS circuit
or use coin junctors or coin 1A0 trunks that have such access.  The use of
coin junctors or coin 1A0 trunks elimnate the need for other trunks to be hard
wired to the Coin Supervisory Link.  When the trunk's supervisory relays show
a coin action is needed the trunk searches for an idle Coin Supervisory
Circuit through the Coin Supervisory Link.  The bridged connection allows the
Coin Supervisory Circuit to give the proper collect or return current toward
the coin telephone and test to see if the action was successful.
    Crossbar offices handle coin actions required by DDD calls or TSPS
operators in the No. 5 crossbar TSPS trunk.  The TSPS base unit signals the
No. 5 office by either frequencies or multiwinks.  The No. 5 office receives
these signals and the trunk applies one pulse of coin collect or return or
ring back.  The No. 5 TSPS trunk dose not make a test to see if the required
coin action is successful.  If the coin is still present the call is dropped
and the coin remains in the trap.


ESS

    ESS offices provide all coin control actions from the Coin Control
Circuit.  The Coin Control Circuit is switched to a customers line under
program control.  The Coin Control Circuits always make a stuck coin test at
the end of a call.
    ESS offices handle coin actions required by DDD or TSPS operators by
scanning the TSPS trunk looking for any control signals from the TSPS base
unit.  When the ESS office sees a request on the TSPS trunk the ESS office
opens the talking path and attaches a multifrequency (MF) reciever.  The MF
reciever looks at the tones being sent from the TSPS base unit transmitter and
checks if the signal requested is a  coin collect, coin return, ring back, or
operator attached.
    Dial-Tone First (DTF) offices not equipped with expanded In-Band
Signaling give +48V talk battery during operator attached and 48V talk
batttery during the rest of the call.  If the TSPS signals for coin return the
ESS office will open the talk path again, release the MF receiver and switch
the line to the Coin Control Circuit which applies  -130V  coin return
potential.  After the coin control function is finished the system will make
on recycle attempt if the coin ground is still present.
    Local calls are handled within the ESS machine.  When a coin control
function is required the program momentarily opens the talk path and switches
the line to a Coin Control C  cuit which applies the required current.

Step By Step
    Coin lines in a Step By Step area are served on dedicated Line Finder
groups.  The Line Finders are hardwired to a coin box trunk and then cabled to
a first selector appearance.
    Step By Step offices can give coin return from coin box trunks,
TSPS/Cordboard trunks, and other miscellaneous trunks. (My knowledge of Step
By Step is vague, it's kind of like trying to research dinosaurs.)









                                   Page 69




                       The Official Phreaker's Manual


    Step By Step offices handle coin actions on local calls in the coin box
trunks.  The coin box trunk applies the coin control current through the
winding of a relay to the coin station hopper trigger ground.   When the coin
station ground disappears, the coin box trunk relay releases and allows the
connection to restore to normal.  Some Step By Step offices have a timed
release circuit that will time out after about eight attempts of coin control
action, peg the stuck coin register, then release.  If the timed release
circuit is not provided and a coin ground can not be removed, the circuit must
be manually released.
    Step By Step offices handle coin actions required by DDD calls or TSPS
operators in the Step By Step TSPS trunk.  The TSPS base unit signals the Step
office by either frequencies or multiwinks.  The Step office trunk recicves
these signals and trunk applies one pulse of coin collect, coin return or ring
back.  The trunk does not make a test to see if the action was successful.
    If a DDD call was completed to a busy number the Step By Step TSPS trunk
will apply one quick pu  e of coin return toward the coin station,  then the
coin box will check to see if the coin ground has disappeared.  If the ground
is still present the coin box trunk will repeat the attempt to collect the
coin.







































                                   Page 70




                       The Official Phreaker's Manual


                                  Chapter 10


WAR AGAINST PHONE HACKING HEATS UP
BY GREGG PEARLMAN, ANTIC ASSISTANT EDITOR

Computer break-ins are no longer viewed as harmless pranks.  For example,
unauthorized computer access is a misdemeanor under 502PC of the California
Penal Code if you just trespass and browse around -- and if it's your first
offense.
But:  "Any person who maliciously accesses, alters, deletes, damages, destroys
or disrupts the operation of any computer system, computer network, computer
program or data is guilty of public offense" -- a felony under Section C of
that code.  Even changing a password to "Gotcha" is a felony if it can be
proven that it was a "malicious access."
In California, the maximum punishment is state imprisonment, a $10,000 fine and
having your equipment confiscated.  The penalty depends on who you are, your
prior record and the seriousness of the crime.
And you don't have to, for instance, breach national security to be guilty of a
felony.  Accessing even a simple system of a small company could damage vital
data for more than a year's worth of business, especially if that company
didn't properly back up its data.
There are all kinds of computer crime.  Stealing an automated teller machine
card and withdrawing money from an account is a computer crime because you're
using a computer to get money out of a system.  But simply trespassing in a
system and not doing any damage is normally a misdemeanor, according to Sgt.
John McMullen of the Stanford University Police Services.  This kind of crime
has become very common. "Every kid with a computer is tempted," he said.
Unfortunately, it can take months to complete an investigation.  For instance,
the so-called "LEGION OF DOOM" case, beginning in September, 1986, took 10
months to solve and involved people in Maryland, New York, Pennsylvania, Oregon
and California.
If someone breaks into the computers of, for example, California's Pacific
Bell, and the break-in is severe, Pacific Bell Security gets warrants issued,
and then, with the police, confiscates computers, manuals, telephone lists and
directories -- all related equipment.  It's common for the computer to be tied
up for a few months as evidence. (And by the time Pacific Bell Security does
get involved, the evidence is usually overwhelming -- the conviction rate is
extremely high.)
"Whenever I'm involved in a case," said McMullen, "I ask the judge for
permission to confiscate the equipment.  That's one big incentive for hackers
not to do this kind of stuff. I haven't had any repeaters, but I know of one
case where the guy probably WILL do it again when he gets out.
"Usually the shock of what happens to a juvenile's parents -- who bought the
equipment and watched it get confiscated -- is enough to make them stop. But we
don't really have enough cases to know what the parents do."












                                   Page 71




                       The Official Phreaker's Manual


ACCESS

"It's easy for hackers to find company phone numbers," said Daniel Suthers,
Atari user and operations manager at Pacific Bell in Concord, California.
"Most large companies have a block of 500 to 1,000 phone numbers set aside for
their own use.  At least one line will have a modem.
"People post messages on hacker/phreaker bases on some BBS's and say 'I don't
know who this phone number belongs to, but it's a business, judging by the
prefix, and has a 1200-baud tone.' Then it's open season for the hackers and
phreakers."

