Well we finally got some stuff to actully release the zine. Hopefully Next issue will be easyer to get out on time. I had a computer problem that killed my hard drive witch had the only copy of the zine. Anyways I'm still working on the number directory. I've got quite a few number to call and make sure they work.So if you plan on sending number please call them and make sure they work. Thanks to everyone who help us get our 2nd issue out. Hopefully there will be alot more. ic0n Table Of Content (TOC) Verizon's Expanded Announcement System............ by captain b and ic0n Exchange Scanning............................................ by decoder ANI vs. ANAC What are they, and what's the difference?.......... by ic0n Loop Maintenance Operations System (LMOS)............... by Brisk Attivo How To Datu............................................ by Majestic 1/12 Maritime Telecommunication Network aka MTN...................... by ic0n Frame Operations Management System (FOMS).................. by Anonymous Verizon's Expanded Announcement System Audio file portion by ic0n - Text file by Captain B To skip directly to listening to the supplemental audio file first, which will let you hear the menu prompts from inside the Expanded Announcement System, go to: http://goblin.crappyhosting.com/Expanded_Announcement.mp3 Telco error messages... We've all heard one at some point. An atypical error message usually starts off with those 3 tones, known as S.I.T. (Special Information Tones) followed by, "We're sorry. The number you have reached... etc". But, have you ever wondered about the recording process for phone company error messages, or how they're stored, accessed, modified, or deleted when need be? Well, if you happen to live in my part of Verizon's service area, Verizon maintains a phone system they call their Expanded Announcement System. Now, due to the fairly potent nature of this system, I won't be disclosing certain important specifics here, such as the phone number to dial, or the passcode to enter in. But, I will tell you that once inside the system, you can listen to, record, modify, or delete error messages. The thing I was kind of surprised to learn about is that a single telco error message is usually 2 or more individual recordings pieced together to form a single error message. And actually, the system refers to those individual recordings as a "message". And, an entire error message put together from those individual message recordings is called an "announcement". Each individual message in an announcement is stored in a slot, which the system refers to as a "position". And, every other position in an announcement seems to be blank. (Doesn't contain a message). I think this is because it contains a "message function" instead. Which, I believe tells the system whether to play another message for the next position in the announcement. And, if so, it would also tell it which one to play. Otherwise, the announcement is deemed finished, and therefore ends if no message function is contained in the next position. In other words, a message function serves as the parameters within an announcement. And, as you probably guessed, there exists a feature in the menus to "define a message function". And, although I didn't mess with that feature to play it safe, I imagine it could be a fairly involved process. By the way, if you were to record over an existing message with one of your own, all announcements that used that particular message within it would now feature your re-recording of that message. However, the system seems to not allow for any recorded messages assigned for use in many announcements to be recorded over. Apparently, this is some sort of failsafe measure. However, you can always re-record a message that's hardly assigned much for use within announcements, or Isn't assigned for use in any announcement. Also, you can record a brand new message within any blank "message number" that doesn't already contain a recorded message. Or, just use option 5 from within the message administration menu (accessible from the main menu) to create a new message/message number from scratch. The system information feature in the main menu lets you listen to a list of open announcement numbers, message functions, and open or unused message numbers. Unused message numbers are recorded, but unassigned messages. Different announcements and message functions are stored seperately in individual announcement numbers, and message function numbers on the system. Just like how the different messages are stored seperately in individual message numbers. All in all, Verizon's Expanded Announcement System is pretty complex and vast, with a storage of thousands of messages, and lots of announcements and message functions. And, an almost limitless number of ways to combine them all. As a result, I would guess it could take a pretty good amount of time to put together an entire announcement. Especially if It's all done from scratch, rather than through modifying or using any existing messages, message functions, or announcements. But, I don't think I recommend spending long sessions logged into the Expanded Announcement System in the first place. Especially not during regular Verizon business hours. (It's just good common sense). Also, I don't know whether this system is logging ANI, either. Besides, It's pretty obvious that they intended this system to be for telco tech personnel use only, anyway. By the way, you don't have to live in my local or regional area to access the Expanded Announcement System, since It's dialable through a standard 10 digit phone number. Shout outs: ic0n (as always), Hopping Goblin, OldSkoolPhreak.com and all the Agents of Freedom, Dual Parallel, Stankdawg.com and all the forum krew over there, all the people behind the screens at hackerhost.com, CueBiz and the Telco Insiders, Decoder, Unity, Phreakblaze, White Raven, Bagel, Reaver, and all the old LPH krew. And, the countless people who've helped me an ic0n make our site www.hackerhost.com/lph what It's grown into. Exchange Scanning by decoder August 7th, 2003 This is not a complete guide to exchange scanning. There are plenty of files on the topic of scanning the full 10,000 block. I will be focusing on the 'test' areas, most commonly found on the 'high end' (99xx) and 'low end'(00xx) of an exchange, as well as 'special' exchanges. This should be a useful guide for the beginner, but also interesting and informative for even the most seasoned phreak. Note: Many people say that the telco has equipment in every central office to detect sequential dialing and excessive calls to toll- free numbers. I do all of my scanning from home, by hand. I encourage everyone to use their own discretion. Introduction. ------------- I happen to live in New York, where exchange scanning is pretty easy. All of the test numbers can usually be found without too much time and effort, which is good because I am lazy. My regional calling area consists of the following NPA's: 212 Manhattan 917 originally NYC wireless, now also includes land lines in Manhattan 646 new Manhattan land lines and wireless 718 Brooklyn, Queens, the Bronx and Staten Island 347 overlap for 718 516 Nassau County (Long Island) 631 Suffolk County (Long Island) *(home of 2600) 914 Westchester County *(where the X-Men are from) 845 Rockland & Putnam Counties (and the southern part of Orange County) 203 Greenwich & Byram Connecticut *[phreak phact: three of these NPA's (212, 914, & 203) are original area codes from 1947. back then, customers didn't use the area codes, they were only for operators.] The most commonly know test number in these area codes is the 'verification' number, which can be found on (NPA)NXX-9901. Keep in mind that this format only applies to Verizon owned, land-line exchanges. (although there are a few exceptions) These verification numbers give you the location of the central office, and usually list most of the exchanges handled by that particular c.o. Many people know of the 'Elvis' verification number (718 238-9901). If you've never heard it, give it a call, it's always good for a laugh. There