rab@well.UUCP (Bob Bickford) (12/23/86)
In article <722@cooper.UUCP>, chris@cooper.UUCP (Chris Lent ) writes: > Here's a bit of phone trivia that works in some places. Dial > 958 and many times you get a generated voice telling you the number > you are DIALING from. > > Enjoy > -- > Chris Lent ihnp4!allegra!phri!cooper!chris Of course, this depends on what particular company's CO equipment is being used. For example, in most of Silicon Valley the magic number is 760 although at least one town (can't remember which) uses 890 More trivia: Most CO's have various service numbers that the linemen can dial (from your instrument) to check your level, etc. If your exchange is 656, for example, you might find that dialing 656-0020 gets you a pulsing 1004 Hz. tone. It will have been at 0 db at the CO; any less is the loss in your line. There are also numbers that give you a terminated line (good for balancing bridges) and a sweep tone. No, it is *not* illegal for you to dial any of these; they exist so that people who know what they're doing can make adjustments to (for example) audio conferencing equipment. (and, of course, primarily for the telco service people) Anyway, try numbers of the form XXX-00YZ where XXX is your exchange, Y is some digit 1-9 (usually low), and Z selects the particular test function (so usually Z can only be 0-3). Enjoy! -- Robert Bickford {lll-crg,hplabs}!well!rab terrorist, cryptography, DES, drugs, cipher, secret, decode, NSA, CIA, NRO. The above is food for the NSA line eater. Add it to your .signature and you too can help overflow the NSA's ability to scan all traffic going in or out of the USA looking for "significant" words. (This is not a joke, sadly.)
larry@kitty.UUCP (12/25/86)
In article <2247@well.UUCP>, rab@well.UUCP (Bob Bickford) writes: > > Here's a bit of phone trivia that works in some places. Dial > > 958 and many times you get a generated voice telling you the number > > you are DIALING from. > > Of course, this depends on what particular company's CO equipment > is being used. For example, in most of Silicon Valley the magic > number is 760 although at least one town (can't remember which) uses 890 The particular test line being described is generally referred to as ANAC (Automatic Number Announcement Circuit), and is usually found only in larger metropolitan central offices. The primary purpose of ANAC is to aid craftspersons who work on the main distributing frame (MDF) _within_ the central office, although there is some benefit for outside plant use. There are various implementations of ANAC, including one or more of the following: 1. Dialing a three-digit access code causes the number to be announced over a loudspeaker located at the CO MDF; the person dialing the acess code hears _nothing_ over the telephone circuit. 2. Dialing a three-digit access code _followed_ by the seven-digit directory number. A correct match of dialed number and actual directory number results in an acknowledgement tone (usually a combination of high tone and busy tone). An _incorrect_ match can be optioned to return an announcement of the actual number OR be switched to a person within the CO to challenge who is using the circuit (n.b. for would-be telephone hackers). 3. Dialing a three-digit access code which immediately provides an announcement over the telephone circuit. This unrestricted implementation has generally been considered a "security" problem (use your imagination) by telephone company management; I am somewhat surprised to see people posting articles reporting the implementation of unrestricted ANAC. > More trivia: Most CO's have various service numbers that the > linemen can dial (from your instrument) to check your level, etc. > If your exchange is 656, for example, you might find that dialing > 656-0020 gets you a pulsing 1004 Hz. tone. It will have been at > 0 db at the CO; any less is the loss in your line. You are referring to milliwatt test lines which provide a 1,000 Hz signal at 0 dBm (1 mw) into a 900 ohm termination. Some milliwatt test lines provide a continuous tone; others have 9 seconds of tone followed by 1 second of silence (with or without answer supervision). A word of caution concerning the use of milliwatt test lines: if you don't know what you are doing and don't have the proper test equipment, you will be fooling yourself with incorrect measurements. You need to properly terminate your telephone line at 900 ohms, and make the measurement with an electrically isolated meter. If the 900 ohm termination does not pass DC, then you will have to use a high-impedance holding coil to keep the circuit established while making the measurement. An actual telephone set is NEVER connected to the line while making the measurement (although it can be used for dialing, provided the circuit is transfered to a holding coil during the measurement). Note that I said the termination impedance is 900 ohms and NOT 600 ohms. End office termination impedances (i.e., like your telephone) are ALWAYS 900 ohms. Toll offices and intertoll trunks are 