Phreakers aren't much different than hackers -- they're just specifically
telephone-oriented.  In "CompuTalk: Texas-Sized BBS" (Antic, August 1987),
sysop Kris Meier discussed phreakers who appear to have called from phone
numbers other than the ones they were actually using.  A computer isn't needed
to do this -- it's usually done with a "blue box."

"The blue boxes were used mostly in the late 1960s and early '70s," said
McMullen.  "They fool the network and let people make free long distance calls
-- a tone generator simulates the signalling codes used by long distance
operators.  The boxes were phased out a couple of years ago, though:  they no
longer let hackers access AT&T, but Sprint and MCI can be accessed by something
similar.  However, computer programs are normally used now."

To get long-distance phone service, hackers now use one of several programs
passed among other hackers (on bulletin boards, for example).  They find the
local access number for Sprint or MCI and then run the program -- perhaps for a
few days.  It generates and dials new phone numbers, and the hackers can check
to see how many new or free codes they've turned up.

They can post the codes on a BBS, and their friends will use them until they
get stopped by the long-distance company -- depending on how long it takes the
company to realize that these numbers hadn't been issued yet -- or until the
customers discover that their numbers have been accessed by someone who isn't
"authorized."

Bulletin boards can be especially easy prey.  "If a hacker knew your BBS
program intimately, he could probably figure it out, but that's messy," said
Suthers.  "If he can find a back door, it's easier.  Sysops are notorious for
putting in their own back doors because, though they have all the security
under the sun on the FRONT doors, they still want to get in without problems.
It's just like what happened in the films Tron and Wargames -- which probably
taught a whole generation a lot of things."

Meier had said in the August, 1987 issue of Antic that someone once called his
board COLLECT.  Simply put, the caller fooled the operator.  McMullen says
that's been around for a long time.  "It's common in prisons and situations
where the phones are restricted." McMullen also said that if the timing is just
right, as soon as the modem answers, the phreaker can wait for an operator to
say "Will you accept the charges," then say "Yes."  The operator can't tell
which end said yes, and if the modem has a long delay before the connect tone,
the phreaker can get away with it.  It couldn't be done entirely electronically
-- the voice contact is needed.





                                   Page 72




                       The Official Phreaker's Manual


"I've never run across people accessing online services such as CompuServe in
this way, but I'm sure it happens," said McMullen.  "People suddenly get
strange charges on their phone bills. "The hackers I've dealt with are very
brilliant and good at what they do. Of course, when you do something all day
that you're really interested in, you're
GOING to be good at it."


DOOM

McMullen's most recent hacker case at Stanford University dealt with the Legion
of Doom, an elite group of hackers who broke into computers -- some containing
national defense-related items. "As I understand it, they're supposed to be the
top hackers in the nation," McMullen said.  "I started investigating the case
when it began crossing state lines, getting a bit too big.  I contacted the
FBI, who said that because of the Secret Service's jurisdiction over credit
card and telephone access fraud, they'd taken over computer crime
investigations that go across state lines -- actually, anything involving a
telephone access code.  This case, of course, involved access codes, because
the Sprint and AT&T systems were used, and it was the Secret Service, not the
FBI, that made the arrests. "I think that the publicity from this case will
scare people, and there'll be a lot less hacking for a while.  Some hackers are
afraid to do anything: they're afraid that the Secret Service is watching them,
too."


TRACING

AT&T, Sprint and MCI now have ANI -- Automatic Number Identification -- as does
Pacific Bell.  It aids a great deal in detecting hackers.  Pacific Bell usually
just assists in this type of investigation and identifies the hackers. "It's
easy to trace a call if the caller logs in more than once," said Suthers. "The
moment they dial in, a message is printed out -- before the phone even answers
-- pinpointing where it came from, where it went to, the whole shmeer.

"A blue box made it much harder to detect, but if a hacker used it
consistently, we could eventually trace it back.  So if someone is in
California and makes it look as if he'd called from New York, we can trace it
across the country one way, and then back across.  Generally, though if the
call IS billed to a New York number, the caller is actually somewhere like
Florida.  But we can back-trace the call itself, especially if it's extremely
long."

But recently someone broke into Pacific Bell "through a fluke of
circumstances."  Suthers said, "We closed down that whole area, so they can't
get back in that way, but if they dial the number again, they're in trouble."
If Pacific Bell Security detects a break-in, the area is secured immediately.
Sometimes hackers are steered toward a kind of "pseudo-system" that makes them
THINK they've broken in -- but in fact they're being monitored and traced.
As to how many hackers there are, who knows?  There's a lot of misuse and
inside work that's never detected or reported.







                                   Page 73




                       The Official Phreaker's Manual


SECURITY

Security systems are expensive, but someone with a lot of data and an important
system should seriously look into one.  Very few hackers are caught, simply
because few corporations have good security systems. "Passwords should never be
names, places or anything that can be found in a dictionary," said Suthers.
"People shouldn't be able to just write a program to send words from their
AtariWriter Plus dictionary disk.  Normally there should be a letter here, a
few numbers there -- garbage. Thus, if someone writes a program to generate
random symbols and keeps calling back until he breaks in, he'll probably be
traced. "Some corporations aren't very computer literate and don't worry about
things like passwords until they've been hit, which is a shame.  But it's all
out there in the books. TRICKS OF THE UNIX MASTER (by Russell Sage, published
by SAMS Publications, $22.95) is a beautiful book that tells you exactly what
to do to avoid break-ins."

McMullen said that Stanford is trying to tighten up security by emphasizing the
importance of better passwords. "When researchers want to do their work,
however, they don't want to mess with passwords and codes," he said.
"Universities seem to want to make their systems easier for researchers to use.
The more accessible it is, obviously, the less security there is in terms of
passwords.  It's easier to use your name as a password than some complicated
character string. "So any hacker worth his salt can go onto any computer system
and pull out an account.  Especially with UNIX, it's very easy to access it,
entering as the password the first name of the person who has the account.
These Legion of Doom hackers used a program that actually found out what the
passwords were: it began by just checking the names.  They were very successful
-- it was just unbelievable."

But McMullen feels that security fell way behind the advances made in
computers, and several avenues were left open for people to explore.  "Often
these hackers don't mean to be malicious or destructive," he said, "but I think
they really feel triumphant at getting on.  Sometimes they do damage without
realizing it, just by tramping through the system:  shutting down phone lines,
programs and accounting systems." However, the strides made in security since
then have accounted for arrests, confiscations and convictions all over the
country -- but there are still many more to come.





