is also a verification number that lists an exchange that begins with a one (914 375-9901), which is apparently some kind of 'inward' exchange. (when you call it, the first exchange listed is 146!) Most of these recordings are pretty old so some exchanges listed may not work anymore and, of course there are some new ones as well. Sometimes, in places where there has been an area code change, the verification message will still give the old one. When the exchanges are listed in non-sequential order, the first ones listed are usually the oldest. This is what should be of interest. I have noticed that in my area that the oldest exchanges in a c.o. are where you will find most of the test messages, tones, payphone recordings, DATU's, etc. In New York, these are found in the 'high end' (99xx) of an exchange, although sometimes they hide the good stuff. There is a list of DATU's in NPA 718 making its way around the net, and they are not located in the 'high end', they're all on random numbers. The list has been out for a while and all of the numbers and codes still work. (most codes in 718 are NOT default, but the codes are kind of simple anyway) This information originated on the PLA (phonelosers) forums, and was posted by an ex-employee of Verizon. But finding a DATU shouldn't be the main objective of exchange scanning. There are many other cool things you can find. Other areas. ------------ New York isn't the only place where the test numbers are in the 'high end' of the exchange. Michigan, D.C., Maryland and many other places work the same way. There are also areas where you should scan the 'low end'(00xx). This seems to be the format in California and Pennsylvania. In Illinois, a good place to look is in 12xx, and I've even found an exchange in Texas where the tests are in 31xx. Although the 'high end' and 'low end' are the most common, don't hesitate to check other sections. If you find a 1000 hz. tone on NXX-6715, then scan out 67xx. If you want to know all the exchanges in your central office, I'm sure that there are websites where you can find such information. If you can't find one, read a file on how to use a search engine. Sometimes you can just open up your local phone book, and if you're lucky, the information will be in there. One trick I use to find out which exchanges are the oldest is to check what the Government numbers are. (police station, court house, library, etc.) It stands to reason that these places will have their numbers on the oldest exchange. After all, the police station has obviously been there for a while, and I'm sure they wouldn't ever need to change their phone number. If you live in a small town and your central office only has one or two exchanges, then you don't have much work to do at all. The Scan. --------- I was inspired to do this scan when reading an old text file on exchange scanning. (it can be found in 'BIOC's Guide to Basic Telecommunications vol. one', as well as many other places) First of all, the area code has changed since the file was written.(1980's?) Also, some of the numbers worked, but most didn't, so I decided to scan the 100 numbers myself. I found that a few of the original recordings were still there, but on different numbers. I also found a few other cool things, so here is the updated and expanded version of that old text-file. (find the old scan, you'll see it's not much different than mine) This should prove that 15 or 20 year old text files are still worth reading, not only to know your history, but they can also be semi-useful. The old skool is alive and well. 1(845)268-99xx: 9901 welcome to the Congers DMS-100 central office, using codes 268, 267, 261 and 979. (261 and 979 don't seem to work anymore) 9903 rings once, then plays six DTMF tones 9909 we're sorry, your call did not go through. will you please hang up and try your call again? this is a recording. (repeats, then rings again...) please hang up and try your call again. if you need assistance, dial your operator. please hang up now. this is a recording. *this is the most common recording on this number, but if you call it a few times, you'll get a few different things. try it out. 9910 DATU (default user code) 9911 DATU (default user code) 9922 excuse me, please deposit five cents for the next two minutes or your call will be terminated. this is a recording. 9926 (914) 268, 267, 261 Congers DMS-100 verification. (also will play the message on 9901 sometimes) *note the old NPA 9933 {sit tones} we're sorry, the long distance company access code you dialed must be preceded by the digits 950. please hang up and try your call again. (I don't think they even use 950 anymore) 9940 {sit tones} we're sorry. private calls are not accepted by this number. to complete your call, hang up, pick up again, dial *82 or on rotary phones 1182, then dial the number. if call id or call id with name are in use, your name and number may be displayed. this message is free. (this one was very informative. I'm surprised that they didn't tell me which end of the phone I should speak into) 9947 {sit tones} we're sorry, you call cannot be completed as dialed. please check the number and dial again, or call your operator to help you. (also plays a similar message in a different voice) 9960 loud tone (1000? hz.) 9963 loud tone (1000? hz.) 9967 rings once, then silence 9977 {sit tones} we're sorry, your call cannot be completed as dialed from the phone you are using. please read the instruction card and dial again. 9978 the call you have made requires a coin deposit. check the instructions on the payphone for the appropriate rate, and dial your call again. 9999 rings, then low hum (weird) Comments. --------- Now lets see what I've found. Two different verification numbers, a number that plays DTMF tones, a few of payphone recordings, some old error messages, tones, and two DATU's. Don't ask me why there are two DATU's, I'm assuming that they don't do anything different. I usually find twice as many test recordings in a New York 'high end' scan, but that old 'call id' message was something I haven't encountered before. Even when you don't find much, you find something. All numbers not listed either ring out, are a fast busy, or play the regular disconnect message. (we're sorry,...268-99xx has been disconnected or is no longer in service...) I usually do my scans at night, well after business hours, but I have reason to believe that 9900 is the direct number to the central office. Sometimes when I scan during the day, someone will answer at 9900 and say the name of the central office (as in where it is located, 268=Congers, NY) I've only encountered this a few times. I never talked to them because I'm usually about to scan out the next 99 numbers, and I'm not looking for trouble. Maybe one day when I'm bored, I'll try to social them. Special Exchanges. ------------------ Most of the time, numbers such as the ANAC, time and weather, ringback and various other things are kept on special exchanges. Almost all special exchanges can only be reached from that particular area, except for time and weather numbers, which can usually be reached from anywhere. In New York, 958-xxxx and 990-xxxx are ANAC's and 660+ your 7-digit phone number is the ringback. In New Jersey, the ringback is 550. Many states use 200 for the ANAC, from what I have heard. In California, you can get the time by dialing 767-xxxx (which most people call 'popcorn', 767-2676 spells popcorn), or 853-xxxx. The 767 exchange is used in Northern California NPA's, and the 853 is for Southern Cali. There are a lot of places, like Boston and D.C., that still use 936 for time and weather. 