Faith Issue 12 - PSTS information gathering, TACS - Customer Line Testing on Digital Exchanges, Meridian PBX remote administration, Cellular phone tracking, and Overview of digital CCITT system 5.
bd12e1ae9ef765a93161b7696f9db64a3a24e0b7367089a6695362588bb8c688
[ D4RKCYDE ]
yyyyyssssyyyy yyyyssssyyyy yyyy yyyy
|lS$$ yy $$$$ """" yy lS$$ S$$$ S$$$$$ $$$$$ S$$$ssssyyyy
:|lS$ ""yyyyy yyyyssss|lS$ lS$$ lS$$ yy$$$$$ lS$$ yy lS$$
:||lS$$ $$$$$ :|lS yy :|lS |lS$ |lS$ $$ yyyy |lS$ $$ |lS$
:::|l ,$$$$$ ::|l $$ ::|l :|lS :|lS $$ :|lS :|lS $$ :|lS
::::| $$$$$$ :::| $$ :::| ::|l ::|l $$ ::|l ::|l $$ ::|l
.:::: ....... .:::....:::: .::| ..:|....:::| .::| .. .::|
[ F41TH ISSUE 12: FEB 2OOO ]
... http://f41th.com ....
.
:
:
|
+-------> hybrid @f41th.com <-------+ http://hybrid.dtmf.org
+-------> zomba @f41th.com <-------+ http://zomba.org
+-------> jasun @f41th.com <-------+ http://fatality.co.uk
+-------> shadowx @f41th.com <-------+ http://f41th.com/~sx
+-------> force @f41th.com <-------+ http://f41th.com/~force
+-------> downtime @f41th.com <-------+ http://f41th.com/~dt
+-------> shylock @f41th.com <-------+ http://f41th.com/~shy
+-------> digiphreq @f41th.com <-------+ http://f41th.com/~digi
|
:
.
+-------> FIND US ON THE PSTN B1TCH. #darkcyde efnet.
:
:
.
.
==============================================================================
9x, b4b0, prez, loophole, ep1d, tip, jimjones, gr1p, guidob, dynamics,
datawar, crypt, reb, type0, skyper, w1cked, siezer, oeb, psyclone, is.
R E S P E K T. I N I I T.
==============================================================================
Welcome to f41th issue 12, this month hosted by me(hybrid)!. This issue is
kind of small compared to the previous issues, but heh, wait until you see
f41th 13.. we are planning a one-off complete oday issue.. so keep any eye
on f41th.com for updates. I'd like to say thanks to the krew at dtmf.org
for hosting f41th.com and to all the ppl mirroring f41th on their sites,
werd. I dont really know what to say in this editorial, so I will keep
it short. Some of the articles in this issue are a bit "risky" -- taken
from the elite f41th oday archives at darkcyde HQ, we know you fear.
later. -hybrid.
M A I L B 4 G
===============================================================================
From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 18:59:49 2000
Delivered-To: hybrid@dtmf.org
Subject: press inquiry
I am a journalist on The Sunday Times, London, and am researching an article
on cracking/hacking. Please could you give me a call on 011 44 171 782 5686
(From US) or 0171 782 5686 (from UK). Alternatively, pse could you email me
a number and I will call you.
Thanks.
Jon Ungoed-Thomas
===============================================================================
From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:00 2000
Delivered-To: hybrid@dtmf.org
Subject: RE: press inquiry
Very interested in talking to you - as soon as possible, really.
I am on 0171 782 5686 or 07771 536255.
Thanks.
===============================================================================
From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:10 2000
Delivered-To: hybrid@dtmf.org
Subject: RE: press inquiry
Got your email address on google search on internet under search terms
satellite and hacking. Would you be able to call me today? I am in the
office. Thanks.
===============================================================================
From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:19 2000
Delivered-To: hybrid@dtmf.org
Subject: RE: press inquiry
Hybrid, still waiting for your call...
===============================================================================
R E M O T E I N F O R M A T I O N I N T E R C E P T I O N
===============================================================================
. .
___::http://_:::hybrid.DTMF:___::org::___::___::::
/ || || |_| __ || || || _|| || | | |
| :__|| |:_ | | : :: | || |:_ |/ |
| : \ | | _ | __:|: _::_ | |: | | --:
--<_____ |___ |_|__\____||_ ||_ ||_ ||____ |_|\__>--
|/ |/:::BL4CKM1LK:|/ |/:: |/::@%$!|/
: : : : : :
. . . .
Remote Information Interception Over The International PSTN.
A Very Brief Overview of Remote Telecommunications "Spying".
by hybrid <hybrid@DTMF.ORG> <hybrid@f41th.co.uk>
===============================================================================
In this article I will discuss various "information gathering" techniques
which can be covertly deployed, implementing the PSTN as a trojan. I'm not
going to discuss the standard "microfone in the wall" scenarios because
that is to obvious, the basis of this article is that no-one needs to
actually break into your house and place some bullshit listening device in
a coffee mug, they dont need to. Nearly every single premisis on this
planet has some kind of telecommunications equipment installed, if someone
was to "bug" you, the harware needed to carry out such a task is allready
in place.. (The Subscriber Loop), think about it, what is a standard
domestic phone line? -- In most casess its a pair of copper wires going
into a persons home and back to the local exchange, frame point, creating
a loop. To break things down even more.. what is on the customer
terminating end of that bundle of copper wires? -- A Microphone and A
Speaker, (Transmission). If you dont know much about electronics, or have
no common sense, you'll probably be thinking, "big deal"... Well, the
point is that a telephone speaker can be turned into a micophone when in
idle state by reversing the circuit of the customer loop, essencially
becoming a room bug when you place the handset down. Now this is just a
VERY simple example of what I am going to discuss in this article.
To begin with, I'll list some of the most likely "targets" for a digital
sniper.