                                   Page 74




                       The Official Phreaker's Manual


                                  Chapter 11


                         The AT&T BILLDATS Collector

NOTES: This article will hopefully give you a better understanding of how
the billing process occurs. BILLDATS is just one part of the billing picture.
Before I began working for the government, I was a Telco employee and thus,
the information within this article has been learned through experience.
Unfortunately, I was only employed for a few months (including training on
BILLDATS) and am still learning more about the many systems that a telco uses.
There are however, a couple of lists that were compiled and slightly modified
from what little reference material I could smuggle out and my notes from the
training class. This article does require a cursory knowledge of telco and
computer operations (ie. switching, SCCS, UNIX).


INTRODUCTION

BILLDATS - BILLing DATa System

BILLDATS can be explained in a nutshell by the acronym listed above. If it's
one thing telecommunications providers do well, it's creating acronyms.
Basically, BILLDATS collects billing information (that's why they call it a
Collector) from AMATs (Automatic Message Accounting Transmitters). The AMATs
are situated in or close to switching offices and are connected to BILLDATS
either through dedicated or dial-up lines. BILLDATS can be considered as
the "middleman" in the billing process. The system collects, validates, and
adds identification information regarding origination and destination. This
is then transferred to tape (or transmitted directly) to the RPC (Regional
Processing Center) or the RAO (Revenue Accounting Office). The RPC/RAO
actually processes the billing information. Typically the BILLDATS system is
located in the same or adjoining building (but can be across town) to
the RPC/RAO.

BILLDATS is similar to many other phone company systems (ie. SCCS) as it uses
a combination of software. The software base is UNIX and the BILLDATS Generic
program runs on it. The hardware used is an AT&T 3B20 (this is what 5ESS
switches use).

Some of the more interesting features BILLDATS possesses are:

*        Can be accessed via dialup (always a plus).
*        Runs under UNIX (another plus).
*        Interface with SCCS (yet another plus).
*        Can store about 12 million calls for the first two disks and about
        8 million calls for each additional disk. A total of 6 (675 MB) disks
        can be used.
*        Inserts the sensor type and ID and recording office type and ID onto
        every AMA record that it collects.
*        Capable of collecting information from nearly 600 AMATs.







                                   Page 75




                       The Official Phreaker's Manual


To better understand how/why you get a bill after making long distance phone
calls, I have delineated the steps involved.

You call Hacker X and tell him all about the latest busts that have occurred,
he exclaims "Oh Shit!" hangs up on you and throws all his hacking information
into the fireplace. The actual call is referred to as a call event. As each
event happens (upon termination of the call) the event is recorded by the
switch. This information is then sent via an AMA Transmitter which formats the
information and then sends it to BILLDATS (commonly called a "Host
Collector"). BILLDATS then provides the information to the RAO/RPC. The
billing computer is located at the RAO/RPC. Do not confuse the actual billing
system with BILLDATS! The billing computer:

*   Contains customer records
*   Credit ratings (in some telcos)
*   Totals and prints the bill
*   Generates messages when customers do not pay (ie. last chance and
   temporary termination of service)

When the billing period is over, (typically 25-30 days), many events (it
depends on how many calls you have made) have accumulated. A bill is then
generated and mailed to you.


COLLECTION

BILLDATS collects information in two ways:

1.       AMATs
2.       Users

AMAT input

BILLDATS collects data from the AMAT either directly from the switch, or from
a front end which performs some processing on the data before giving it to
BILLDATS. The data I am talking about here is usually AMA billing information.
The information is in the usual AMA format. As I said earlier, the recording
office and sensor types and IDs have to be added by BILLDATS. The other
information that is transmitted is usually maintenance data.

The data that is transferred between BILLDATS and an AMAT is accomplished
over either dedicated or dialup lines using the BX.25 protocol. This protocol
has been adopted by the telecommunications industry as a whole. It is
basically a modified version of X.25.

User input

This is simply sysadmin and sysop information.










                                   Page 76




                       The Official Phreaker's Manual


INSERTED INFORMATION

Once the information is collected, additional data (mentioned earlier)
must be inserted. The information that BILLDATS inserts into the AMA records
it receives depends on whether the AMAT is a single or multi-switch AMAT.
Either way, the data is passed through the DEP. The DEP is a module which
is part of the LHS (Link Handler Subsystem) that actually inserts the
additional data. It also performs other functions which are rather
uninteresting to the hacker. The LHS manages the x-mission of all the
collected information. This is either through dedicated or dialup lines. The
LHS is responsible for:

*   Logging of statistics as related to the performance of links.
*   Polling of remote switches for maintenance and billing information.
*   Passing information to the DEP in which additional information is
   inserted.
*   Storing billing information.
*   Other boring stuff.


AMATS

Basically an AMAT is a front end to the switch. The AMAT:

*   Gets AMA information from the switch.
*   Formats and processes the information.
*   Transmits it to BILLDATS.
*   An AMAT can also store information for up to 1 week.

The following is a list of switches and their related AMAT equipment that
BILLDATS obtains billing information from:

1A ESS: This is usually connected to a 3B APS (Attached Processor System) or
       BILLDATS AMAT.
2ESS:   This is connected to an IBM Series 1 AMAT.
2BESS:  Connected to a BILLDATS AMAT.
4ESS:   Connects to 3B APS.
5ESS:   Direct connection.
TSPS 3B:Direct connection.
DMS-10: Connects to IBM Series 1 AMAT.

There are other AMATs/Switches but they must be compatible with the BILLDATS
interface.















                                   Page 77




                       The Official Phreaker's Manual


ACCESSING BILLDATS

Even though a system is UNIX based, that doesn't mean that it is a piece of
cake to get into. Surprisingly (when you think about the average Intelligence
Quotient of telco personnel) but not surprisingly (when you consider that the
information contained on the system is BILLING information--the life blood of
the phone company) BILLDATS is a little more secure than your average telco
system, except for the fact the all login IDs are 5 lower case characters or
less. BILLDATS can usually be identified by:

bcxxxx 3bunix SV_R2+

where:

bc = B(ILLDATS) C(ollector).
xxxx = The node suffix. This is entered when the current Generic is installed.
3bunix = This simply indicates that UNIX is running on an AT&T 3Bxx system.
SV_R2+ = Software Version.

