냐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +-+-+-+-+-+-+-+-+ 栢栢栢栢昉께께굇굇굅같�|O|u|t|b|r|e|a|k|臍같굇굇굉께께栢栢栢� +-+-+-+-+-+-+-+-+ Issue #5 - Page 12 of 13 냐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� - - - - - - - - - - - - - - - - - - - - - - - - - - Step by Step (SxS) switching notes by: antimatt3r on: 4/29/02 for: Issue 5 - - - - - - - - - - - - - - - - - - - - - - - - - - The information provided below was conducted on a class 5 step by step switching sytem. The topics/methods described in the following may not work on your switching system and also may have no practical use, but are being exposed to the public simply becaise knowledge is power. This text is for those of you who know about switching and telefone system architcture, meaning dont come to me asking what this and that means.... read a bewk =) Step by step switching (I would say) is rare. On most occasions it will be only in use in very rural areas w/o digital equipment. Everyday electromechanical SxS systems are being replaced with electronic/digital switches and Remote Switching Systems (RSSs). SO if your in the middle of nowhere give this sh!t a try..... Toll/Operator Assisted Dialing Most likley you can dial 1/0+ numbers with your prefix included in most areas. You can dial any call that you could normally reach by dialing 1+ or 0+. Example; to dial an operator assisted call to a number in Chicago, you would dial NXX+0312+555+1000 where NXXX is your prefix, and you would recieve the TSPS bong tone, and the number you dialed (312 555 1000) would show up on the TSPS console readout board. You can also use a 1 in the place of the 0 in the above example to put the call thru as a normal toll call. Sorry for you folks that think that this bypasses billing, it dosent in any way. The actual reason that this works that the thousandths digit in many SxS offices determines the type of call. A 0 or a 1 in place of another number (which would represent a local call) is handled accordingly. Another reason is due to a DAS that can be installed in some SxS offices to 'absorb' the prefix on intraoffice calls when its not needed to process the call. A DAS can absorb either two or three digits, depending on weather the CO needs any prefix digit(s) for intraoffice call execution. Hunting Prefixes SxS switches may also translate an improperly dialed local call and send it to the right area over intraoffice trunks. Example; you need locally call 492 1000. You could dial 292 1000 and reach the same number, provided there is no 292 prefix within your local calling area. However, only the first digit of a prefix may be modified or the call will not go through correctly unless you happened to dial a valid local prefix. You also cannot use a 1 or a 0 in place of the first digit in the prefix. If you should, the switch would interpret that as either dialing a toll or operator assisted call. ONI / ANI Fail To get this you must have basic knowledge on how ANI functions on the SxS system. ONI stands for Operator Number Identification. Your CO sends ANI with you number, in MF or DP toreceivers that recieve (duh) the ANI information and display (and\or) store it with the called number If it is stored, (almost always) it is stored in the form of AMA tape. ANI outpulsing in MF can use either Local Automatic Message Accounting (LAMA) or Centralized Automatic Message Accounting (CAMA). ANI sent in DP type signalling is rare. DP vs. MF type signalling is like comparing DTMF to pulse dialing. On a trunk DP sends all information in short bursts of 2600hz tones. Triggering ANIF's/ONI is an easy task on SxS (and some versions of xbar) because the customers link to the CO allows the input of MF tones to infulence a calls completion. This can be accomplished by dialing a long distance number, then listening to the click that follow. After the first click (after dialing) you will hear a few more usually timed very close to one another. The final click always happens right before the called fone rings. The number and speed of clicks usually varies.The click are the toll office that serves your CO setting up a route for your call. In order to 'exploit' this you will need a MF source. It could be a recording, blue box, good sound card or anything else you can come up with. Soon before you hear the clicks, send the sequence KP+1 (repeatedly) for ANIF or KP+2 (repeatedly) for ONI. This will NOT work if your CO uses DP signalling. Play the tones into the fone at a sufficent volume to overpower the clicks. The MF squences must be sent quickly for this to work correctly. After you have played your 'routing' a few times you should hear a TSPS op. S/he will want to know the number you are calling from. (When ANIF is recognised the call is sent to a TSPS site for the area. You can give the op any number in your exchange and s/he will enter the billing information manually. then put your call through. The charges for your call will be billed to the number you gave as yours. Another method to do this is just to click the switchhook during the clicks. This sends DC pulses that scramble ANI outpulsing and cause the call to be directed to a TSPS site before dialing the number. This method should be used sparingly and with caution. Hopefully you would gather that its not advisable to use the same number to bill the calls to often. If you should do this (to someone like