========================================+=======================================
WHO/WHAT | WHY
========================================|=======================================
Scientific Research | Depending on the level of
| "research" some entitys may wish
| to have detailed knowledge of
| just what the other entitys are
| doing, usually when some kind of
| academic competition is
| concerned, and depending on the
| level of scientific research.
========================================|=======================================
Diplomatic Internal Government | People/Organisations that are
| involved in any government work
| are likely targets to "buging"
| usually in the interests of
| intellegence gathering on the
| other-side's part. Worldwide
| governments percieve it as
| imperitive to possess knowledge
| of what other governments are
| upto, right down to the smallest
| detail.
========================================|======================================
Business People/Organisations | Its common knowledge that
| competing companys like to know
| what the opposition is upto, and
| what strategic advantage they
| may have. In this case financial
| reasons are usually the
| foundation.
========================================|======================================
Crime "Suspects" | Usually when law agencies
| suspect some kind of organised
| crime, or need more evidence
| they will use resources to
| gather information. Very
| obvious, if someone's down with
| somthing, they are a target to
| this activity.
========================================|======================================
Attorneys | These people will do anything to
| know what the "opposition" has
| up their sleve. They'll bug each
| other, aswell as clients.
========================================+======================================
The list could go on forever.. The main basis is, if A wants to know what
B is doing, they'll try their best to find out somehow, and vise versa. It
could be any scenario. Now, I'm not going to drift out of the scope of
this article, because the idea is to discuss how someone can be "buged"
just by using the PSTN and nothing more. Now, the scary thing is, a single
person with a telephone can be just as "dangerous" than a fully trained
covert "spy" with a briefcase full of 007 warez..
To emphasise and explain this, I'm going to set up two scenarios. The
first scenario is domestic, the second is more business based. We'll start
with the first scenario and suppose that "Mr A" is the target, and "Mr B"
is the sniper. Mr B has no purpose or has no reason to spy on Mr A, he
just feels like it.. to make things a little more interesting, Mr A (the
target) lives in Virginia (703) and Mr B (the sniper) lives in another
country, lets say, England (+44).
To save me writting a big essay, I'll list some of the more effective
methods that Mr B could implement in order to gather as much information
about mr A as possible (using a telephone and nothing more)
================================+==============================================
OBJECTIVE | ACTION
================================|==============================================
Find out Mr A's Contacts | Telephone Records/Bills: who does mr A
| Call? Examining Mr A's most commonly
| called numbers would reveal a great deal
| about his activitys, perhaps even more
| effective than simply listening to his
| telephone conversations. Essentialy an
| entire profile could be built up on
| someone just by looking at their
| phone records: ie: what taxi companys
| they use, when and what time they go
| out, what kind of food they like, etc.
| Telephone records are considered
| sensitive information for this matter,
| but can be obtained by customer request
| (fax) or someone in the phone
| company(BOC) requesting to view them for
| billing purposes. Customer records are
| also kept in an array of databases
| concerning the maintanance of a local
| exchange. See * Note.
================================|==============================================
Monitor Mr A's Calls (realtime) | Perhaps slightly more elaborate, but
| easily achieved. Mr A's line information
| can be modifyied at the local switching
| office to induce a number of occurances.
| Using ManMachineLanguage, a subscriber
| line can be setup to trigger an
| automatic conference call with a "silent
| number" whenever mr A pics his phone up.
| Aswell as this, a subscriber trunk can
| be configured to loop to 2 POT lines
| (similtaniously), ie: routed to Mr A,
| aswell as a loopline (which can be
| remotely dialed into). Mr B could
| effectivly "sit on the trunk".
================================|==============================================
Audibly Monitor Mr A's House | The simple scenario would be that Mr A
| has an AnswerPhone, which in most casess
| would have a remote-room monitor
| function built into it. Believe it or
| not, these kind of answerphones DO
| EXIST! It's a gimic built into an
| answerphone that allows a person to
| phone there own number when they are
| away from there house, plug in the 2
| digit answerphone code, and then be
| presented with a menu such as "1. listen
| to messages, 2. record OGM, 3. room
| monitor".. So they can check out what is
| going on in there house while they are
| away. The scary thing is, these
| answerphones have 2 digit passcodes,
| which are plugged in while the OGM
| occurs, an answerphone can also be
| remotely switched on/off by ringing it
| 10 times and hanging up and calling
| back. Using this "room monitor" function
| Mr B can do just that.. monitor audible
| room activity. See * Note for the more
| plausable method.
================================|==============================================
Find Additional Information | The most common threat to any subscriber
| to the phone company is the fact that
| RBOCs hold detailed account information
| concerning their customers, which can be
| obtained for reference by an "engineer"
| or such.. for example, one piece of
| information leads to another, ie: the
| customers prefered method of paying the
| IXC bill will lead to bank details and
| from there, credit details and status,
| to social security information.
================================+==============================================
* Taken from (http://www.tscm.com) A very interesting site.
"A Soft Wiretap, is a modification to the software used to run the phone
system. This can be done at the telephone company, or in the case of a
business, the PBX. A soft wiretap is a preferred method to tap a phone,
easy to catch on a PBX, but tough to find in the phone company's system.
(It is sometimes called a REMOBS, ESS, or translation tap). This type of
tap is very popular with large law enforcement agencies, larger
corporations, and with hackers who find it quite simple to gain access via
maintenance software."
So, in my lame example, Mr B now has a FULL background on Mr A, just by
using his telephone. In the next scenario, we'll consider that Company A
wants internal information on the workings of Comany B. It is important to
take into acocunt that companys are very secretive when it comes to the
internal workings/operations of the company concerned, due to the simple
fact that any informational leaked from that particular company could
prove bennificial to their compitors. Therefore, most companys that
operate strategic buisness plans etc, will go to great lenghts to
safegaurd that backbone or inter workings of their companys workforce, ie:
the securing of database systems and accounts, employee information. The
problem is the more security that is implememented, the harder it can be
for a legitiamte company employee to access data, therfore this decreses
work efficiancy. However, it is important that a company locks down on the
availability of there companys internal workings, as in some cases, a leak
to a competitor could result in colosal financial loss.