The good news is that there is a default username when the system is
installed. The bad news is that upon logon, the system forces you to choose a
password. The default username is not passworded initially. The added security
feature is simply that the system forces all usernames to have passwords. If
it doesn't have an associated password, the system will give you the message:

"Your password has expired. Choose a new one"

A 6-8 character password must then be entered. After this you will be asked
to enter the terminal type. The ones provided are AT&T terminals (615, 4425,
and 5420 models). Once entered a welcome message will probably be displayed:

"Welcome to the South Western Bell BILLDATS Collector"
"Generic 3, Issue 1"
"Tuesday 01 Aug 1989 12:44:44 PM"

dallas>

The BILLDATS prompt was displayed "dallas>" where dallas is the node name.

There are 3 privilege levels within BILLDATS:

1.       Administrator
2.       Operator
3.       UUCP

*   Administrator privs are basically root privs.
*   An account with Operator privs can still do about anything an Admin can do
   except make data base changes.
*   UUCP privs are the lowest and allow file transfer.









                                   Page 78




                       The Official Phreaker's Manual

Commands

Just like SCCS, UNIX commands can be entered while using BILLDATS. The format
is:

dallas>run-unx:$unix cmd;

All unix commands must be preceded by "run-unx:" and end with a semicolon ";".
The semicolon is the command terminator character (just like Carriage Return).

BILLDATS isn't exactly user friendly, but it does have on-line help. There are
a number of ways that it can be obtained:

dallas> help-?;  or  help-??;  or  ?-help;  or  ??-help;

If you want specific help:

dallas> help-(command name);

I can list commands forever, but between UNIX (commands every hacker should
be familiar with) and help (any moron can use it), you can figure out which
ones are important.


Error Messages

Just like SCCS, BILLDATS has some rather cryptic error messages. There are
thousands of error messages, once you know a little about the format they
are easier to understand. When a mistake is made, something similar to
the following will appear:

UI0029      (attempted command) is not a valid input string.

 ^                   ^- error message information
 |
 |--  This is the subsystem and error message number























                                   Page 79




                       The Official Phreaker's Manual


The following is a brief description of subsystem abbreviations:

BD: BILLDATS system utilities. Errors associated with the use of utility
   programs will be displayed.
DB: Data Base manager. These messages are generated when accessing or
   attempting to access the various Data Bases (explained later) within
   BILLDATS.
DM: Disk Manager. Basically, information pertaining to the system disk(s).
EA: Error and Alarm. As the name implies, system errors and alarms.
LH: Link Handler. Messages related to data link activity, either between
   BILLDATS and the AMAT or BILLDATS and the RAO/RPC.
SC: Scheduler. The scheduler is BILLDATS' version of the UNIX cron daemon.
   BILLDATS uses cron to schedule things like when to access remote systems.
TW: Tape Writer. Messages related to storing billing information on tapes
   which will then be transported to the RAO/RPC.
UI: User Interface. This was used in the above example. Displays syntax,
   range or status errors when entering commands.
DL: Direct Link. Instead of BILLDATS information being written to tape, a
   direct link to the RPC/RAO mainframe (the actual billing system computer)
   can be accomplished. This is usually done when BILLDATS is located far
   away from the RPC/RAO office as there is always some risk involved in
   transporting tapes, and that risk increases the farther away the two
   offices are. Another neat thing about Direct Link is that the billing data
   can be sent across a LAN (Local Area Network) also. Obviously this incurs
   some concerns regarding security, but from what I have heard and seen,
   AT&T and the BOC's typically choose to ignore the security of their
   systems which suits me just fine. The Direct Link is an optional BILLDATS
   feature and if it is in use, messages related to its operation are
   displayed with the DL prefix.


BILLDATS DATA BASES

The databases contain all kinds of useful information such as usernames,
switch types, scheduled polling times, etc.

The AMAT Data Base contains:

*   Type of switch
*   Sensor type and identification
*   AMAT phone number
*   Channel and port number/group
*   Other boring information

The Port Data Base contains:

*   Communications information (like L-Dialers on UNIX Sys. V)
*   Channel and port information
*   Other boring information









                                   Page 80




                       The Official Phreaker's Manual


The Collector Data Base contains:

*   Collector office ID
*   Version number of the Data Base
*   Number and speed of any remote terminals
*   When reports are scheduled for output
*   Other boring information


CONCLUSION

If you are not technically oriented, I hope this article helped you understand
how you get your bill. I assumed that you would skip over the commands for
using BILLDATS and similar information.

If you are technically oriented, I hope I not only helped you understand more
about the billing process, but also increased your awareness of how detailed
the whole process is. And if you do happen to stumble onto a BILLDATS system,
you have been pointed in the right direction as far as using it correctly is
concerned.

I tried to leave out all the boring details, but some may have slipped by me.
I reserved the right to omit specific details and instructions regarding any
alteration or deletion of calls/charges for my own use/abuse.


































                                   Page 81




                       The Official Phreaker's Manual


                                  Chapter 12



                         Central Office Operations
                        Western Electric 1ESS,1AESS,
                     The end office network environment



    Topics covered in this article will be:

       Call tracing
       RCMAC
       Input/output messages
       SCC and SCCS
       COSMOS and LMOS
       BLV, (REMOB) and "No test trunks"
       Recent change messages
       Equal Access

   Did I get your attention? Good, everyone should read this. With the time,
effort, and balls it has taken me compile this knowledge it is certainly worth
your time. I hope you appreciate me taking the time to write this.

   I should point out that the information in this article is correct to the
best of my knowledge. I'm sure there are going to be people that disagree
with me on some of it, particularly the references to tracing. However, I
have been involved in telecommunications and computers for 12+ years.

   I'm basing this article around the 1AESS since it is the most common
switch in use today.


    ** OUTSIDE PLANT **

   This is the wiring between your telephone and the central office. That is
another topic in itself.


    ** CABLE VAULT **

    All of the cables from other offices and from subscribers enter the
central office underground. They enter into a room called the cable vault.
This is a room generally in the basement located at one end or another of the
building. The width of the room varies but runs the entire length of the
building. Outside cables appear through holes in the wall. The cables then run
up through holes in the ceiling to the frame room.










                                   Page 82




                       The Official Phreaker's Manual


    Understand that each of these cables consist of an average of 3600 pairs
of wires. That's 3600 telephone lines. The amount of cables obviously depends
on the size of the office. All cables (e.g. interoffice, local lines, fiber
optic, coaxial) enter through the cable vault.