600 ohms. Most dedicated data lines and 4-wire private lines are also 600 ohms. There is a slight but definite error if 600 ohms is used for subscriber loop transmission measurement. > There are also numbers that give you a terminated line (good > for balancing bridges) and a sweep tone. Almost all CO's provide three "quiet lines" for noise measurement purposes and repeater test purposes: (1) a balanced termination; (2) an open-circuit termination; and (3) a short-circuit termination. The latter two lines are primarily used to test negative impedance repeaters for noise and "singing". It is useless to attempt any noise measurement unless (1) you are certain what type of termination you have dialed; (2) you have a proper noise measurement test set (which reads in dBRN, among other things); and (3) you know what you are doing. The test line that gives a "sweep tone" is called a "loop checker" test line. The amplitude of the tone is NOT constant over the swept frequency range. This test line is only useful if you have a loop checker test set with a properly calibrated meter scale. <> Larry Lippman @ Recognition Research Corp., Clarence, New York <> UUCP: {allegra|bbncca|decvax|nike|rocksanne|watmath}!sunybcs!kitty!larry <> VOICE: 716/688-1231 {hplabs|ihnp4|mtune|seismo|utzoo}!/ <> FAX: 716/741-9635 {G1,G2,G3 modes} "Have you hugged your cat today?"
rab@well.UUCP (Bob Bickford) (12/27/86)
In a previous article Larry Lippman writes: > Dialing a three-digit access code which immediately provides an > announcement over the telephone circuit. This unrestricted > implementation has generally been considered a "security" problem > (use your imagination) by telephone company management; I am > somewhat surprised to see people posting articles reporting the > implementation of unrestricted ANAC. Why? I'm afraid my imagination does not present me with any compelling reason to belive this a 'security risk'. Certainly it is of little or no use to a telco cracker. [context deleted] > You are referring to milliwatt test lines which provide a 1,000 Hz > signal at 0 dBm (1 mw) into a 900 ohm termination. Some milliwatt test > lines provide a continuous tone; others have 9 seconds of tone followed by > 1 second of silence (with or without answer supervision). Ours are 8 seconds and 2 seconds; the tone by the way is 1004 Hz and NOT 1000 Hz. > A word of caution concerning the use of milliwatt test lines: if > you don't know what you are doing and don't have the proper test equipment, > you will be fooling yourself with incorrect measurements. Quite true. We wasted several weeks working on the audio portion of our video conferencing system when I was at Vitalink Communications. Finally we purchased a Halcyon tester (don't recall model #) and stopped listening to the linemen who kept insisting that the line was a 600 ohm line. [some text deleted] > Note that I said the termination impedance is 900 ohms and NOT > 600 ohms. End office termination impedances (i.e., like your telephone) > are ALWAYS 900 ohms. Toll offices and intertoll trunks are 600 ohms. > Most dedicated data lines and 4-wire private lines are also 600 ohms. > There is a slight but definite error if 600 ohms is used for subscriber > loop transmission measurement. Only about a dB (or less), but enough to give you the screaming fits if you know what the measurement "is supposed to be". > > There are also numbers that give you a terminated line (good > > for balancing bridges) and a sweep tone. > > Almost all CO's provide three "quiet lines" for noise measurement > purposes and repeater test purposes: (1) a balanced termination; (2) an > open-circuit termination; and (3) a short-circuit termination. The latter > two lines are primarily used to test negative impedance repeaters for > noise and "singing". > It is useless to attempt any noise measurement unless (1) you are > certain what type of termination you have dialed; (2) you have a proper > noise measurement test set (which reads in dBRN, among other things); and > (3) you know what you are doing. That's strange, we seem to only have one variety of quiet line around here, and that's the terminated one. (Compare measurements on it with measurements made on a call to a known quiet set, such as another of our conferencing systems in 'mute' mode, and it's almost identical, certainly not 6dB off.) > The test line that gives a "sweep tone" is called a "loop checker" > test line. The amplitude of the tone is NOT constant over the swept > frequency range. I did not say it was, it is merely interesting. > Larry Lippman @ Recognition Research Corp., Clarence, New York -- Robert Bickford {hplabs, ucbvax, lll-lcc, ptsfa, msudoc}!well!rab terrorist cryptography DES drugs cipher secret decode NSA CIA NRO IRS coke crack pot LSD russian missile atom nuclear assassinate libyan RSA The above is food for the NSA line eater. Add it to your .signature and you too can help overflow the NSA's ability to scan all traffic going in or out of the USA looking for "significant" words. (This is not a joke, sadly.)