I remember reading somewhere that the biggest security hole/weakness in
ANY network is not the network itself, but the people that interact with
it. A machine cannot be psycologicaly stered to do somthing over the
telephone, a person can. A company with a workforce that is un-educated to
the risks of information leaks can be a very vulnerable target to anyone
wishing to gain such information. Particualry vulnerable are lower-level
employees, who may hold a lower level of respect to the workings of the
company than an employee who has a close relationship with the hiearchial
workings of a company.
I believe that the biggest (and commonly overlooked) security flaw in any
company, is the companys internal phone system, PBX and Voicemail
networks. Employees are given the sense that a company voicemail system is
for "employees only" and therefore see fit to discuss company sensitive
matters on such systems. Most employees are un-aware that they are able to
remotely check their voicemail from home, they just use it to COMMUNICATE
with other members of the company, to the standard employee, they tend to
build up a mental image that the internal Voicemail system is just "one
big answerphone", and that is all they will ever need to know about it.
I have yet to see a Voicemail system that CANNOT be accessed via an
external line. The fact is, voicemail is designed to be an asset to the
internal communication of the company, and therfore must be remotely
accessable, which in its own sense is the biggest security hole. A typical
voicemail system will handle thousands of internal/external messages every
working day, and STORE them all on backup devices, digital or tape driven.
Most employees dont care for the security of the "work" voicemailboxes,
simply because it's "work" and just that, it does not concern them on a
personal level, so users tend to be lazy with passcodes (they dont even
need one to access voicemail from their workphones).
Now, lets suppose that Company A hold an interest in how Company B's
financial status. Remotely "they" can dial into Company B's PBX, probably
a listed number, get an automated recording, then find the Voicemail login
prompt by trying a few well-known numerical login patterns, ie: *# (octel)
*81 (meridian) *7 (audix).. or in alot of cases, the employee VoiceMail
login menu option will be presented in the IVR menu at the dialin prompt.
Once prompted to login, Company A could be essentially stealthing through
the entire of company B's voicemail system in seconds.. picking up contact
numbers, account information, financial status, ideas etc along the way.
A "sophisticated" method would involve a slightly higher aim than just
intercepting emplopyee voicemail. All voicemail and pbx networks have to
be administered by someone 24 hours a day, and therefore all have remote
administration capabilitys. A few things to note, all voicemail messages
varying from system to system are backed up on storage mediums, digital or
analouge, and can be remotely downloaded for "audit" purposess. A
potential spy, could in essance download the entire pbx database for the
company they have interests in, ie: company incoming/outgoing phone
records, voice data, commonly used conference lines, etc. Another thing to
note, is that alot of companys like to use teleconferencing as a means to
communicate with remote clients etc. Usually if an employee is invited to
attend the teleconference they will be left a voicemail message from the
host containing the dialin and password information for the conference
call. Again, the possible security risks are endless, and are always
overlooked by companys.. "It's just a phone".
Anyway, I've illistrated some of the simple methods that can be used by an
intruder to remotely spy on someone/somthing. I find it very interesting
as to how such obvious things such as common-sense telecom security is
always overlooked. Even more interesting is how a large company can spend
ALOT of time and money securing and maintaining server's in fear that an
intruder could gain internal information about their company, when a
single person could pick up a telephone and filter all their companys
operations in a matter of seconds. The fact is, most administators do not
see a phone system as an imediate threat to security, and will spend
little or no time whatsover looking into securing their own phone system.
http://hybrid.dtmf.org
======================
S Y S T E M X T E S T A C C E S S S U B S Y S T E M
==============================================================================
SystemX Test Access Connection
Customer Line Testing on Digital
Exchanges. hybrid <hybrid@dtmf.org> _\'/_gBH
============================================
To allow testing of subscriber's lines, each subcriber has a Test Access
relay in their SLU. The Test Access relay can connect the subs line to a
4-wire testng circuit called a "Test Common Highway." This arrangment is
shown bellow.
SLU Line Controller
__________________________________________________ _________
___ | .______________._________________________|__| |_
| # | | | | || 2 wires | | .... |
|___|---|------O // TA1 // TA2 | |__:__:___|
subs | O O | | |
| | | .________|_____| |
| | | | |::::::::|:::::
| | | | | Switch |
| | | ____|____ | Plane >|--->>
| / 2 wires / 2 wires |_________| | |
| | | | TA2 | From the
| | | | | Module |
| | | | | Controller
| | | O -50v |
|_________|______________|_________________________|
| |
| Test | Test The Test Access Relay
| Line | Exchange =====================
:::::::::::::::::::::::::
Test Common Highway
The MC can send an instruction via the Line Controller to operate Test
Access relay (TA) in the SLU. With TA operated, the subscriber's line can
be tested via the Test Line Pair of the Test Common Highway an contact
TA1. The subscriber's line circuit can be tested via the Test Exchange
pair of the Test Common Highway an contact TA2. If "Test Line" is connected
to "Test Exchange" is is possible to monitor calls. The "Test Line" and
"Test Exchange" pairs together comprise 1 Test Common Highway.
The P-SWITCH
============
Following the Test Common Highway back from the SLU, we find it is
connected to a piece of equipment called the P-SWITCH. The P-Switch is
located in the Auxiliary Module and has 12 Test Common highways (Numbered
0 to 11) connected to it. 11 are availiable for connection to SLU's and 1
for the connection to Per Line Auxiliarys (PLA's). For design reasons,
there cannot be more than 24 SLU's connected to each Test Common Highway.