976, 540, and 550 are also special exchanges, but they are all premium pay services, kind of like 900 numbers, so I wouldn't suggest scanning them unless you are beige boxing. You're probably not going to find anything that interesting, but you never know. The time and weather numbers in NY are on the 976 exchange, so If I want to know the current weather conditions, it'll cost me 99 cents. What a bargain! There is also the little known 959 exchange, which is very different from other special exchanges. It is owned by AT&T, and it is accessible from almost any area code. (except NY for some reason) If you get lucky, you might hear things like test messages and different tones, just like you would when scanning the high and low end of any other exchange. Try common numbers such as 1000, 1111, 1234, etc. Sometimes the test numbers will be different in different area codes and sometimes they're the same. I think that 959-1000 is the same everywhere. Because these are AT&T's numbers, they can only be reached through AT&T. The way to do this is to use AT&T's dial-around, 10-10-288. (another one is 10-16-111, which also works the same for op-diverting, by the way) Simply dial 10-10-288+ 1(NPA)959-xxxx. You will not be charged for this call because it is a test exchange. I can personally attest to the fact that it is free, but I can also personally attest to the fact that AT&T might get pissed off if you do it too much because they blocked my use of 10-10-288. Don't feel too bad for me. I can still use 10-10-288-0 to op-divert to toll-free numbers, I just can't use it to make long distance calls or to call 959 numbers. Oh well. Conclusion. ----------- Exchange scanning is fun and most of the time, it's free! The telco doesn't charge you when you reach an error message, so you can call these numbers from a payphone without paying for it. If you're scanning your exchange from home, then it's either free or just the price of a local call,(if you get the odd business or residence here and there). I do strongly suggest getting an unlimited long distance plan so you can scan exchanges all over the country. (not to mention call up all the 'l33t phreaker confs) It's always cool to be able to tell your friend who lives 1000 miles from you what his DATU and ANAC numbers are. Appendix. --------- I was planning on adding a few scans to this file, but I thought it would be a better idea to give people the chance to do some scanning for themselves. To give you guys a starting point, I've added some numbers from scans I have done in the past. If you take a look around in these exchanges, you will find many interesting things. (313)849-9906 due to weather conditions, all Ameritech circuits are busy. please try your call again later. (313)324-9901 you have reached AT&T local services. DT RT MI BA DS0 (570)387-0000 thank you for calling Bell Atlantic. due to an emergency condition, we are operating with a reduced staff, and if you stay on the line you may experience a delay. you may find it more convenient to call us back at another time for assistance. (570)387-0083 DATU (default codes) *(this one has a different voice, so far it's the only one I have found like it) (202)965-9970 you have just de-activated this feature (916)440-0017 we're sorry, your service has been interrupted. for fire, medical and police emergencies, dial 911. to discuss your account, please contact you local service provider. thank you. (916)440-0031 {sit tones) we're sorry. due to telephone company facility trouble, your call cannot be completed at this time. will you try your call again later. (212)967-9999 this is a test announcement. this is a test announcement for use at anytime in emergency cases. thank you. (this will also play a citibank message sometimes) (646)674-9901 you have reached Bell Atlantic office of west 36th st., serving codes (646)674, (212)594, (917) 339. (914)345-9935 excuse me, please deposit 5 cents for the next two minutes or your call will be terminated. thank you for using Nynex. this is a recording. (415)499-0091 DATU (default user code) (618)654-1206 ANAC (this can be reached from anywhere, but it only reads back your 7-digit number) (409)724-3137 {sit tones} the call you have made requires an initial deposit. please hang up momentarily, listen for dialtone, deposit the amount specified on the instruction card, and dial your call again. (215)979-0045 (AT 629) welcome to the ATX long distance network. please contact customer service at 1(800)220-4900 to activate service. (215)979-0028 -(hold music)- thank you for calling Bell Atlantic. all of our lines are busy right now, but your call is important to us. please hold on, our next available representative will be with you shortly. -(more horrible hold music with singing!)- ANI vs. ANAC What are they, and what's the difference? By: ic0n Email: ic0n@oldskoolphreak.com URL: www.hackerhost.com/lph/ Since I showed up on the phreak scene, I've seen many phreaks mix up ANI and ANAC. In this article, I'll explain what both are, what they're used for, and the diffrence between the 2. Ill start with ANI. ANI means Automatic Number Identification This is a service that is mainly found on toll free numbers. But any telco related number in your area might also have ANI.Larger Companys will also have ANI on their networks. If they have an outdial feature there are very good chances that will have ANI. I've read on quite a website that ANI is not offered to the public, I think that if you have the money your local telco will be able to help you out with getting this very expensive feature added to your wire pair (your telephone). ANI information is transmitted as part of the digital stream in the signaling protocal. At the end of each month the subcriber will be mailed a log of every phone call they got for that given month. Included in the log are the numbers of each caller along with the full name of who the number belongs to. ANI may also be used to refer to any telephone number. Ani is used to bust people doing toll fraud or anything else illegal over the telephone. Ani is a service that is on an ANAC. Hotels and motels use something called ARI. ARI stands for Automatic Room Identification which will allow the front desk to see who's calling. There's also something called Ani 2 witch will give even more information about you. The major thing about it is that you get a 2 digit code. To find out if your area code is under ANI 2 op-divert threw a local operator to an ANAC that has ANI 2. Example: 00 Pots (plan old telephone service) This 2 digit code will identify your line. Ani 2 will also identify The line number, ARU, and DNIS. ARU, Audio Response unit. Aru device that provides synthesized voice responses to dtmf signaling input by processing calls based on the call-originator input information received from a host data base information in the incoming call, such as the time of day. Line Number, The line you are accessing on their system. DNIS, Dialed Number Identification Service Is a telephone service that identifies for the receiver of a call the number that the caller dialed. It's a common feature of 800 and 900 lines. If you have multiple 800 or 900 numbers to the same destination, DNIS tells which number was called. DNIS works by passing the touch tone digits (dual tone multi-frequency or MF digits) to the destination where a special, facility can read and display them or make them available for call center programming. Here's a list of every 2 digit code... 00 Plain Old Telephone Service (POTS) - non-coin service requiring no special treatment 01 Multiparty line (more than 2) - ANI cannot be provided on 4 or 8 party lines. The presence of this "01" code will cause an Operator Number Identification (ONI) function to be performed at the distant location. The ONI feature routes the call to a CAMA operator or to an Operator Services System (OSS) for determination of the calling number. 02 ANI Failure - the originating switching system indicates (by the "02" code), to the receiving office that the calling station has not been identified. If the receiving switching system routes the call to a CAMA or Operator Services System, the calling number may be verbally obtained and manually recorded. If manual operator identification is not available, the receiving switching system (e.g., an interLATA carrier without operator capabilities) may reject the call. 03-05 Unassigned 06 Station Level Rating - The "06" digit pair is used when the customer has subscribed to a class of service in order to be provided with real time billing information. For example, hotel/motels, served by PBXs, receive detailed billing information, including the calling partys room number. When the originating switching system doesn't receive the detailed billing information, e.g., room number, this "06" code allows the call to be routed to an operator or operator services system to obtain complete billing information. The rating and/or billing information is then provided to the service subscriber. This code is used only when the directory number, (DN) is not accompanied by an automatic, room/account identification. 