thuglife32 (4747631)) the toll office report will list the number of ANIFs in a period of time. The ONI method works better because it is gathered that ONI is needed to identify a callers DN upon a multi-party line. Too many ANIFs generated a report on a security/maintenence TTY, so if you use this method, use ONI more than just ANIFs. The idea of ANIF is to scramble your ANI info by using MF (or the switchhook) to send your long distance call to a TSPS op for ONI due to ANIF. The idea behind ONI is that you are making them think that youre calling from a multi-party line and ONIis needed to identify your DN. Test Numbers Some interesting features in the step switching network can be found by dialing test numbers. Test numbers in SxS switching are usually hidden in the xx99 area, as opposed to 99xx which is common for other types of switching areas/systems. These types of numbers are possibly physical limitations of a SxS switch, and thus a milliwatt tone or other test numbers may be placed there because a normal DN cant be assigned to such a number. However, these xx99 numbers are usually listed in COSMOS as test numbers. Another interseting note about xx99 numbers is that they seem (in some offices) to be on the same circut. (if one person calls a xx99 number and gets the test tone, and another person dials any other xx99 number they will get a busy signal) DIaling your prefix followed by an xx99 may result in a busy signal test numbet, a network overflow (recorder), milliwatt tones, or some other type of message encountered when dialing. Although not every xx99 is a test number, many are. The numbers that return busy signals are the ones that incoming callers are connected to when then sleeve lead of the called number is in a voltage present state, which is when the line is in use or off hook. Busy Signal Confing This really sucks, and its a easy, but annoying way to conf. Imagine you call up a number and you get a busy signal, then someone says, "hey whats up". What the hell? Well, another interesting feature on the SxS switching system is the way busy signals are generated. In ESS and DMS COs, busy signals that are sent by the terminating switch are computer generated and sound very even and clear with no signal irregularity. In SxS, all calls to a particular DN are sent the same busy signal termination number, which can usually be reached by a POTS number. These busy tones arent computer generated and the voice path is not cut off. You can exploit this and have a busy signal confrence. Several people dial the same busy DN that is served by a step office, or they can dial the always busy termination number. When the people are connected to the number you can hear them talking. (over the damn 60 IPM tone that is) One bonus of this is that answering supervision is not returned on busy numbers and thus the call is toll free for all parties calling. You must be using AT&T as your inter-LATA carrier if the call to the busy number is an inter-LATA number for you. So if you have sprint you must first dial the AT&T carrier acess code (10ATT) before the busy number. If your LC dosent detect answer supervision, and beings billing immediatley or after a certain amount of time, then you are billed for the length of the call. Geez, just go get a damn raindance eh?!? Temporarily Freezing a Line On a SxS system that runs on the direct control idea, which controlled directly by what the subscriber dials, it is possible to jam a line to prevent service by flashing the switchhook several times. Another way to temporarily freeze a line is several aborted dialing attempts, this makes the line freeze untill the line is manually reset, or if theres some sort of timeout mechanism. Usually when you do this the line will only be out of service for a few minutes. The line shows the same characteristics as if you busyed someone out, the line is busy to callers, and the line seems dead for the victim. This is what happens when an element is jammed. The switch itself consists of a linefinder, which sends a dialtone to the customer who picked their fone up, and puts voltage on the sleeve lead to mark the given DN busy. Next are the selectors, which recieve the digits dialed and move accordingly. The last step in the switch is the connector, which connects the calls (no shit eh?) that are intraoffice, and sends calls to a toll office when necessary. Other types of devices can be used where needed. (such as Digit Absorbing Sensors (DAS)) Trunks The SxS system incoming and outgoing trunks are very likley to use in-band supervisory signalling. This should tell you that you could possibly use numbers served by a SxS CO to blue box off of. Some older step areas may not use MF signalling, but DP signalling. DP signalling (if you recall) uses short busrts of 2600Hz to transfer information as opposed to MF tones. In DP signalling, there are no KP or ST equivalents. Boxing may be accomplished from DP trunks by sending short bursts of 2600Hz (2 bursts = the number 2). Usable rates are 7.5 to 12 pulses per second, a digit might be around .04 seconds of tone and .06 seconds of silence. DP is rare today, but some direct-control step offices may still use it. Common control step offices are more likely to use MF trunk signalling. Refrences: Basic Telephone Switching Systems - By: David Tally No.1 AMARC-Bell System Tech. Journal