Because there are a maximum number of 8 subs per SLU, the maximum number
of subs that can be connected to 1 Test Common Highway is 24x8= 192 subs.
This means that 11 Test Common Highways can handle upto 2112 subs.
However, a Concentrator has a maximum of 2048 subs. So the Test Common
Highway is only connected to 128 subs. The Test Access relay contacts are
simply teed off its associated Test Common Highway as shown bellow.
_______________________
| _ |
| To Test Access >> _| | 4 wires
24 SLU's .. | relay contacts >> _}--|---/---.
per Test : | SLU 0 _| | |
Common ----: |_______________________| |
Highway : ___________:___________ / 4 wires
: | _ | |
: | To Test Access >> _| | | Test Access Relay
:. | relay contacts >> _}--|-------O to Test Common
| SLU 23 _| | | Highway Connections
|_______________________| | ===================
::::::::::::::::::::::::: |
_______________________ |
| _ | |
| To Test Access >> _| | | 4 wires
24 SLU's .. | relay contacts >> _}--|-------+---/---.
per Test : | SLU 24 _| | | |
Common ----: |_______________________| | |
Highway : ___________:___________ | |
: | _ | | |
: | To Test Access >> _| | | |
:. | relay contacts >> _}--|-------+-------O
| SLU 47 _| | | |
|_______________________| | |
::::::::::::::::::::::::: | / 4 wires
___________:___________ | |
| : _ | | |
Less than | To Test Access >> _| | | | 4 wires
24 SLU's .. | relay contacts >> _}--|-------+-------+---/---.
on last : | SLU 255 _| | | | |
Test ------: |_______________________| | | |
Common : | | |
Highway :. O O O
TCH/0 TCH/1 TCH/11
::::::To the P-SWITCH::::::
P-Q Links
=========
There are 12 Test Common Highway's conencted to the P-SWITCH. Connected
between the P-Switch and the Local Exchange are up to 4, 2 wire
input/output circuits, known as P-Q Links. These are controlled by the
Local Exchange PUS and can be used to test either the Line or the Exchange
side of an SLU. The way in which this is done is shown bellow.
The P-SWITCH/P-Q Link to Test Common Highway Connection
=======================================================
LineSide| 2 wires | | reed relay |
TCH/0 --------+---/-----------+---------------+---------------+------->
>>>>> --------+---/-----------+---------------+---------------+------->
ExchSide| 2 wires | | |
LineSide| | | |
TCH/1 --------+---------------+---------------+---------------+------->
>>>>> --------+---------------+---------------+---------------+------->
ExchSide| | | |
LineSide| | | |
TCH/2 --------+---------------+---------------+---------------+------->
>>>>> --------+---------------+---------------+---------------+------->
ExchSide| |(N) | |
LineSide|(M) | | |
TCH/3 --------+---------------+---------------+---------------+------->
>>>>> --------+---------------+---------------+---------------+------->
ExchSide| | | |
/ 2 wires / 2 wires / 2 wires / 2 wires
| | | |
TCH/11 --------+---------------+---------------+---------------+-------->
>>>>>> --------+---------------+---------------+---------------+-------->
| | | |
| | | |
| | | |
(0) (1) (2) (3)
:::::::::::::::::::::::::::::::::::::::::::::::::::
::::::: P-Q Links to Test Network Equipment :::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::
The connections between the Test Common Highways and the P-Q Links are
made by reed relays. These relays are controlled by the Auxilliary
Controller. (The Auxilliary Controller is part of the Auxilliary Module).
Instructions to opertate these read relays are origionated by the Test
Network Subsystem in the Local Exchange. They are then passed via MTS to
the Module Controller, which passes them on to the Auxilliary Controller.
If the reed relay marked (M) is operated, then P-Q Link 0 will be
connected to the line side pair of the Test Common Highway 3. This will
enable any of the subs connected to the Test Common Highway 3 to be
tested, simply by operating their associated Test Access relay. Similarly,
if reed relay (N) is operated, it will connect P-Q Link 1 to the Test
Common Highway 2, exchange side.
Monitoring
==========
If "Test Line" and "Test Exchange" are connected toghether, it is possible
to monitor the subs line. This is achieved by operating two reed relays on
one P-Q Link as shown bellow.
SLU Line Controller
_______________________________ _________
| _________.______/._______|_____| |
___ | | | 2 wires | | |--------------->>
| # | | : TA1 : TA2 | | ..... | To Switch Plane
|___|---|---O// //O | |__:___:__| :::::::::::::::
| | | ______|________| |
| | | | | |
| | | |(TA2) | |
| | | ___|___ | |
| / 2 wires / |_______| | |
| | | | | |
| | | O -50v | |::::::::::::::::::
|___|____________|______________| ::From the Module::
| | ::Controller:::::::
| | :::::::::::::::::::
| |
: : _________________
: : 2 wires | |
: |______/.____________|___._____________|________
: | : |
| | : P-SWITCH |
| 2 wires | / 2 wires |
|___________________/.____________|___:_____________|________
TA relay shown operated | : |
|___:_____________|
:
Monitoring The Subscriber Line :
============================== :
::: P-Q Link to Test
::: Network Equipment
RSC Connections SystemX/X Local RCU Exchange Remote Test Network
================================================================
The total resistance of the test pair between the Test Equipment and the
subscribers termination shall not exceed 2000ohms. Therefore RCU DSSS's
can also be served from the TNS in the Main Exchange via P-SWITCH in the
RCU and Q-SWITCH in the Main, providing the test pair does not exceed
2000ohmz. The prefered location of the Test Unit is to be as close as
possible to the Test Network equipment.
Exchanges built to SEP2 and SEP3 connection to RSC using Modern LTS.