    ** FRAME ROOM **

    The frame is where the cable separates into individual pairs and attach
to connectors. The frame runs the length of the building, from floor to
ceiling. There are two sides to the frame, the horizontal side and the
vertical side. The vertical side is where the outside wiring attaches and the
protector fuses reside. The horizontal side is where the connectors to the
switching system reside. Multi-conductor cables run from the connectors to
actual switching equipment. So what we have is a large frame called the Main
Distribution Frame (MDF) running the entire length of the building. From floor
to ceiling it is 5 feet thick. The MDF consists of two sides, the VDF and the
HDF. Cables from outside connect on one side and cables from the switching
equipment connect to the other side and jumper wires connect the two. This way
any piece of equipment can be connected to any incoming "cable pair". These
jumper wires are simply 2 conductor twisted pair, running between the VDF and
the HDF.

    What does all this mean? Well if you had access to COSMOS you would see
information regarding cable and pair and "OE" (Office Equipment). With this
information you could find your line on the frame and on the switch. The VDF
side is clearly marked by cable and pair at the top of the frame, however the
HDF side is a little more complicated and varies in format from frame to frame
and from switch to switch. Since I am writing this article around the 1AESS,
I will describe the OE format used for that switch.

   OE  ABB-CDD-EFF

  Where..

     A = Control Group (when more than one switch exists in that C.O.)
     B = LN  Line Link Network
     C = LS  Line Switching Frame
     D = CONC or CONCentrator
     E = Switch (individual, not the big one)
     F = Level

















                                   Page 83




                       The Official Phreaker's Manual


   There is one more frame designation called LOC or LOCation. This gives the
location of the connector block on the HDF side. Very simply, looking at the
frame:


H  ---------------------------------------------------------------------

G  ---------------------------------------------------------------------

F  ---------------------------------------------------------------------

E  ---------------------------------------------------------------------

D  ---------------------------------------------------------------------

C  ---------------------------------------------------------------------

B  ---------------------------------------------------------------------

A  ---------------------------------------------------------------------

  123456789 etc.

   Please note that what you are looking at here represents the HDF side of
the MDF, being up to 100 feet long, and 20 feet high. Each "-" represents a
connector block containing connections for 4 x 24 (which is 96) pairs.

   So far I've covered how the wires get from you to the switching
equipment. Now we get to the switching system itself.


   ** SWITCHING SYSTEMS **

   Writing an article that covers them all would be lengthy indeed. So I am
only going to list the major ones and a brief description of each.

   - Step by Step
     Strowger 1889
     First automatic, required no operators for local calls
     No custom calling or touch tone
     Manufactured by many different companies in different versions
     Hard wire routing instructions, could not choose an alternate route if
     programed route was busy
     Each dial pulse tripped a "stepper" type relay to find its path

   - No.1 Crossbar 1930
   - No.5 Crossbar 1947 (faster, more capacity)
     Western Electric
     First ability to find idle trunks for call routing
     No custom calling, or equal access
     Utilized 10x20 cross point relay switches
     Hard wired common control logic for program control
     Also copied by other manufactures





                                   Page 84




                       The Official Phreaker's Manual


   - No.4 Crossbar
     Used as a toll switch for AT&T's long lines network
     4 wire tandem switching
     Not usually used for local loop switching

   - No.1ESS  1966
   - No.1AESS 1973
     Western Electric
     Described in detail later

   - No.1EAX
     GTE Automatic Electric
     GTE's version of the 1AESS
     Slower and louder

   - No.2ESS  1967
   - No.2BESS 1974
     Western Electric
     Analog switching under digital control
     Very similar to the No.1ESS and No.1AESS
     Downsized for smaller applications

   _ No.3ESS
     Western Electric
     Analog switching under digital control
     Even smaller version of No.1AESS
     Rural applications for up to 4500 lines

   - No.2EAX
     GTE Automatic Electric
     Smaller version of 1EAX
     Analog switch under digital control

   - No.4ESS
     Western Electric
     Toll switch, 4 wire tandem
     Digital switching
     Uses the 1AESS processor

   - No.3EAX
     Gee is there a pattern here? No GTE
     Digital Toll switch
     4 wire tandem switching

   - No.5ESS
     AT&T Network Systems
     Full scale computerized digital switching
     ISDN compatibility
     Utilizes time sharing technology
     Toll or end office

   - DMS 100 Digital Matrix Switch
     Northern Telecom
     Similar to 5ESS
     Runs slower
     Considerably less expensive


                                   Page 85




                       The Official Phreaker's Manual


   - DMS 200
     Toll and Access Tandem
     Optional operator services

   - DMS 250
     Toll switch designed for common carriers

   - DMS 300
     Toll switch for international gateways

   - No.5EAX
     GTE Automatic Electric
     Same as above

   How much does a switch cost? A fully equipped 5ESS for a 40,000
subscriber end office can cost well over 3 million dollars. Now you know why
your phone bill is so much. Well...maybe you parents bill.


   ** The 1ESS and 1AESS **

   This was the first switch of it's type put into widespread use by Bell.
Primarily an analog switch under digital control, the switch is no longer
being manufactured. The 1ESS has been replaced by the 5ESS and other full
scale digital switches, however, it is still by far the most common switch
used in today's Class 5 end offices.

   The #1 and 1A use a crosspoint matrix similar to the X-bar.  The primary
switch used in the matrix is the ferreed (remreed in the 1A).  It is a two
state magnetic alloy switch.  It is basically a magnetic switch that does not
require voltage to stay in it's present position. A voltage is only required
to change the state of the switch.

  The No. 1 utilized a computer style, common control and memory.  Memory
used by the #1 changed with technology, but most have been upgraded to RAM.
Line scanners monitor the status of customer lines, crosspoint switches,
and all internal, outgoing, and incoming trunks, reporting their status to
the central control.  The central control then either calls upon program or
call store memories to chose which crosspoints to activate for processing the
call.  The crosspoint matrices are controlled via central pulse distributors
which in turn are controlled by the central control via data buses.  All of
the scanner's AMA tape controllers, pulse distro, x-point matrix, etc., listen
to data buses for their address and command or report their information on
the buses. The buses are merely cables connecting the different units to the
central control.













                                   Page 86




                       The Official Phreaker's Manual


  The 1E was quickly replaced by the 1A due to advances in technology. So
1A's are more common, also many of the 1E's have been upgraded to a 1A.
This meant changing the ferreed to the remreed relay, adding additional
peripheral component controllers (to free up central controller load) and
implementation of the 1A processor.  The 1A processor replaced older style
electronics with integrated circuits.  Both switches operate similarly.
The primary differences were speed and capacity.  The #1ESS could process
110,000 calls per hour and serve 128,000 lines.