07 Special Operator Handling Required - calls generated from stations that require further operator or Operator Services System screening are accompanied by the "07" code. The code is used to route the call to an operator or Operator Services System for further screening and to determine if the station has a denied-originating class of service or special routing/billing procedures. If the call is unauthorized, the calling party will be routed to a standard intercept message. 08-09 Unassigned 10 Not assignable - conflict with 10X test code 11 Unassigned 12-19 Not assignable - conflict with international outpulsing code 20 Automatic Identified Outward Dialing (AIOD) - without AIOD, the billing number for a PBX is the same as the PBX Directory Number (DN). With the AIOD feature, the originating line number within the PBX is provided for charging purposes. If the AIOD number is available when ANI is transmitted, code "00" is sent. If not, the PBX DN is sent with ANI code "20". In either case, the AIOD number is included in the AMA record. 21-22 Unassigned 23 Coin or Non-Coin - on calls using database access, e.g., 800, ANI II 23 is used to indicate that the coin/non-coin status of the originating line cannot be positively distinguished for ANI purposes by the SSP. The ANI II pair 23 is substituted for the II pairs which would otherwise indicate that the non-coin status is known, i.e., 00, or when there is ANI failure. ANI II 23 may be substituted for a valid 2-digit ANI pair on 0-800 calls. In all other cases, ANI II 23 should not be substituted for a valid 2-digit ANI II pair which is forward to an SSP from an EAEO. Some of the situations in which the ANI II 23 may be sent: Calls from non-conforming end offices (CAMA or LAMA types) with combined coin/non-coin trunk groups. 0-800 Calls Type 1 Cellular Calls Calls from PBX Trunks Calls from Centrex Tie Lines 24 Code 24 identifies a toll free service call that has been translated to a Plain Old Telephone Service (POTS) routable number via the toll free database that originated for any non-pay station. If the received toll free number is not converted to a POTS number, the database returns the received ANI code along with the received toll free number. Thus, Code 24 indicates that this is a toll free service call since that fact can no longer be recognized simply by examining the called address. 25 Code 25 identifies a toll free service call that has been translated to a Plain Old Telephone Service (POTS) routable number via the toll free database that originated from any pay station, including inmate telephone service. Specifically, ANI II digits 27, 29, and 70 will be replaced with Code 25 under the above stated condition. 26 Unassigned 27 Code 27 identifies a line connected to a pay station which uses network provided coin control signaling. II 27 is used to identify this type of pay station line irrespective of whether the pay station is provided by a LEC or a non-LEC. II 27 is transmitted from the originating end office on all calls made from these lines. 28 Unassigned 29 Prison/Inmate Service - the ANI II digit pair 29 is used to designate lines within a confinement/detention facility that are intended for inmate/detainee use and require outward call screening and restriction (e.g., 0+ collect only service). A confinement/detention facility may be defined as including, but not limited to, Federal, State and/or Local prisons, juvenile facilities, immigration and naturalization confinement/detention facilities, etc., which are under the administration of Federal, State, City, County, or other Governmental agencies. Prison/Inmate Service lines will be identified by the customer requesting such call screening and restriction. In those cases where private paystations are located in confinement/detention facilities, and the same call restrictions applicable to Prison/Inmate Service required, the ANI II digit for Prison/Inmate Service will apply if the line is identified for Prison/Inmate Service by the customer. 30-32 Intercept - where the capability is provide to route intercept calls (either directly or after an announcement recycle) to an access tandem with an associated Telco Operator Services System, the following ANI codes should be used: 30 Intercept (blank) - for calls to unassigned directory number (DN) 31 Intercept (trouble) - for calls to directory numbers (DN) that have been manually placed in trouble-busy state by Telco personnel 32 Intercept (regular) - for calls to recently changed or disconnected numbers 33 Unassigned 34 Telco Operator Handled Call - after the Telco Operator Services System has handled a call for an IC, it may change the standard ANI digits to "34", before outpulsing the sequence to the IC, when the Telco performs all call handling functions, e.g., billing. The code tells the IC that the BOC has performed billing on the call and the IC only has to complete the call. 35-39 Unassigned 40-49 Unrestricted Use - locally determined by carrier 50-51 Unassigned 52 Outward Wide Area Telecommunications Service (OUTWATS) - this service allows customers to make calls to a certain zone(s) or band(s) on a direct dialed basis for a flat monthly charge or for a charge based on accumulated usage. OUTWATS lines can dial station-to-station calls directly to points within the selected band(s) or zone(s). The LEC performs a screening function to determine the correct charging and routing for OUTWATS calls based on the customers class of service and the service area of the call party. When these calls are routed to the interexchange carrier via a combined WATS-POTS trunk group, it is necessary to identify the WATS calls with the ANI code "52". 53-59 Unassigned 60 TRS - ANI II digit pair 60 indicates that the associated call is a TRS call delivered to a transport carrier from a TRS Provider and that the call originated from an unrestricted line (i.e., a line for which there are no billing restrictions). Accordingly, if no request for alternate billing is made, the call will be billed to the calling line. 61 Cellular/Wireless PCS (Type 1) - The "61" digit pair is to be forwarded to the interexchange carrier by the local exchange carrier for traffic originating from a cellular/wireless PCS carrier over type 1 trunks. (Note: ANI information accompanying digit pair "61" identifies only the originating cellular/wireless PCS system, not the mobile directory placing the call. 62 Cellular/Wireless PCS (Type 2) - The "62" digit pair is to be forwarded to the interexchange carrier by the cellular/wireless PCS carrier when routing traffic over type 2 trunks through the local exchange carrier access tandem for delivery to the interexchange carrier. (Note: ANI information accompanying digit pair "62" identifies the mobile directory number placing the call but does not necessarily identify the true call point of origin.) 63 Cellular/Wireless PCS (Roaming) - The "63" digit pair is to be forwarded to the interexchange carrier by the cellular/wireless PCS subscriber "roaming" in another cellular/wireless PCS network, over type 2 trunks through the local exchange carrier access tandem for delivery to the interexchange carrier. (Note: Use of 63 signifies that the "called number" is used only for network routing and should not be disclosed to the cellular/wireless PCS subscriber. Also, ANI information accompanying digit pair "63" identifies the mobile directory number forwarding the call but doesn't necessarily identify the true forwarded-call point of origin.) 