====================================================================
Sub <--------x ----- x --------> Exchange
<------. | ----- | .------->
| |_______| |
|_____|_____| DSSS (Located at RCU)
| |
| |
____|_|_____
| |
| P-SWITCH |
|____________|
| |
| |
===============|=|======================================================
| |
____|_|_____
| |
| Q-SWITCH | MINI TNS (Located at RCU)
| | | |
| | | |
-----|----O-O-----|-------------O------------------O-----
| __|_|___ | ____|____ _______|_______
| |Pseudo | | | | | |
| |D/E Swt | | |R-SWITCH | | Test Network |
|_| |_| |_________| | Controller |
|_____::_| | | | |_______________|
| || Built-in Line Test ___|________ |
| || Equipment | V24 ACCESS | |
| || |____________| |
| || | |
| || | |
===============|==||================================|==========|=========
| || | |
| || | |
| Test (V24) (TNS)
Dial-Back <<..| Pair | |
via the main || | (MCS)
Exchange Switch || | | Local VDT
|| | (I/O)------>>
__||___________ | |
| | | |
| Test Unit LTS |____________________| |
|_______________| |
| ________________|
| |
| |
| (MMI ACCESS)
| |
RCU | | MAIN EXCHANGE
| __|__
| | M |
| |_____|
| |
| (V24 or X25)
| |
| |
=======================|======================|============================
| |
| |
__________|__________ __|__
| | | M |
| LTS PROCESSOR | |_____| OMC
|_____________________| |
| |________
| |
RSC | ________|_________
| |MML DIRECT ACCESS |
________ | | : |
|| ||_________| |_O/_____|_________|
||______|| (Users Terminal) | |
--oooooo-- | |
__|__ __|__
________ (SystemX Terminal) | M || M |
|| ||_________ |_____||_____| _\'/_
||______|| | | |
--oooooo-- | (V24) (V24)
_|_ | __|__
| M |________________| | M | Other Admin
|___| |_____| Users
Subscriber Line Test Codes
* Determine Switch Type
==========================
Exchange Type | SALT | FRB | CPI(EN) | CPI(DN) | LPI(EN) | LPI(DN)
==============|=======|=======|=========|=========|=========|========
| | | | | |
TXS |175/01 | | |838 (L4) | |
|175/03 |839 | |836 (L5) | |
|175 |819/174| |810/176 | |
|185 |184 | |186 | |
|183 |182 | |180 | |
|82801 |88 | |80 | |
|833802 |89 | |839 | |
|91757 |819 | |810 | |
| | | | | |
==============|=======|=======|=========|=========|=========|========
| | | | | |
TXD |175 | | |176 | |
| | | | | |
==============|=======|=======|=========|=========|=========|========
| | | | | |
TXE |175 |174 |180 |176/172 |187 |188
|188 | | |186 |188 |
| | | | | |
==============|=======|=======|=========|=========|=========|========
| | | | | |
TXE4 |175 |174 |180 |176 |187 |188
| | | | | |
==============|=======|=======|=========|=========|=========|========
| | | | | |
AXE10 |175 |174 | | | |
| | | | | |
==============+=======+=======+=========+=========+=========+========
The TXD Exchange
================
SALT TEST
=========
Dial 175.. system will announce the Customers Number (the line you are on)
Replace the reciever. Line Test Takes place. Possible delay of upto 30
seconds before ringing is recieved (ringback test). If ringing recieved OK
- if no ring fault condition announced when handset lifted. If line tests
OK "Dial Next Test" is announced followed by interrupted dial tone.
1. DIAL TEST - Dial 1.
...On DialTone:
Dial 1 through to 0 for Loop Disconnect
or 1 through to 9 * 0 for MF.
If OK "Testing OK" announced.
2. COIN PULSE TEST (POA Only) - Dial 3.
...On PayTone:
Insert coins. 1 KHz tone pulse for each coin indication.
3. SPM TEST - Dial 4.
...Supplies 20 SPM pulses (10 long, 10 short).
To exit SALT test, replace handset.
CPI TEST
========
Dial 176 followed by national number (eg 176 0171-313-3700)
1. LINE FREE - intersupted 1 KHz tone for 7 seconds. Trace tone applied to
number. Timeout after 5 minutes. If the customer attempts to make a call,
then trace tone removed and engaged tone returned to engineer. Trace Tone
reapplied if line becomes free within 5 minutes.
2. LINE SPARE - NU Tone returned.
3. IDENTIFICATION OF B WIRE - Good Earth applied to B Wire returns NU Tone
to engineer. Tone removed when earth removed.
The AXE10 Exchange
==================
SALT TEST
=========
Dial access code 175 from the line to be tested. When dialtone is recieved
replace the handset. After initial checks telephone will ring, on answer
DT recieved. Subsequent tests can be made by dialing the following order
codes.
ORDER CODE | TEST | DIAL | RESULT
============|============|===================|==========================
2 | insulation | replace reciever | phone rings,
| test A-B | lift reciever | tone returned.
============|============|===================|==========================
3 | insulation | replace reciever | phone rings,
| test to | lift reciever | tone returned.
| earth | |
============|============|===================|===========================
4 | insulation | replace reciever | phone rings,
| test to | lift reciever | tone returned.
| -48v | |
============|============|===================|===========================
5 | insulation | replace reciever | phone rings,
| test A&B | lift reciever | tone returned.
| loop to | |
| earth | |
============|============|===================|===========================
6 | polarity | | tone returned
============|============|===================|===========================
7 | loop | | tone returned
| resistance | |
============|============|===================|===========================
8 | dial test | dial 0 | tone returned
| keypad MF | dial 0 | tone returned
| keypad | dial 123456789*0# | tone returned
============|============|===================|===========================
9 | bell test | replace reciever | phone rings
| | lift reciever | tone returned
============|============|===================|===========================
10 | service | press button | tone returned
| button | |
============|============|===================|===========================
11 | SPM test | | meter steps *
============|============|===================|===========================
12 | SALT EQM | | tone returned
| test | |
============+============+===================+===========================
* On SPM test 10 pulses are returned. After completion of each successful
ordered test another test can be obtained by dialing another Order Code
immediatly. Tones Returned:
DT = (DIAL TONE) Test Passed
ET = (ENGAGED TONE) Test Acceptable
FT = (600Hz at 260Ms, 260Ms OFF, 1400Hz at 260Ms ON, 260Ms OFF) Failure.