king@kestrel.ARPA (Dick King) (12/27/86)
Posting-Front-End: GNU Emacs 18.32.5 of Fri Dec 26 1986 on kestrel (berkeley-unix) In article <2263@well.UUCP> rab@well.UUCP (Bob Bickford) writes: Path: kestrel!labrea!decwrl!decvax!ucbvax!ucbcad!ames!lll-lcc!ptsfa!well!rab From: rab@well.UUCP (Bob Bickford) Newsgroups: comp.dcom.modems Summary: 900 ohms , ANAC Date: 27 Dec 86 11:01:22 GMT References: <750@sdcc12.ucsd.EDU> <1706@sunybcs.UUCP> <722@cooper.UUCP> <1498@kitty.UUCP> Distribution: na Organization: Whole Earth Lectronic Link, Sausalito, CA Lines: 77 In a previous article Larry Lippman writes: > Dialing a three-digit access code which immediately provides an > announcement over the telephone circuit. This unrestricted > implementation has generally been considered a "security" problem > (use your imagination) by telephone company management; I am > somewhat surprised to see people posting articles reporting the > implementation of unrestricted ANAC. Why? I'm afraid my imagination does not present me with any compelling reason to belive this a 'security risk'. Certainly it is of little or no use to a telco cracker. I can think of one. If someone wants to tap your line, he can find it more easily, further from your house. For example, it would be possible for him to do about an hour's work at a junction box. > Larry Lippman @ Recognition Research Corp., Clarence, New York -- Robert Bickford {hplabs, ucbvax, lll-lcc, ptsfa, msudoc}!well!rab terrorist cryptography DES drugs cipher secret decode NSA CIA NRO IRS coke crack pot LSD russian missile atom nuclear assassinate libyan RSA The above is food for the NSA line eater. Add it to your .signature and you too can help overflow the NSA's ability to scan all traffic going in or out of the USA looking for "significant" words. (This is not a joke, sadly.) -dick
larry@kitty.UUCP (Larry Lippman) (12/28/86)
In article <2263@well.UUCP>, rab@well.UUCP (Bob Bickford) writes: > > Dialing a three-digit access code which immediately provides an > > announcement over the telephone circuit. This unrestricted > > implementation has generally been considered a "security" problem > > (use your imagination) by telephone company management; I am > > somewhat surprised to see people posting articles reporting the > > implementation of unrestricted ANAC. > > Why? I'm afraid my imagination does not present me with any > compelling reason to belive this a 'security risk'. Certainly it > is of little or no use to a telco cracker. Well, I guess I have to spell it out... The availability of ANAC at any outside plant location (like cross-connect terminal) is of significant value to anyone bent upon unlawful wiretapping. Telephone company security personnel are always concerned about unauthorized persons obtaining any information with respect to subscriber line pair identity and circuit routing. In fact, in New York State it is a specific criminal offense (Penal Law 250.30) for an "unauthorized" person to obtain "information concerning identification or location of any wires, cables, lines, terminals or other apparatus used in furnishing telephone or telegraph service". Since people are reporting unrestricted ANAC in California, perhaps life there is more permissive. :-) > > You are referring to milliwatt test lines which provide a 1,000 Hz > > signal at 0 dBm (1 mw) into a 900 ohm termination. Some milliwatt test > > lines provide a continuous tone; others have 9 seconds of tone followed by > > 1 second of silence (with or without answer supervision). > > Ours are 8 seconds and 2 seconds; the tone by the way is 1004 Hz > and NOT 1000 Hz. Traditionally, the milliwatt reference frequency was 1,000 Hz, and still is 1,000 Hz in many central offices (especially those that are still electromechanical). Interestingly enough, the milliwatt reference frequency has been changed in some areas to 1,004 Hz because of small measurement errors which occur when measuring through PCM (i.e., digital) CO's or transmission (T-carrier) facilities. The reason is that 1,000 Hz is an even divisor of the 8,000 Hz PCM sampling rate, and any frequency within say 1 Hz of 1,000 Hz exhibits erratic results (to a minor degree, however) during measurement. > > A word of caution concerning the use of milliwatt test lines: if > > you don't know what you are doing and don't have the proper test equipment, > > you will be fooling yourself with incorrect