64-65 Unassigned 66 TRS - ANI II digit pair 66 indicates that the associated call is a TRS call delivered to a transport carrier from a TRS Provider, and that the call originates from a hotel/motel. The transport carrier can use this indication, along with other information (e.g., whether the call was dialed 1+ or 0+) to determine the appropriate billing arrangement (i.e., bill to room or alternate bill). 67 TRS - ANI II digit pair 67 indicates that the associated call is a TRS call delivered to a transport carrier from a TRS Provider and that the call originated from a restricted line. Accordingly, sent paid calls should not be allowed and additional screening, if available, should be performed to determine the specific restrictions and type of alternate billing permitted. 68-69 Unassigned 70 Code 70 identifies a line connected to a pay station (including both coin and coinless stations) which does not use network provided coin control signaling. II 70 is used to identify this type pay station line irrespective of whether the pay station is provided by a LEC or a non-LEC. II 70 is transmitted from the originating end office on all calls made from these lines. 71-79 Unassigned 80-89 Reserved for Future Expansion "to" 3-digit Code 90-92 Unassigned 93 Access for private virtual network types of service: the ANI code "93" indicates, to the IC, that the originating call is a private virtual network type of service call. 94 Unassigned 95 Unassigned - conflict with Test Codes 958 and 959 96-99 Unassigned Now on with ANAC.. ANAC stands for Automatic Number Announcement Circuit. When you dial up an anac it will give you the telephone number you called the anac from. This is very useful when out field phreaking with your beige box. By far the most important when your at a telco can. At the end of this article I'll include a list of local anacs. Some local anacs will differ from switch to switch. There also toll free anacs most get shutdown due to abuse or overuse. Because of that I quit releasing anac lists. So do every phreak a favor and use local anac when and if possible. Hopefully, you now understand both ANI and ANAC. Now here's a list of ANAC's they all worked as of 8/21/03 Patlife Anac's 800-492-0295 005736 800-857-9139 200695 800-584-9196 300265 800-300-ic0n (4206) 202622 800-877-Capt 009949 800-789-4779 201867 800-729-0059 302234 888-253-8254 411198 888-253-8253 411197 888-253-8251 411196 888-253-8249 411195 888-253-8229 411193 888-253-8227 411192 888-253-8226 411191 888-253-8225 411190 888-776-5733 409159 800-964-0221 401479 888-535-0055 507433 888-349-9971 505656 888-578-7437 kru-sher 504872 800-797-6088 200170 800-803-6514 300433 800-803-6521 300434 800-803-6527 300435 800-803-6528 301892 800-803-6594 100973 800-803-6544 300436 800-293-6924 010614 800-213-2233 008637 800-483-2975 005976 800-737-9628 002023 800-729-0056 302234 888-837-7230 503712 888-837-7231 503713 Ani2 (II) 800-555-1140 800-555-1180 800-550-3124 800-225-5313 800-225-5214 Atnt 800-532-7486 +1 Mci 800-314-4258 800-333-3232 800-444-0800 800-444-2222 800-444-3333 800-444-4444 800-444-5555 800-552-8355 800-555-1221 800-797-5207 800-967-5326 +2 Other Anac's 800-240-1411 +1 (even if blocked from area code) 800-444-0872 +1 (even if blocked from area code) 800-444-0866 +1 (even if blocked from area code) 800-666-1379 +1 (even if blocked from area code) 877-265-5343 8+1 (877-college) 800-964-0176 800-964-0221 800-223-1104 195632 888-221-0104 12345 888 324 8686 NPA ANAC number Geographic area 201 958 Hackensack/Jersey City/Newark/Paterson, NJ 202 811 District of Columbia 203 970 CT 205 300-222-2222 Birmingham, AL 205 300-555-5555 Many small towns in AL 205 300-648-1111 Dora, AL 205 300-765-4321 Bessemer, AL 205 300-798-1111 Forestdale, AL 205 300-833-3333 Birmingham 205 557-2311 Birmingham, AL 205 811 Pell City/Cropwell/Lincoln, AL 205 841-1111 Tarrant, AL 205 908-222-2222 Birmingham, AL 206 411 WA (Not US West) 207 958 ME 209 830-2121 Stockton, CA 209 211-9779 Stockton, CA 212 958 Manhattan, NY 213 114 Los Angeles, CA (GTE) 213 1223 Los Angeles, CA (Some 1AESS switches) 213 211-2345 Los Angeles, CA (English response) 213 211-2346 Los Angeles, CA (DTMF response) 213 760-2??? Los Angeles, CA (DMS switches) 213 61056 Los Angeles, CA 214 570 Dallas, TX 214 790 Dallas, TX (GTE) 214 970-222-2222 Dallas, TX 214 970-611-1111 Dallas, TX (Southwestern Bell) 215 410-xxxx Philadelphia, PA 215 511 Philadelphia, PA 215 958 Philadelphia, PA 216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH 217 200-xxx-xxxx Champaign-Urbana/Springfield, IL 219 550 Gary/Hammond/Michigan City/Southbend, IN 219 559 Gary/Hammond/Michigan City/Southbend, IN 301 958-9968 Hagerstown/Rockville, MD 310 114 Long Beach, CA (On many GTE switches) 310 1223 Long Beach, CA (Some 1AESS switches) 310 211-2345 Long Beach, CA (English response) 310 211-2346 Long Beach, CA (DTMF response) 312 200 Chicago, IL 312 290 Chicago, IL 312 1-200-8825 Chicago, IL (Last four change rapidly) 312 1-200-555-1212 Chicago, IL 313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI 313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI 313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI 313 200200200200200 Ann Arbor/Dearborn/Detroit, MI 314 410-xxxx# Columbia/Jefferson City/St.Louis, MO 315 953 Syracuse/Utica, NY 315 958 Syracuse/Utica, NY 315 998 Syracuse/Utica, NY 317 310-222-2222 Indianapolis/Kokomo, IN 317 559-222-2222 Indianapolis/Kokomo, IN 317 743-1218 Indianapolis/Kokomo, IN 401 200-200-4444 RI 401 222-2222 RI 402 311 Lincoln, NE 404 311 Atlanta, GA 404 940-xxx-xxxx Atlanta, GA 404 990 Atlanta, GA 405 890-7777777 Enid/Oklahoma City, OK 405 897 Enid/Oklahoma City, OK 407 200-222-2222 Orlando/West Palm Beach, FL 408 300-xxx-xxxx San Jose, CA 408 760 San Jose, CA 408 940 San Jose, CA 409 951 Beaumont/Galveston, TX 409 970-xxxx Beaumont/Galveston, TX 410 200-6969 A 410 200-555-1212 A 410 811 Annapolis/Baltimore, MD 412 711-6633 Pittsburgh, PA 412 711-4411 Pittsburgh, PA 412 999-xxxx Pittsburgh, PA 413 958 Pittsfield/Springfield, MA 413 200-555-5555 Pittsfield/Springfield, MA 414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI 415 200-555-1212 San Francisco, CA 415 211-2111 San Francisco, CA 415 2222 San Francisco, CA 415 640 San Francisco, CA 415 760-2878 San Francisco, CA 415 7600-2222 San Francisco, CA 419 311 Toledo, OH 440 959-9892 East Cleveland, OH 502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY 502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY 503 611 Portland, OR 503 999 Portland, OR (GTE) 504 99882233 Baton Rouge/New Orleans, LA 504 201-269-1111 Baton Rouge/New Orleans, LA 504 998 Baton Rouge/New Orleans, LA 504 99851-0000000000 Baton Rouge/New Orleans, LA 508 958 Fall River/New Bedford/Worchester, MA 508 200-222-1234 Fall River/New Bedford/Worchester, MA 508 200-222-2222 Fall River/New Bedford/Worchester, MA 508 26011 Fall River/New Bedford/Worchester, MA 509 560 Spokane/Walla Walla/Yakima, WA 512 830 Austin/Corpus Christi, TX 512 970-xxxx Austin/Corpus Christi, TX 515 5463 Des Moines, IA 515 811 Des Moines, IA 516 958 Hempstead/Long Island, NY 516 968 Hempstead/Long Island, NY 517 200-222-2222 Bay City/Jackson/Lansing, MI 517 200200200200200 Bay City/Jackson/Lansing, MI 518 997 Albany/Schenectady/Troy, NY 518 998 Albany/Schenectady/Troy, NY 603 200-222-2222 NH 606 997-555-1212 Ashland/Winchester, KY 606 711 Ashland/Winchester, KY 607 993 Binghamton/Elmira, NY 609 958 Atlantic City/Camden/Trenton/Vineland, NJ 610 958 Allentown/Reading, PA 612 511 Minneapolis/St.Paul, MN 614 200 Columbus/Steubenville, OH 614 571 Columbus/Steubenville, OH 615 200200200200200 Chatanooga/Knoxville/Nashville, TN 615 2002222222 Chatanooga/Knoxville/Nashville, TN 615 830 Nashville, TN 616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI 617 200-222-1234 Boston, MA 617 200-222-2222 Boston, MA 617 200-444-4444 Boston, MA (Woburn, MA) 617 220-2622 Boston, MA 617 958 Boston, MA 618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL 618 930 Alton/Cairo/Mt.Vernon, IL 619 211-2001 San Diego, CA 703 811 Alexandria/Arlington/Roanoke, VA 704 311 Asheville/Charlotte, NC 708 1-200-555-1212 Chicago/Elgin, IL 708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly) 708 200-6153 Chicago/Elgin, IL 708 724-9951 