CPI (Cable Pair Identification)
===============================
Speaker Circuits: Where digital (TXD) unit exists, in order to gain full
access to CPI, it is essential that all speaker circuits be connected to
this unit, as access to TXD is not possible from Strowger (TXS) or
electronic (TXS) or electionic (TXE). In cases where there is a mix of TXS
and TXE only, it would be benificial to connect the speaker circuit to
TXS, as when the exchange is modernised, the TXS unit will be the first to
be converted into TXD. This will eliminate the problem of having the
speaker circuit numbers at a later date. To access CPI from TXD, in all
cases, the full national number must be used. This facility is not
automaticaly provided and must be requested from Data Managment.
_\'/_gBH
ping?
M E R 1 D I 4 N R E M O T E A D M I N I S T 4 T 1 0 N
===============================================================================
Meridian 1 PBX Administration Typed up and slightly edited by Sneeka
=-=-=-=-=-=-=-=-=-=-=-=-=-=-= (sneeka1@hotmail.com)
Well, seeing as i've found an official Meridian 1 Sysadmin Manual, i
thought i might as well type it up. Most of it is pretty simple stuff, so
i guess it's mainly for ppl out there just getting started on PBXs, but
i've left out the really patronising stuff :)
I've decided to split this article into two parts. This first part has two
sections. The first deals with a general overview of Meridian 1 and all
the equipment associated with it, and the second deals with actually
administrating the pbx, in terms of extension manipulation etc. The next
part will (hopefully) appear in the next issue of F41TH and will contain
info
about all the various features etc that you can apply to extensions.
Anyway, on with the text....
(btw - some of the longer output captures were taken from my pbx at work
(stops me getting finger-strain) so it's not like all the samples are from
the same pbx, which means there are some differences between outputs as the
shorter ones were just copied out of the manual)
Sneeka
---
SECTION 1: PRODUCT DESCRIPTION
===============================
Meridian 1
==========
Meridian 1, which is the prime Integrated Services Private Branch Exchange
(ISPBX) offering in the BT product portfolio, meets the most demanding
telecommunications needs of the 90s. Its extensive selection of
facilities, features and options provides a highly attractive solution to
the communications requirements of a wide variety of customers.
Meridian 1 System Types/Options
===============================
There are currently four Meridian 1 options available in the UK, namely,
Option 11, 51, 61 and 71. The system size range from the small wall
mounted Option 11 which caters for between 30 & 200 extensions up to the
Option 71 which can handle up to 10,000 ports.
The table below shows the basic data on the Meridian 1 Options:
Type/Option | Theoretical Max No. | CPUs
| of Ports* |
--------------+-------------------------+---------------
| |
11 | 250 | 1
51 | 1000 | 1
61 | 2000 | 2
71 | 10000 | 2
*A port is the common term given to exchange lines, private circuits and
extensions etc. The main difference between the various Options is the
port capacity. The Option 61 and 71 systems also have two CPUs for security
purposes.
Telephone Sets
==============
The Meridian 1 system supports two types of telephone:-
a. Meridian 1 Digital Feature Phones.
These phones are specifically designed for Meridian 1. There are
four types available in the UK, the M2006, M2008, M2616 and M2216.
b. Analogue Phones
These are any BT general purpose telephone. The Meridian 1 refers
to these as 500 sets.
M2006
=====
The M2006 is equipped with six programmable keys, a HOLD key and a RLS
(Release) key. The bottom key (Key 0) will always contain a Directory
Number (DN) and is designated as the Prime DN. The remaining five
programmable keys can be programmed with Meridian 1 features such as Call
Forwarding.
A red message waiting lamp is provided for use with Meridian Mail.
On-Hook dialling is available with the M2006 by the user must lift the
handset to speak to the other party.
M2008
=====
The M2008 is similar to the M2006 with the following exceptions:
o Multiple DN capability.
o Eight programmable keys.
o Optional 2x24 character display.
The bottom key (Key 0) is always used for the Prime DN. (Keys 1-7 can be
programmed with Meridian 1 features or additional DNs) If the display
module is fitted, the top key, (Key 7) will always be used for programming
the display.
M2616
=====
The M2616 is capable of the following features:
o 16 programmable keys.
o Two way hands free operation.
o Optional key expansion modules.
o Optional 2x24 character display.
The bottom key (Key 0) is always used for Prime DN.
The top left hand key (Key 15) is always used for the hands free/mute.
If the display module is fitted, the top right hand key (Key 7), will
always be used for programming the display.
M2216 - Automatic Call Distribution (ACD) Feature Phone
=======================================================
The M2216 is designed to be used in high volume traffic situations
associated with Automatic Call Distribution operation.
The M2216 have the following characteristics:-
o Two headset jacks, (one have a "listen only" option).
o Optional key expansion modules.
o A 2x24 character display is provided as standard.
Features of the M2216 are similar to the M2616.
Display Module
==============
This option provides a 2x24 character display for M2008 and M2616
(additional power required for the M2008).
The display provides alpha-numeric information for:-
o Calling / called DN.
o Re-routed calls.
o Optional Call Party Name Display. (CPND)
o Date and Time.
o Feature activation assistance.