measurements. > > Quite true. We wasted several weeks working on the audio portion of > our video conferencing system when I was at Vitalink Communications. > Finally we purchased a Halcyon tester (don't recall model #) and > stopped listening to the linemen who kept insisting that the line was > a 600 ohm line. There is a good moral to be learned here: Don't ever accept as gospel any transmission-related information given by telephone company craftspersons (also salespersons!) - either get it from someone that you _know_ is an engineer, or measure it yourself. Not that I have anything against non-engineers, but many telephone company craftspersons just follow orders and directions, with little or no understanding beyond that. For example, even a craftsperson using a TTS to make transmission measurements will have _explicit_ instructions how to set the controls on his TTS and then get a meter reading - but more often than not, will have no idea why the TTS is operated as he has it configured. > > Almost all CO's provide three "quiet lines" for noise measurement > > purposes and repeater test purposes: (1) a balanced termination; (2) an > > open-circuit termination; and (3) a short-circuit termination. The latter > > two lines are primarily used to test negative impedance repeaters for > > noise and "singing". > > That's strange, we seem to only have one variety of quiet line around > here, and that's the terminated one. You might not know the numbers for the others. Actually, there may be TWO lines with balanced terminations (in addition to one for open-circuit and one for short-circuit). Many CO's use a CLA (combined loop-around) for a milliwatt test line. The CLA uses two sequential numbers (common example 9911 and 9912 applied to New York Telephone) which work as follows: 1. Dialing _only_ the 9911 number gives you milliwatt tone. 2. Dialing _only_ the 9912 number gives you a balanced termination. 3. Dialing _both_ 9911 and 9912 gives you a bridged connection between the two lines whose insertion loss is the typical CO switching loss (usually well under 1.0 dB). This is referred to as "loop-around" mode, and is used for remote transmission measurements to and from a CO; its primary purpose is to test interoffice trunks, and it has no usefulness for subscriber loop meqsurements. Many newer CO's have a speech energy detector on the CLA which drops the connection if _other_ than SF tones are sent in loop-around mode; this has been implemented to stop "unauthorized" people from using the CLA for talking. So, in addition to the balanced termination available through the CLA, most CO's still have a short-circuit termination (typical 9954 suffix for New York Telephone), an open-cicruit termination (typical 9955) and another balanced termination (typical 9956). Note that in addition to a milliwatt line being available through the CLA (9911 as above), there is usually a dedicated milliwatt line (typical number is 9910). There is generally an important distinction between this apparent duplication of test lines: the CLA is used primarily for interoffice trunk measurements, so its impedance is 600 ohms - whereas all of the other lines have 900 ohm impedance. <> Larry Lippman @ Recognition Research Corp., Clarence, New York <> UUCP: {allegra|bbncca|decvax|nike|rocksanne|watmath}!sunybcs!kitty!larry <> VOICE: 716/688-1231 {hplabs|ihnp4|mtune|seismo|utzoo}!/ <> FAX: 716/741-9635 {G1,G2,G3 modes} "Have you hugged your cat today?"
wb8foz@ncoast.UUCP (12/29/86)
# a CO; its primary purpose is to test interoffice trunks, and it has
# no usefulness for subscriber loop meqsurements. Many newer CO's have
# a speech energy detector on the CLA which drops the connection if
# _other_ than SF tones are sent in loop-around mode; this has been
# implemented to stop "unauthorized" people from using the CLA for
# talking.
A bit of historic trivia. Many of the loop-arounds never used to terminate
and thus never started the calling end's billing timer. Thus they were used
by many persons to provide 'free'LD. Needless to say, Ma was not happy to
find that happening. The same was true on dispatch circuits. These were
groups of # for the outside craftpeople to call in on for the next assignment.
They were dropped into the conference with the dispatcher, and they got their
nickle, (oops) dime (oops) quarter (oops) ..... back from the coin slot when
they hung up.