Chicago/Elgin, IL 708 356-9646 Chicago/Elgin, IL 713 380 Houston, TX 713 970-xxxx Houston, TX 713 811 Humble, TX 714 114 Anaheim, CA (GTE) 714 211-2121 Anaheim, CA (PacBell) 714 211-2222 Anaheim, CA (Pacbell) 716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 717 958 Harrisburg/Scranton/Wilkes-Barre, PA 718 958 Bronx/Brooklyn/Queens/Staten Island, NY 802 2-222-222-2222 Vermont 802 200-222-2222 Vermont 802 1-700-222-2222 Vermont 802 111-2222 Vermont 805 114 Bakersfield/Santa Barbara, CA 805 211-2345 Bakersfield/Santa Barbara, CA 805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF) 805 830 Bakersfield/Santa Barbara, CA 806 970-xxxx Amarillo/Lubbock, TX 810 200200200200200 Flint/Pontiac/Southfield/Troy, MI 812 410-555-1212 Evansville, IN 813 311 Ft. Meyers/St. Petersburg/Tampa, FL 815 200-xxx-xxxx La Salle/Rockford, IL 815 290 La Salle/Rockford, IL 817 211 Ft. Worth/Waco, TX 817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell) 818 1223 Pasadena, CA (Some 1AESS switches) 818 211-2345 Pasadena, CA (English response) 818 211-2346 Pasadena, CA (DTMF response) 903 970-611-1111 Denison, TX 906 1-200-222-2222 Marquette/Sault Ste. Marie, MI 908 958 New Brunswick, NJ 910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY 915 970-xxxx Abilene/El Paso, TX 916 211-2222 Sacramento, CA (Pac Bell) 916 461 Sacramento, CA (Roseville Telepohone) 919 200 Durham, NC 919 711 Durham, NC Canada: 204 644-xxxx Manitoba 306 115 Saskatchewan, Canada 403 311 Alberta, Yukon and N.W. Territory 403 908-222-2222 Alberta, Yukon and N.W. Territory 403 999 Alberta, Yukon and N.W. Territory 416 997-xxxx Toronto, Ontario 506 1-555-1313 New Brunswick 514 320-xxxx Montreal, Quebec 519 320-xxxx London, Ontario 604 1116 British Columbia, Canada 604 1211 British Columbia, Canada 604 211 British Columbia, Canada 613 320-2232 Ottawa, Ontario 705 320-4567 North Bay/Saulte Ste. Marie, Ontario Australia: +61 03-552-4111 Victoria 03 area +612 19123 All major capital cities 12722123 United Kingdom: 175 Loop Maintenance Operations System (LMOS) by Brisk Attivo 16.3.2. LOOP MAINTENANCE OPERATIONS SYSTEM (LMOS) When a clerk takes a report in a repair service bureau that uses only manual methods, a trouble ticket is filled out. This ticket includes the customer's name, address, telephone number, and any pertinent information that may help to identify the trouble. All of this information is entered on the ticket manually, with the ticket eventually passing through many hands. In addition to this source of information, cable pair assignment, cable makeup information, and trouble history for each customer are kept on file in large bins or file tubs. This information is used by the tester to help isolate the problem. Through the use of LMOS, all of this information can be stored in a computer and displayed on CRTs at the 611 position and other locations. In addition to simplifying information retrieval, the accuracy and readability of the information will be greatly imporved. The CRT display will alow the RSB to advice the customer immediately of the status of the trouble, should the customer happen to make a followup inquiry. It also produces administrative reports including jeopardy reports, facility status reports, cable fill reports, and reports with respect to closed out troubles. LMOS includes documentation such as training materials and position practices. LMOS can be installed separately or with the LSV or mechanized loop testing (MLT) modules, which mechanize important testing functions. The system economically viable for typical groupings of repair service bureaus that serve on-half million to five million lines. Labor savings benefits result from: (1) Mechanization of the line record. (2) A mechanized service order inteface for automatic line record updating. (3) The ability to centralize the repair service attendants for many repair service bureaus. (4) A flexible report generator that produces standard statistics or processed trouble reports and special reports on demand. (5) A repair force administration algorithm that optimizes the travel time of the repair personell. LMOS is a 3-level network interconnected by data links as shown in Fig. 16-2. The hub of the network is an IBM 370 computer and associated peripherals. The master line record data base is maintained in the hub, which can support up to five million working lines. Fig. 16-2. Loop Maintenance Operations System The second level of the system consists of a number of satellite locations which are linked with the central data base. A satellite consists of a PDP 11/70 minicomputer and associated peripheral equipment. Each satellite has an estimated capacity of one million lines. The satellites support almost all of the real-time transactions and provide response times on the order of 5 seconds or less for most transactions. Because these satellites have such a large capacity and since the cost of the minicomputer equipment is a minor portion of the overall system cost, a duplexed configuration is reccomended for reliability. The third level of the system is at the repair service bureaus and centralized repair service attendant locations. Each location has a PDP 11/10 minicomputer which is linked with one of the satellite minicomputers. The repair service attenants and other personel interact with the system through CRT terminals, printers, and status entry devices which are special purpose data entry terminals that enter data with a TOUCH-TONE pad and display data on a light-emitting diode readout strip. The lower limit on the capacity of a LMOS installation is based on economic constraints imposed by fixed cost items such as software support personnel, training center costs, and IBM 370 costs. This limit is estimated to be 500,000 lines. 16.3.2.2 Operations The following descriptions of ways that LMOS can be used in an operating company will further explain the organization and functions of the system. The Repair Service Attendant Position. Each repair service attendant position is equipped with a CRT terminal through with LMOS accepts trouble reports. Following keyboard entry of a customer telephone number or special service circuit number, LMOS responds with 5 second with a CRT display that includes: (1) Customer name, address, and service data such as disconnected, non-working, affiliated with a telephone answering service, or date of last trouble. (2) An appointment time that can be offered to the customer if a repair visit appears to be neccessary. (3) LSV or mechanized line testing system responses ( if installed at serving RSB) to LMOS initiations. (4) Information on cable and other equipment failures that are known to be affecting the particular customer's circuit. (5) Information on the initial report (if the current report is identified as a subsequent report) concering repair status, promised appointment time, and number of previous subsequent reports. The appointment time mentioned above takes into account both of the back-log of trouble reports awaiting dispatch and the size of the craft force responsible for the corresponding repair coverage. The LSV or mechanized line testing system response usually is not available at the time of the initial trouble report transmission, but is writen into a reserved space on the display as the repair service attendant is talking to the customer. REsponse time of these systems is on the order of 10 seconds and can be longer if delays are encountered because of test equipment usage. As in the case of the appointment time offering, the LSV or mechanized line testing system response is made from the RSB covering the service in question and need not be the same RSB that contains the originating repair service attendant position. It is the independence of the repair service attendant from the responsible RSB that permits one of the more significant operational capabilities: centralization of the repair service attendant task. Such centralization is possible because all of the repair service attendant transactions are designed to operate with acces to all of the line records contained within the serving satellite minicomputer (this also implies acess to all LSV and mechanized line testing systems covering these lines). Thus, 24-hour coverage and other desirable features possible with a centralized repair service attendant location are provided within the LMOS design. 