   Most of the major common control elements are either fully or partially
duplicated to ensure reliability. Systems run simultaneously and are checked
against each other for errors. When a problem occurs the system will double
check, reroute, or switch over to auxiliary to continue system operation.
Alarms are also reported to the maintenance console and are in turn printed
out on a printer near the control console.

   Operation of the switch is done through the Master Control Center (MCC)
panel and/or a terminal. Remote operation is also done through input/output
channels. These channels have different functions and therefore receive
different types of output messages and have different abilities as for what
type of commands they are allowed to issue. Here is a list of the commonly
used TTY channels.

  Maintenance     - Primary channel for testing, enable, disable etc.
  Recent Change   - Changes in class of service, calling features etc.
  Administrative  - Traffic information and control
  Supplementary   - Traffic information supplied to automatic network control
  SCC Maint.      - Switching Control Center interface
  Plant Serv.Cent.- Reports testing information to test facilities

   At the end of this article you will find a list of the most frequently
seen Maintenance channel output messages and a brief description of their
meaning. You will also find a list of frequently used input messages.

   There are other channels as well as back ups but the only ones to be
concerned with are Recent Change and SCC maint. These are the two channels
you will most likely want to get access to. The Maintenance channel doesn't
leave the C.O. and is used by switch engineers as the primary way of
controlling the switch. During off hours and weekends the control of the
switch is transferred to the SCC.

   The SCC is a centrally located bureau that has up to 16 switches
reporting to it via their SCC maint. channel. The SCC has a mini computer
running SCCS that watches the output of all these switches for trouble
conditions that require immediate attention. The SCC personnel then have the
ability to input messages to that particular switch to try and correct the
problem. If necessary, someone will be dispatched to the C.O. to correct the
problem. I should also mention that the SCC mini, SCCS has dialups and access
to SCCS means access to all the switches connected to it. The level of access
however, may be dependent upon the privileges of the account you are using.








                                   Page 87




                       The Official Phreaker's Manual


   The Recent Change channels also connect to a centrally located bureau
referred to as the RCMAC. These bureaus are responsible for activating lines,
changing class of service etc. RCMAC has been automated to a large degree by
computer systems that log into COSMOS and look for pending orders. COSMOS is
basically an order placement and record keeping system for central office
equipment, but you should know that already, right? So this system, called
Work Manager running MIZAR logs into COSMOS, pulls orders requiring recent
change work, then in one batch several times a day, transmits the orders to
the appropriate switch via it's Recent Change Channel.

   Testing of the switch is done by many different methods. Bell Labs has
developed a number of systems, many accomplishing the same functions. I will
only attempt to cover the ones I know fairly well.

   The primary testing system is the trunk test panels located at the switch
itself. There are three and they all pretty much do the same thing, which is
to test trunk and line paths through the switch.

        Trunk and Line Test Panel
        Supplementary Trunk Test Panel
        Manual Trunk Test Panel

    MLT (Mechanized Loop Testing) is another popular one. This system is
often available through the LMOS data base and can give very specific
measurements of line levels and losses. The "TV Mask" is also popular giving
the user the ability to monitor lines via a call back number.

   DAMT (Direct Access Mechanized Testing) is used by line repairmen to put
tone on numbers to help them find lines. This was previously done by Frame
personnel, so DAMT automated that task. DAMT can also monitor lines, but
unfortunately, the audio is scrambled in a manor that allows one only to tell
what type of signal is present on the line, or whether it is busy or not.

   All of these testing systems have one thing in common: they access the
line through a "No Test Trunk". This is a switch which can drop in on a
specific path or line and connect it to the testing device. It depends on
the device connected to the trunk, but there is usually a noticeable "click"
heard on the tested line when the No Test Trunk drops in. Also the testing
devices I have mentioned here will seize the line, busying it out. This will
present problems when trying to monitor calls, as you would need to drop in
during the call. The No Test Trunk is also the method in which operator
consoles perform verifications and interrupts.
















                                   Page 88




                       The Official Phreaker's Manual


   ** INTEROFFICE SIGNALLING **

   Calls coming into and leaving the switch are routed via trunks. The
switches select which trunk will route the call most effectively and then
retransmits the dialed number to the distant switch. There are several
different ways this is done. The two most common are Loop Signaling and CCIS,
Common Channel Interoffice Signaling. The predecessor to both of these is the
famous and almost extinct "SF Signaling". This utilized the presence of
2600hz to indicate trunks in use. If one winks 2600Hz down one of these
trunks, the distant switch would think you hung up. Remove the 2600, and you
have control of the trunk and you could then MF a number. This worked great
for years. Assuming you had dialed a toll free number to begin with, there
was no billing generated at all. The 1AESS does have a program called SIGI
that looks for any 2600 winks after the original connection of a toll call.
It then proceeds to record on AMA and output any MF digits received.
However due to many long distant carriers using signaling that can generate
these messages it is often overlooked and "SIG IRR" output messages are quite
common.

   Loop signaling still uses MF to transmit the called number to distant
switches, however, the polarity of the voltage on the trunk is reversed to
indicate trunk use.

   CCIS sometimes referred to CCS#6 uses a separate data link sending
packets of data containing information regarding outgoing calls. The distant
switch monitors the information and connects the correct trunk to the correct
path. This is a faster and more efficient way of call processing and is being
implemented everywhere. The protocol that AT&T uses is CCS7 and is currently
being accepted as the industry standard. CCS6 and CCS7 are somewhat similar.

   Interoffice trunks are multiplexed together onto one pair. The standard
is 24 channels per pair. This is called T-1 in it's analog format and D-1
in its digital format. This is often referred to as carrier or CXR. The terms
frame error and phase jitter are part of this technology which is often a
world in itself. This type of transmission is effective for only a few miles
on twisted pair. It is often common to see interoffice repeaters in manholes
or special huts. Repeaters can also be found within C.O.s, amplifying trunks
between offices. This equipment is usually handled by the "carrier" room,
often located on another floor. Carrier also handles special circuits, private
lines, and foreign exchange circuits.

    After a call reaches a Toll Switch, the transmit and receive paths of
the calling and called party are separated and transmitted on separate
channels. This allows better transmission results and allows more calls to
be placed on any given trunk. This is referred to as 4 wire switching. This
also explains why during a call, one person can hear crosstalk and the other
cannot. Crosstalk will bleed over from other channels onto the multiplexed
T-Carrier transmission lines used between switches.