When Esquire hit the streets in the 60's, everything was changed. But one of
my friends hit on an solution. By prearrangement, he called one side of
a local loop and waited. His brother called the other, collect from a
coin slot in a Big 10 dorm (not his). "Of course, I will accept the charges"
I always wondered which BOC got stuck.
--
decvax!cwruecmp!ncoast!wb8foz
ncoast!wb8foz@case.csnet
(ncoast!wb8foz%case.csnet@csnet-relay.ARPA)
"SERIOUS?
Bones, it could upset the entire percentage!"
NRO Mossad intercept igniters plutonium Ollie North Tehran johnl@ima.UUCP (John R. Levine) (12/30/86)
In article <1502@kitty.UUCP> larry@kitty.UUCP (Larry Lippman) writes: >In article <2263@well.UUCP>, rab@well.UUCP (Bob Bickford) writes: >> > Dialing a three-digit access code which immediately provides an >> > announcement over the telephone circuit. ... > > Well, I guess I have to spell it out... The availability of ANAC >at any outside plant location (like cross-connect terminal) is of significant >value to anyone bent upon unlawful wiretapping. ... Dialing 1-200-55
rab@well.UUCP (Bob Bickford) (12/31/86)
In a previous article Larry Lippman writes: > Well, I guess I have to spell it out... The availability of ANAC > at any outside plant location (like cross-connect terminal) is of significant > value to anyone bent upon unlawful wiretapping. Telephone company security > personnel are always concerned about unauthorized persons obtaining any > information with respect to subscriber line pair identity and circuit > routing. In fact, in New York State it is a specific criminal offense > (Penal Law 250.30) for an "unauthorized" person to obtain "information > concerning identification or location of any wires, cables, lines, terminals > or other apparatus used in furnishing telephone or telegraph service". Well, here I am with mud on my face. That *is* just a bit obvious... Listen, and I particularly direct this to the silent readers out there, whether or not it is illegal, using this information in this way is quite clearly wrong. I know there are laws in California against using telephone equipment to commit a prank, AND there are laws against tapping people's phones. Don't do it. If you use this info, it had better be for a legitimate reason, and it would help a great deal if you know what you're doing. > Interestingly enough, the milliwatt reference frequency has been > changed in some areas to 1,004 Hz because of small measurement errors which > occur when measuring through PCM (i.e., digital) CO's or transmission > (T-carrier) facilities. The reason is that 1,000 Hz is an even divisor of > the 8,000 Hz PCM sampling rate, and any frequency within say 1 Hz of 1,000 > Hz exhibits erratic results (to a minor degree, however) during measurement. I knew this; the assumption I was making (which I gather was invalid) was that almost all of the country had switched. I do know that none of our field service people complained of the meter reading 1000 instead of 1004; but perhaps they thought it didn't matter (which I guess it doesn't).
berger@datacube.UUCP (12/31/86)
>Dialing 1-200-555-1212 reads you back your phone number in most New England
Doesn't work in Peabody Ma. exchange 617-535
Bob Berger
Datacube Inc. 4 Dearborn Rd. Peabody, Ma 01960 617-535-6644
ihnp4!datacube!berger
{seismo,cbosgd,cuae2,mit-eddie}!mirror!datacube!bergerhartley@uvm-gen.UUCP (Stephen J. Hartley) (12/31/86)
< Keywords: ANAC wire-tapping
< Summary: 200-555-1212 give you ANAC most places in New England
<
< Dialing 1-200-555-1212 reads you back your phone number in most New England
< Telephone exchanges I've tried, in several states.
<
I tried it in Vermont, and sure enough it worked!