16.3.2.3 RSB Handling of the Trouble REports Once a trouble report has been entered in LMOS, the line record data base is accessed and a basic output report is transmitted within seconds to a printer at the appropriate RSB. In addition to the trouble report and line record data, this paper document contains: (1) Assignment information. )2) Service and equipment information. (3) Trouble history for the past 40 days. (4) Warning of potential trouble causes such as cable failures. As repair action takes place following a trouble reports, status updates, such as test results and trouble reports closeouts, are entered into LMOS in the RSB, using status entry devices described previously. LMOS will aid in the dispatching of the repair force through the use of a repair force administration module that will provide a CRT-equipped dispatcher with a short list of reccomended dispatches each time a member of the repair force calls in for a new dispatch. Repair force administration will take into account the repair work backlog, available repair force, promised appointment times, and travel times. Note that since ach line record is keyed to a serving RSB, LMOS permits functional repair operations such as coin telephone repair centers and PBX repair centers; the basic output report always arrives at the correct serving RSB or repair center. 16.3.2.4 Control of Testing Not only can the repair service attendant position trigger LSV action against a particular telephone number, but also RSB personnel can use LMOS to drive a LSV in an automatic verification mode. This is done by using a RSB CRT terminal to enter a list of telephone number, a particular cable complement, a range of central office equipments, or a specifc class and period of closed-out trouble reports such as all-test-OKs for the last two days. LMOS then acceses its data base for cross-reference lists that provide the appropriate telephone numbers and initiates automatic sequential line status verification against the telephone number list. Results are printed out at the requesting RSB within seconds of completion. The testing capabilities of the mechanized line testing system can be used by LMOS in the same manner. 16.3.2.5 Operational REports Over and above individual trouble report tracking, LMOS provides three basic classees of operational reports: one covering open troubles, one covering closed-out reports, and one covering the line record and equipment file. Open trouble reports are used to aid in the hour-to-hour administration of the RSB. An example of this kind of reportis the jeopardy report, which flags trouble reports in jeopardy of missing their appointment times. Closed-out trouble reports relate to troubles that have been closed out within the last 40 days. Line record and equipment reports fall into three categories: (1) Batch reports that use the line record file as input, for example: all circuits on temporary suspension can be listed by telephone number. (2) Batch reports that list unallowed multiple assignments of cable and pair or central office equipment. (3) Equipment reports that are fixed in format but that are available inr elat time in response to CRT-entered transactions, for example :cable pair versus telephoen number by complement. Since many of these reports can be retrieved from a centralized location, the potential for a formal program of centralized analysis exists under LMOS. Note that some reports will be useful in connection with with operating company activities other than maintenance such as business office and network administration activities. 16.3.3. AUTOMATED REPAIR SERVICE BUREAU (ARSB) Both LSV and LMOS initially were designed as stand-alone systems, LSV as a manually operated line verification system and LMOS as a mechanized line record and trouble administration system. Recently, and interface was provided for LSV so that it can be directed from a LMOS operator's position to run its sequence of measurements on a particular line. This is a first step toward a total RSB system concept. Developpment is under way for a mechanized line testing (MLT) system, which is an improved version of the LSV. In addition to improved testing capabilities, it will have the ability to test in the presence of known terminations. In the new arrangement, the MLT system, working in conjunction with LMOS, will have a priori knowledge of expected values and allowable deviations for aparticular line being tested. For example, when testing a ground start PBX line, it would know that -48 volts is the normal on-hook condition, whereas this would indicate a fault for a station line. The new system also will make routine rapid scan measurements automatically during the early morning hours when lines are normally idle. All of these developments are part of what will be known as the automated repair service bureau (ARSB). How To Datu By: Majestic 1/12 " ( Warning Disclaimer ) All material(s) in this text file are intended for informational use only, it is not the authors intent to endorse fraud or help others in the pursuit of fraud. The author accepts no responsablity for any and all Fraudulant Activities that may come from the viewing of this text file. By downloading this file you the viewer accept all resposabliity for any repercutions that may come from abusing this information. " " Information is free, Crime costs! " Majestic 1/12 I have come to realize that the world of Phreaking is alot like Trial and Error, I myself hand scan all the numbers I come to own, and feel this is the only real way to extract all the information needed to continue on my ventures. Like all Phreakers I set out to discover the mad world of " ESS " and ways to make free calls. I came to discover a " PBX " or " Diverter " was not at all hard to find. Keeping the number secure was yet another matter! I went to all of the normal places on the net to view text files from the old Skool Era, and found alot of the material I had already known. It wasn't until I actually started calling into the " Voice Bridges " that I became really interested in the " Datu Systems ". I had friends that were really into REMOB back in the day, telling me how much fun it was to listen in on the conversations thier nieghbors held. When I found my first Datu, with Passcode, I thought I was going to be able to play phone god and take over lines, this was my first mistake. Sure I called in, entered a random number and was givin the prompt listed below. Being the inexperienced lamer at the time, I started trying the Permenant Signal Rlease, followed by a quick call back to check the line! I was defeated, as my attempt to take out a phone was deflected by my own stupidity! I called the Datu up again and actually listened to the woman's automated voice. This time when I pressed # 9, I heard " Permanent Signal Release Disabled, ( Pause ) ... OK Audio Monitor ... " After this I was redirected to the Datu Main Menu and I hung up! After further investigation into the Datu functions it was brought to my attention that along with the default codes to access the Datu, there were also sets of Admin Defaults that were needed in order to actually set up the functions. So with this I give you the information needed to help guide you to understanding the world of the Datu! Please read the information closely, as it will indeed give you insight! Step # 1: Dial Datu Access Number. Step # 2: Enter Datu Password. Step # 3: Dial Seven digit subscriber line number. Step # 4: Datu will respond with " Connected to XXX - XXXX " " OK " "Connected to XXX - XXXX, Busy LIne, Audio Monitor " Non pair gain lines proceed to Step # 7: " Note " If the line is busy the Datu will not access the DC by-pass pair or the Metallic Access Unit. Step # 5: SLC lines: If the line is idle Datu will respond " Pair Gain Line " Followed by " Processing " ( " Processing " may be repeated for up to 25 seconds. ) Datu will voice