Prompts make the activation of features easier.
A screen menu exists for the following which is accessed by pressing key 7
on the set:-
o Adjust key click
o Activation / deactivation of call timer
o Independant volume controls (handset, buzz, ring, on-hook dial)
o Screen contrast level
o Predial recall (last number which was dialled)
o Idle screen format (preferred layout of date and time)
o Lauguage selection:
English/French/French Canadian/German/Dutch/Spanish
Key Expansion Module
====================
The Key Expansion Module is available for use with the M2616 and M2216 ACD
sets.
Each expansion module gives an extra 22 keys and up to two modules can be
added.
M2250 Attendant Console
=======================
All Meridian 1s can be equipped with a system console(s) (M2250). The
console is designed to handle a high volume of calls and there are over 100
call processing feature to choose from that can be assigned to the console.
Central Answering Position (CAP)
================================
The Central Answering Position (CAP) is an alternative to the attendant
console, and must use a Meridian M2616 or M2216 ACD telephone. It provides
many console features including responding ro requests for information,
transferring, parking, and placing calls. With the addition of an optional
key expansion module(s), the CAP can also have Direct Station Select and
Busy Lamp Field features.
The equipment required for a CAP is:
o an M2616 or M2216 ACD digital telephone
o an LCD display
o optional key expansion module(s)
Extension Circuit Card Capacities
=================================
An analogue telephone connects into the Meridian 1 using a Flexible
Analogue Line Card (FALC).
The digital feature phone connects into the Meridian 1 using a Digital Line
Card (DGTL LC).
The maximum number of extensions that can be provided on an extension card
is 16 on a FALC and 16 (Voice and Data) on a DGTL LC.
Digital sets have a data adapter fitted into the telephone foot to allow
data to be sent through the Meridian 1 to/from a terminal or computer.
Referencing Extensions
======================
A system administrator needs to know how to reference an extension in order
to change the features assigned it.
The term given to the number that is used to ring the extension is the
"Directory Number" (DN). Note that extension users will probably talk in
terms of their "Extension Number" rather than "Directory Number".
The length of the DN can range from 2 to 7 digits in length. In all
examples in this document 4 digits DNs are used.
The term given to the physical point at which an extension connects to the
system is the "Terminal Number" (TN) and is comprised of the following:-
For Types 51, 61 and 71 the TN consists of:-
Superloop | Shelf | Card Slot | Unit (Port)
-------------+-----------+--------------+--------------
(0-159) | (0/1) | (0-15) | (0-15)
eg | eg | eg | eg
004 | 0 | 08 | 01
[ Sorry about the ascii table, but i think you get the drift - Snk ]
and Option 11 systems the TN consists of:-
Card Slot | Unit (Port)
------------+-------------
(0-20) | (0-15)
eg | eg
11 | 10
---
SECTION 2: EXTENSION MOVES AND CHANGES
======================================
Administration of a Meridian 1 system can be carried out using three
different methods.
These are:-
Using a Teletypewriter (TTY) Terminal:
--------------------------------------
This is the primary method through which all administration functions are
available.
[ Basically, just calling a dialup with Terminate, Hyperterminal ..or
wotever you use - Snk]
Using the Attendant Console:
----------------------------
If the system is equipped with Attendant Administration (AA) software
package limited admin functions are available from the M2250 attendant
console.
Using Telephone Extensions:
---------------------------
Extension moves can be performed from telephone extensions if your system
is equipped with the Automatic Set Relocaton (SR) software package.
Later in this document, you will find the procedure for listing what
software you have available on the system.
On Option 11, you can add a new extension by plugging the new telephone
into a spare socket and keying a short code. The features allocated to the
new extension are copied from a predefined template (Model Set).
Admin From The Teletypewriter (TTY) Terminal
============================================
[ Ok, this is where it really gets patronising, so i'll leave out the
obvious points - Snk ]
Logging in and out of the system
================================
When the TTY terminal has not been used recently, the screen will turn
itself off. If this is the case press return to refresh the screen.
If no one is logged into the system the screen will display:
OVR111 IDLE
If someone is already logged in, it will display:
OVL000
To login type LOGI and hit return.
It'll then prompt you for a password with 'PASS' if there's a password set.
You'll then get a chevron prompt:
>
To logout, just type LOGO, hit return, and hangup.
Loading Overlay Programs
========================
Each Overlay program has a reference number and is brought into memory by
typing:
LD XX
where XX is the program number.
The system will come back with a REQ.
To exit from a Overlay program, type END and return.
The table below is a list of frequently used Overlay programs:
Type To Add, Change or Delete To Print
---------------------------------------------------------------------------
Analogue 500 sets 10 20
Digital sets 11 20
Customer Data Block 15 21
Speed Call Lists 18 20
Trunk Routes -- 21
Trunk Members -- 20
ACD Queues 23 23
Configuration -- 22
Print Software Packages -- 22
List Unused Units (TNs) -- 20
Set Time/Date 2 2
Data Backup 43 --
Authorisation Codes 88 88
Console Configuration 12 20
Station Print -- 81
Group Hunting Lists 18 20
Group Hunting Pilot DNs 57 57
Scheduled Access Restriction (SAR) 88 88
Flexible Feature Codes 57 57
Call Party Name Display 95 95
Correcting Mistakes
===================
The backspace key doesn't remove characters on the Meridian system. You
use *'s to correct any mistakes as follows:
* Cancels the current line and prompts for input.
** Takes you back to the REQ prompt of the current Overlay program.
**** Aborts the current Overlay program.
Printing Extension Details
===========================
Overlay program 20 is used to print the features assigned to an extension.
In order to do this the TN must be known.
Find out the TN number by doing the following:
>LD 20 {Load program}
REQ PRT {Meaning Print}
TYPE DNB
CUST 0 {To identify the customer if 'multi-customer is work is used.