--
Department of Computer Science and Elec. Eng. Stephen J. Hartley
USENET: {decvax,ihnp4}!dartvax!uvm-gen!uvm-cs!hartley University of Vermont
CSNET: hartley%uvm@csnet-relay (802) 656-3330, 862-5323larry@kitty.UUCP (Larry Lippman) (01/02/87)
In article <1879@ncoast.UUCP>, wb8foz@ncoast.UUCP (David Lesher) writes: > A bit of historic trivia. Many of the loop-arounds never used to terminate > and thus never started the calling end's billing timer. Thus they were used > by many persons to provide 'free'LD. Needless to say, Ma was not happy to > find that happening. ... But one of > my friends hit on an solution. By prearrangement, he called one side of > a local loop and waited. His brother called the other, collect from a > coin slot in a Big 10 dorm (not his). "Of course, I will accept the charges" > I always wondered which BOC got stuck. One of the simplest methods of toll fraud during the late 60's to mid 70's (when this sort of fraud peaked) was to place a collect call to a coin telephone. Both parties would use coin telephones by prearrangement; this made it rather difficult for the telephone company to locate the perpetrators since no person's actual telephone was ever used. By convention, most coin telephones have their last four digits begin with the digit 9 followed by 6, 7, 8, or 9 (e.g., NNN-96XX, NNN-97XX, etc.). Of course, legitimate business and residence telephone numbers also follow the above numbering plan. In an effort to combat the above toll fraud problem during the 70's, if a telephone company operator received a collect call request for a number fitting the above pattern, they would usually check with directory assistance in the destination city to see if the number is a coin telephone before completing the call (this would usually be done while the calling party listened). This was of particular personal annoyance to me. During the early 70's I was involved with a project that set up telemetering and remote control for unattended petroleum company pipeline pumping stations. At the time, I was dealing with telephone company personnel at about 30 locations in 6 states in order to get data lines installed (among other things, I was responsible for specifying all of these data circuits). It was standard practice to call the telephone company locations collect. Since many telephone company business and plant locations have telephone numbers that also fit the above calling number pattern, you will never believe how many hours I wasted listening to operators "check out" the numbers of my collect calls! [It didn't seem to mean anything to the operators that I was calling _from_ an easily verified business number - they still checked out the called number...] <> Larry Lippman @ Recognition Research Corp., Clarence, New York <> UUCP: {allegra|bbncca|decvax|nike|rocksanne|watmath}!sunybcs!kitty!larry <> VOICE: 716/688-1231 {hplabs|ihnp4|mtune|seismo|utzoo}!/ <> FAX: 716/741-9635 {G1,G2,G3 modes} "Have you hugged your cat today?"
hes@ecsvax.UUCP (Henry Schaffer) (01/04/87)
In article <472@uvm-gen.UUCP>, hartley@uvm-gen.UUCP (Stephen J. Hartley) writes: > < Keywords: ANAC wire-tapping > < Summary: 200-555-1212 give you ANAC most places in New England ... > I tried it in Vermont, and sure enough it worked! > -- > Department of Computer Science and Elec. Eng. Stephen J. Hartley Not in Raleigh, NC. --henry schaffer
ken@argus.UUCP (Kenneth Ng) (01/05/87)
In article <102000001@datacube>, berger@datacube.UUCP writes: > > >Dialing 1-200-555-1212 reads you back your phone number in most New England > > Doesn't work in Peabody Ma. exchange 617-535 > Bob Berger Nor does it work in Newark New Jersey: 201-596 > ihnp4!datacube!berger > {seismo,cbosgd,cuae2,mit-eddie}!mirror!datacube!berger -- Kenneth Ng: Post office: NJIT - CCCC, Newark New Jersey 07102 uucp !ihnp4!allegra!bellcore!argus!ken *** WARNING: NOT ken@bellcore.uucp *** bitnet(prefered) ken@orion.bitnet Gillian: "Are you sure you won't change your mind?" Spock: "Is there something wrong with the one I have?"
kre@munnari.oz (Robert Elz) (01/05/87)
> > >Dialing 1-200-555-1212 reads you back your phone number in most New England > > Doesn't work in Peabody Ma. exchange 617-535 > Nor does it work in Newark New Jersey: 201-596 It doesn't work in Melbourne Australia either... (nb: please read the Summary header line, that's where the message is). kre
gold@cdx39.UUCP (Mark Goldstein x7004) (01/09/87)
The 1-200-555-1212 does not work in Walpole, MA 617-668...
Mark Goldstein
Codex Corporation, Motorola Information Systems Group, Canton, MA
path: ...{mit-eddie,harvax,inmet,rclex,adelie,mot}!cdx39!goldaditya@utx1.UUCP (01/27/87)
Does not work in Florida as well
--
Aditya N. Mishra | *** Standard disclaimer applies.
Racal-Milgo | *** Copy available on request from :-
P.O.Box 407044 (MS E112) | USENET:..{allegra|codas}!novavax!utx1!aditya
Fort Lauderdale, FL 33340 | Phone : 305-476-6552