message: ____________________________________________________________ Single PartyLine (GOOD) Multi-Party LIne Followed by Coin LIne " Enter RT Number " ____________________________________________________________ Channel Not available (No Bad Channel test results) PGTC Failure/By-Pass If same recording is heard Pair Busy repeatededly, alert supervisor Pair Gain System Alarm (Alert Supervisor) ____________________________________________________________ step # 6: If Good ( Or Bad ) Channel test results, enter the RT number, Dial" * " to end,( " ** " to toggle on or off the Alpha Mode. ) Enter the pair number, Dial " * " to end. Dial " 0 * " to existing DC Test Pair. Datu will connect to the by-pass Pair or call the Metallic Access Unit in the RT, except when bypass is busy or Pair Gain system is in Alarm. See Step # 7 after Connection to remote site. Step # 7: Line Preperation Functional Dial Codes: 2 = Audio Monitor 33 = Short Tip and Ring to Ground 37 = Short Ring to ground ( Tip Open ) 38 = Short Tip to Ground ( Ring Open ) 44 = High Level Tone on Tip and Ring 47 = Gigh Level Tone on Ring ( Tip Grounded ) 48 = High Level Tone on Tip ( Ring Grounded ) 5 = Low Level Tone 6 = Open Line 7 = Short Line ( Tip to Ring ) 9 = Permanent Signal Release # = New Subscriber Line ## = Force Disconnect "MJ Notes" When accessing a Datu Unit you must know the Passcode which is usually a default of " 1234 or 2345 " I have noticed that when a Datu is called it will after prompted move straight to Step # 7 Line Preperation Function Dial Codes. The Audio Monitor option will sound with a low level sctratch type beep that cannot be decoded as talking to the human ear. this will only happen if the phone line called is currently busy. It has come to my attention that you also have to setup the Datu through the Admin Codes in order to actually have used the Datu correctly, otherwise you are accessing a totally dead and useless Phone Utility. The only use for a Datu without Admin features promted is to tell if someone is on thier phone, and yes boys and girls you are able to do that by just dialing the persons phone number. Now then I have givin you enough info on how to Datu, Now I will give you the actual Datu numbers and you can attempt to Datu all by yourselves... Play nice now ya'll! Datu Numbers: rea: NPA: Datu: Code: Laurelton 718 528-8374 2345 -8375 -8375 L.I.C 718 472-0567 2345 -0572 -0576 Flushing 718 460-2775 2345 -4055 -2861 -4155 Forest Hills 718 520-1207 2345 -1320 -1518 -1553 Astoria 718 728-2432 2345 2345 278- 626- 204- 956- 267- Astoria Contd... 718 726-2722 2345 2811 274- 932- 721- 545- 777- 546 Newton 718 424-0157 2345 0173 429- 639- 426- 565- 507- 936- 803- Newton Contd... 718 651-9129 2345 9139 3308 672- 478- 779- 334- 205- Yes Folks those are all valid Datu Numbers, enough that you could go read " Decoder's " Exchange Scanning " Article and figure out how you yourself can begin scanning out the local Datu's that may be in your own Area. Be advised that not all states have Datu test Units, Or it may be that I have just not found them yet... I hand scan all the numbers I get, and it takes alot of time, but I do get a very good amount of numbers that would be passed up on if scanned through a wardialer... I recommend Hand Scanning it is Uber 1337! " Props to Decoder, Twinkee the Kid, White Sword, ic0n, Dick Pickleson, Lucky 225, Dialect, Dark Cube, Night Wolf, Royal and the rest of the 31337 Phreakers doing what we know to be right..... " " I am a 404 ... " Maritime Telecommunication Network aka MTN By ic0n e-mail ic0n at houseofphreak dot org Quite sometime ago i went on a ship, That had telephones on it. Being the phreak i am I decided i would mess around with it since I've never heard anyone talk about it. First off these are satellite telephones. I don't remember the make nor the type of phone they where using. I was on a Carnival ship that witch has phones in every 'stateroom' (ships way of saying hotel room) All calls going back into the United States cost around 1.50 a minute. I don't remember about the international calls. I would guess thats around 3 bucks! Carnival blackmales anyone who goes on a cruse because that don't allow you to calling cards,credit cards nor collect calls. Heres what was told to everyone. 'Please note Since Communications at sea are via Satellite, guest maynot use credit cards,calling card nor collect calls.' What they try and make you do is use your phone in your room witch will be directly added to your bill. If i remember correctly the system they used was called 'Shore to ship' After going threw some old notebooks i found 2 numbers for ship to shore. 877-225-7447 732-335-3284 From http://www.carlsontravel.com Using your credit card: 1-877-823-6000 The cost is $8.50/minute once connected*. Billed to your telephone: 1-900-555-6000 The cost is $8.95/minute once connected*. You will need the Cruise Line and Ship Name in order to be connected. Refer to the cruise codes once you begin dialing. Please remember to give your friends and family the Cruise Line and Ship Name that you’re sailing on. Enjoy your cruise and thank you for booking through Carlson Wagonlit Travel. *Additional charges may be charged to the passenger depending on the cruise line. Print this information sheer to contact future Carlson Wagonlit Travel cruisers! CRUISE CODES CRUISE LINE CODE CRUISE LINE CODE Celebrity Cruise Line 700 Princess Cruises 300 Crystal Cruises 180 Radisson Seven Seas Cruises 800 Cunard Line 340 Royal Caribbean International 200 Disney Cruise Line 900 Seabourn Cruise Line 380 Holland America Line 400 Silversea Cruises 470 Norwegian Coastal Voyage 600 Windstar Cruises 530 Norwegian Cruise Line 500 World Explorer Cruises 550 Orient Lines 360 Frame Operations Management System (FOMS) by Anonymous from http://www.oldskoolphreak.com LEGAL NOTICE - YOU MUST READ Qwest computers and the Qwest network are Qwest property. Only authorized persons may use them for legal and proper purposes as determined solely by Qwest. By using them, you consent to monitoring. DESTINATION: foms xxxxxXX UMI Destination >xxxxXX Using DNS to resolve 'xxxxXX'... Trying 123.45.67.89 @ TCP Port 23... --> Connection Established <-- UNIX(r) System V Release 4 / UTS 4.5 (xxxxXX) (1) login: xxxxxxx Password: UNIX System V Release 4 / UTS 4.5 (UTS Global, LLC) xxxxXX Copyright (c) 1984, 1990 AT&T Copyright (c) 1990, 1993 UNIX System Laboratories, Inc. Copyright (c) 2000, 2003 UTS Global, LLC All Rights Reserved UTS is a registered trademark of UTS Blobal, LLC. Last login: LAST LOGIN: UNIX System "xxxxXX" Release 4 500 **** UTS SYSTEM "XXXXXX" **** **************************************************************** * Proprietary System * * Authorized access ONLY. Users subject to monitoring. * * ALL other use probhibited. * **************************************************************** FOMS/SWITCH problems ??? Call the IT Unified Help Desk All Qwest employees are directed to dial 8XX-XXX-HELP (4357) They are there 24 hours a day - 7 day a week to help you and determiine trouble source , soulutions and to coordinate resolution with the appropriate support group. Password resets require a call to the RMA Hotline at 1-8XX-XXX-XXXX Jeopardy reason tables have been updated for all wirecenters. Below is a list of permissible jeopardies. a1 Assignment Error on F1 Facilities [CP or UDC] a2 Assignment Error on Office Equipment (OE) a3 Reserved for Future Assignment Error Category a4 Assingment Error Tie Pair a5 Assingment Error TRE [Reg Units, DSL] a6 Qwest Wiring/Inventory issue [Line Sharing, DSL] a7 Stenciling Error Splitter or DSLAM a8 Splitter not connected to DLEC side, Splitter not avail. a9 Load Coil Detected [Line Share only not used for DSL] s1 Failed Synch Test [Line Share Only] FOMS for Xxxxxxxxxx, Xxxxxxxxxx and Xxxxxxxxxx COT Note: fnd_winback has been modified to only show uncompleted orders COT Note: fnd_ufo can be used at wc prompt to list unprinted ords & admin COT Note: fnd_cancel can be used at wc prompt to list canceled ords *********************************************************************** Press RETURN KEY to continue