                                   Page 89




                       The Official Phreaker's Manual


   ** CALL TRACING

    So with the Loop Signaling standard format there is no information being
transmitted regarding the calling number between switches. This therefore
causes the call tracing routine to be at least a two step process. This is
assuming that you are trying to trace an anticipated call, not one in
progress. When call trace "CLID" is placed on a number, a message is output
every time someone calls that number. The message shows up on most of the ESS
output channels and gives information regarding the time and the number of the
incoming trunk group. If the call came from within that office, then the
calling number is printed in the message. Once the trunk group is known, it
can usually be determined what C.O. the calls are coming from. This is also
assuming that the calls are coming from within that Bell company and not
through a long distance carrier (IEC). So if Bell knows what C.O. the calls
are coming from, they simply put the called number on the C.I. list of that
C.O. Anytime anyone in that C.O. calls the number in question another message
is generated showing all the pertinent information.

   Now if this were a real time trace it would only require the assistance
of the SCC and a few commands sent to the appropriate switches (i.e.
NET-LINE). This would give them the path and trunk group numbers of the call
in progress. Naturally the more things the call is going through, the more
people that will need to be involved in the trace. There seems to be a common
misconception about the ability to trace a call through some of the larger
packet networks i.e. Telenet and TYMNET. Well I can assure you, they can
track a call through their network in seconds (assuming multiple systems
and/or network gateways are not used) and then all that is needed is the
cooperation of the Bell companies. Call tracing in itself it not that
difficult these days. What is difficult is getting the different organizations
together to cooperate. You have to be doing something relatively serious to
warrant tracing in most cases, however, not always. So if tracing is a
concern, I would recommend using as many different companies at one time as
you think is necessary, especially US Sprint, since they can't even bill
people on time much less trace a call. But...it is not recommended to call
Sprint direct, more on that in the Equal Access section.


   ** EQUAL ACCESS

   The first thing you need to understand is that every IEC Inter Exchange
Carrier (long distance company) needs to have an agreement with every LEC
Local Exchange Carrier (your local phone company) that they want to have
access to and from. They have to pay the LEC for the type of service they
receive and the amount of trunks, and trunk use. The cost is high and the
market is a zoo. The LECs have the following options:

    - Feature Group A -

   This was the first access form offered to the IECs by the LECs. Basically
whenever you access an IEC by dialing a regular 7 digit number (POTS line)
this is FGA. The IECs' equipment would answer the line and interpret your
digits and route your call over their own network. Then they would pick up an
outgoing telephone line in the city you were calling and dial your number
locally. Basically a dial in, dial out situation similar to Telenet's
PC pursuit service.



                                   Page 90




                       The Official Phreaker's Manual


    - Feature Group B -

    FGB is 950-xxxx. This is a very different setup from FGA. When you dial
950, your local switch routes the call to the closest Access Tandem (AT) (Toll
Switch) in your area. There the IECs have direct trunks connected between the
AT and their equipment. These trunks usually use a form of multiplexing like
T-1 carrier with wink start (2600Hz). On the incoming side, calls coming in
from the IEC are basically connected the same way. The IEC MFs into the AT
and the AT then connects the calls. There are many different ways FGB is
technically setup, but this is the most common.

    Tracing on 950 calls has been an area of controversy and I would like to
clear it up. The answer is yes, it is possible. But like I mentioned earlier,
it would take considerable manpower which equals expensive to do this. It
also really depends on how the IEC interface is set up. Many IECs have
trunks going directly to Class 5 end offices. So, if you are using a small
IEC, and they figure out what C.O. you are calling from, it wouldn't be out
of the question to put CLID on the 950 number. This is highly unlikely and I
have not heard from reliable sources of it ever being done. Remember, CLID
generates a message every time a call is placed to that number. Excessive
call trace messages can crash a switch. However, I should mention that brute
force hacking of 950s is easily detected and relatively easy to trace. If the
IEC is really having a problem in a particular area they will pursue it.

    - Feature Group C -

    FGC is reserved for and used exclusively by AT&T.

    - Feature Group D -
    FGD is similar to FGB with the exception that ANI is MF'ed to the IEC.
The end office switch must have Equal Access capability in order to transmit
the ANI. Anything above a X-bar can have it. FGD can only be implemented on
800 numbers and if an IEC wants it, they have to buy the whole prefix. For a
list of FGD prefixes see 2600 Magazine. You should also be aware that MCI,
Sprint, and AT&T are offering a service where they will transmit the ANI to
the customer as well. You will find this being used as a security or
marketing tool by an increasing amount of companies. A good example would be
800-999-CHAT.


** OUTPUT MESSAGES **

The following is a compiled list of common switch messages. The list was
compiled from various reference materials that I have at my disposal.














                                   Page 91




                       The Official Phreaker's Manual


                    1AESS COMMON OUTPUT MESSAGES
               --------------------------------------

MSG.  DESCRIPTION
----------------------------------------------------------------
   ** ALARM **

AR01  Office alarm
AR02  Alarm retired or transferred
AR03  Fuse blown
AR04  Unknown alarm scan point activated
AR05  Commercial power failure
AR06  Switchroom alarm via alarm grid
AR07  Power plant alarm
AR08  Alarm circuit battery loss
AR09  AMA bus fuse blown
AR10  Alarm configuration has been changed (retired,inhibited)
AR11  Power converter trouble
AR13  Carrier group alarm
AR15  Hourly report on building and power alarms

     ** AUTOMATIC TRUNK TEST **
AT01  Results of trunk test

     ** CARRIER GROUP **
CG01  Carrier group in alarm
CG03  Reason for above

     ** COIN PHONE **
CN02  List of pay phones with coin disposal problems
CN03  Possible Trouble
CN04  Phone taken out of restored service because of possible coin fraud

     ** COPY **
COPY  Data copied from one address to another

     ** CALL TRACE **
CT01  Manually requested trace line to line, information follows
CT02  Manually requested trace line to trunk, information follows
CT03  Intraoffice call placed to a number with CLID
CT04  Interoffice call placed to a number with CLID
CT05  Call placed to number on the CI list
CT06  Contents of the CI list
CT07  ACD related trace
CT08  ACD related trace
CT09  ACD related trace

     ** DIGITAL CARRIER TRUNK **
DCT COUNTS Count of T carrier errors

     ** MEMORY DIAGNOSTICS **
DGN   Memory failure in cs/ps diagnostic program






                                   Page 92




                       The Official Phreaker's Manual


     ** DIGITAL CARRIER "FRAME" ERRORS **
FM01  DCT alarm activated or retired
FM02  Possible failure of entire bank not just frame
FM03  Error rate of specified digroup
FM04  Digroup out of frame more than indicated
FM05  Operation or release of the loop terminal relay
FM06  Result of digroup circuit diagnostics
FM07  Carrier group alarm status of specific group
FM08  Carrier group alarm count for digroup
FM09  Hourly report of carrier group alarms
FM10  Public switched digital capacity failure
FM11  PUC counts of carrier group errors

     ** MAINTENANCE **
MA02  Status requested, print out of MACII scratch pad
MA03  Hourly report of system circuits and units in trouble
MA04  Reports condition of system
MA05  Maintenance interrupt count for last hour
MA06  Scanners,network and signal distributors in trouble
MA07  Successful switch of duplicated unit (program store etc.)
MA08  Excessive error rate of named unit
MA09  Power should not be removed from named unit
MA10  OK to remove paper
MA11  Power manually removed from unit
MA12  Power restored to unit
MA13  Indicates central control active
MA15  Hourly report of # of times interrupt recovery program acted
MA17  Centrex data link power removed
MA21  Reports action taken on MAC-REX command
MA23  4 minute report, emergency action phase triggers are inhibited

     ** MEMORY **
MN02  List of circuits in trouble in memory

     ** NETWORK TROUBLE **
NT01  Network frame unable to switch off line after fault detection
NT02  Network path trouble Trunk to Line
NT03  Network path trouble Line to Line
NT04  Network path trouble Trunk to Trunk
NT06  Hourly report of network frames made busy
NT10  Network path failed to restore

     ** OPERATING SYSTEM STATUS **
OP:APS-0
OP:APSTATUS
OP:CHAN
OP:CISRC     Source of critical alarm, automatic every 15 minutes
OP:CSSTATUS  Call store status
OP:DUSTATUS  Data unit status
OP:ERAPDATA  Error analysis database output
OP:INHINT    Hourly report of inhibited devices
OP:LIBSTAT   List of active library programs
OP:OOSUNITS  Units out of service
OP:PSSTATUS  Program store status




                                   Page 93




                       The Official Phreaker's Manual


     ** PLANT MEASUREMENTS **
PM01  Daily report
PM02  Monthly report
PM03  Response to a request for a specific section of report
PM04  Daily summary of IC/IEC irregularities

     ** REPORT **
REPT:ADS FUNCTION  Reports that a ADS function is about to occur
REPT:ADS FUNCTION DUPLEX FAILED No ADS assigned
REPT:ADS FUNCTION SIMPLEX Only one tape drive is assigned
REPT:ADS FUNCTION STATE CHANGE Change in state of ADS
REPT:ADS PROCEDURAL ERROR You fucked up
REPT:LINE TRBL Too many permanent off hooks, may indicate bad cable
REPT:PROG CONT OFF-NORMAL System programs that are off or on
REPT:RC CENSUS Hourly report on recent changes
REPT:RC SOURCE Recent change system status (RCS=1 means RC Channel inhibited)

     ** RECENT CHANGE **
RC18  RC message response

     ** REMOVE **
RMV   Removed from service

     ** RESTORE **
RST   Restored to service status

     ** RINGING AND TONE PLANT **
RT04  Status of monitors

     ** SOFTWARE AUDIT **
SA01  Call store memory audit results
SA03  Call store memory audit results

     ** SIGNAL IRREGULARITY **
SIG IRR  Blue box detection
SIG IRR INHIBITED  Detector off
SIG IRR TRAF  Half hour report of traffic data

     ** TRAFFIC CONDITION **
TC15  Reports overall traffic condition
TL02  Reason test position test was denied
TL03  Same as above

     ** TRUNK NETWORK **
TN01  Trunk diagnostic found trouble
TN02  Dial tone delay alarm failure
TN04  Trunk diag request from test panel
TN05  Trunk test procedural report or denials
TN06  Trunk state change
TN07  Response to a trunk type and status request
TN08  Failed incoming or outgoing call
TN09  Network relay failures
TN10  Response to TRK-LIST input, usually a request from test position
TN11  Hourly, status of trunk undergoing tests
TN16  Daily summary of precut trunk groups



                                   Page 94




                       The Official Phreaker's Manual


     ** TRAFFIC OVERLOAD CONDITION **
TOC01 Serious traffic condition
TOC02 Reports status of less serious overload conditions

     ** TRANSLATION **  (shows class of service, calling features etc.)
TR01  Translation information, response to VFY-DN
TR03  Translation information, response to VFY-LEN
TR75  Translation information, response to VF:DNSVY
     **             **
TW02  Dump of octal contents of memory



                   1AESS COMMON INPUT MESSAGES
              -------------------------------------

Messages always terminate with ". ctrl d "      x=number or trunk network #


MSG.                   DESCRIPTION
------------------------------------------------------------------------
NET-LINE-xxxxxxx0000   Trace of path through switch
NET-TNN-xxxxxx         Same as above for trunk trace
T-DN-MBxxxxxxx         Makes a # busy
TR-DEACTT-26xxxxxxx    Deactivates call forwarding
VFY-DNxxxxxxx          Displays class of service, calling features etc.
VFY-LENxxxxxxxx        Same as above for OE
VFY-LIST-09 xxxxxxx    Displays speed calling 8 list


************************************************************************

   There are many things I didn't cover in this article and many of the
things I covered, I did so very briefly. My intention was to write an article
that explains the big picture, how everything fits together. I hope I helped.

   Special thanks to all the stupid people, for without them some of us
wouldn't be so smart and might have to work for a living. Also all the usual
Bell Labs, AT&T bla bla bla etc. etc.

   I can usually be reached on any respectable board, ha!

















                                   Page 95




                       The Official Phreaker's Manual


                                  Chapter 13


                        The personal Thanx to autors!


Atlantis board, Metal Shop private board, Digital Logic board, Taran King,
      Hell Phrozen Over board, Mark Tabas, The Videosmith, Lex Luthor,
         The Marauder, Jester Sluggo, Phucked Agent 04, Gary Seven,
                            Rogue Fed and others.
















































                                   Page 96




                       The Official Phreaker's Manual


































            Well, this is just a page to protect the other pages.
                        I hope you enjoyed the book!
























                                   Page 97