Always set to 0 if multi-customer is not used}
DN 5004 {The DN number}
DATE {
PAGE { Just return through all of these to except the defaults
DES {
You should get back something like this:
DN 5004
TYPE 500
TN 004 0 00 008 DES ROOM26 15 JAN 1992
NACT {Meaning Next Action, just return through it}
REQ END {Exit from the overlay program}
The TN number is 4 8 (ie. the non-0's in the TN field seperated by a
space).
The system also displayed the "designation (DES)" which is a 6 character
field in the extension's data that can be used for remarks or comments.
Printing the Terminal Number Data Block (TNB) of an Extension
=============================================================
>LD 20
REQ PRT
TYPE TNB
TN 4 8 {The TN number}
DATE
PAGE
DES
[ Output ]
DES ROOM26
TN 004 0 00 08
TYPE 500
CDEN 4D
CUST 0
DN 5004
AST NO
IAPG O
HUNT 2406
TGAR 1
LDN NO
NCOS 3
SGRP 0
RNPG 0
LNRS 16
XLST
SCI 0
SCPW
CLS TLD DTN FBD XFA WTA FNA HTA ONP
LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD
CFTD SFD MRD C6A CNID
ICDD EHTD MCTD
GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA
UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD
MCRD
PLEV 02
FTR CFW 4
FTR SSU 0010
FTR FDN 2502
FTR PHD
FTR RDL 12
DATE 14 JAN 1992
NACT
REQ END
Finding a Spare TN
==================
To List Unused Units (LUU) do the following:
>LD 20
REQ LUU
TYPE 500 {To obtain a list of analogue units}
TN {Return through this}
TYPE 500 TN 009 0 00 02 4D
TYPE 500 TN 009 0 00 09 4D
TYPE 500 TN 009 0 00 12 4D
TYPE 500 TN 009 0 00 22 4D
REQ LUU
TYPE 2000 {To obtain a list of digital units}
TN
TYPE 2000 TN 004 0 00 16 8D DTA
TYPE 2000 TN 004 0 00 17 8D DTA
TYPE 2000 TN 004 0 00 18 8D DTA
TYPE 2000 TN 004 0 00 19 8D DTA
TYPE 2000 TN 004 0 00 20 8D DTA
TYPE 2000 TN 004 0 00 21 8D DTA
TYPE 2000 TN 004 0 00 22 8D DTA
TYPE 2000 TN 004 0 00 23 8D DTA
TYPE 2000 TN 004 0 00 24 8D DTA
TYPE 2000 TN 004 0 00 25 8D DTA
TYPE 2000 TN 004 0 00 30 8D DTA
TYPE 2000 TN 004 0 00 31 8D DTA
TYPE 2000 TN 005 0 00 16 8D DTA
REQ END {Quit}
Finding a Spare DN
==================
Spare DNs can be found by listing DNs in a number range and checking it for
gaps.
In this example a list of DNs in use in the range 2500 to 2599 has been
requested.
REQ PRT
TYPE DNB
CUST 0
DN 25
DATE
PAGE
DES
DN 2501
TYPE SL1
TN 008 0 00 01 KEY 00 DES ROOM21 15 JAN 1992
(2006)
DN 2502
TYPE SL1
TN 008 0 00 02 KEY 00 DES ROOM26 15 JAN 1992
(2008)
TN 008 0 00 03 KEY 03 DES ROOM34 15 JAN 1992
(2016)
DN 2503
TYPE SL1
TN 008 0 00 02 KEY 03 DES ROOM67 15 JAN 1992
(2008)
TN 008 0 00 03 KEY 00 DES ROOM43 15 JAN 1992
(2616)
DN 2504
TYPE 500
TN 009 0 00 07 DES ROOM34 15 JAN 1992
DN 2505
TYPE 500
TN 009 0 00 08 KEY 00 DES ROOM56 15 JAN 1992
DN 2509
TYPE SL1
TN 008 0 00 00 KEY 06 DES ROOM47 15 JAN 1992
(2008)
>From this printout you can see that DNs 2500, 2506 to 2508 and 2510 to 2599
are free.
Listing Extensions with a Particular Feature Assigned
=====================================================
Overlay program 81, termed 'Station Print' is useful for obtaining a list
of extensions that have a particular feature assigned. For example to list
all extensions in a Pickup Group (Number 1) use Overlay Program 81 as shown
below. [ btw - for those who don't know, pickup groups are are groups of
extensions that can answer a call coming in on another fone...so, if you
had a Managing department, anyone in that group could answer any call
coming in on another fone as long as it's part of the managing group number
- Snk ]
>LD 81
REQ LST
CUST 0
DATE
PAGE
DES
FEAT RNP {Requesting that any extension in a ringing number pickup group
is listed}
RNPG 1 {Requesting only extensions that are in Pickup Group 1)
FEAT
{Feature}{Cust} {Group} {Terminal No.} {Type} {Designation} {DateChanged}
PUA 00 0001 TN 005 0 00 08 2000 ROOM21 25 MAR 1999
PUA 00 0001 TN 005 0 00 13 2000 ROOM24 25 MAR 1999
PUA 00 0001 TN 005 0 00 14 2000 ROOM56 25 MAR 1999
PUA 00 0001 TN 006 0 00 01 2000 ROOM65 25 MAR 1999
PUA 00 0001 TN 006 0 00 03 2000 ROOM11 25 MAR 1999
PUA 00 0001 TN 006 0 00 12 2000 ROOM70 25 MAR 1999
PUA 00 0001 TN 133 0 00 04 2000 ROOM34 NO DATE
PUA 00 0001 TN 133 0 00 05 2000 ROOM23 NO DATE
PUA 00 0001 TN 133 0 00 06 2000 ROOM12 NO DATE
PUA 00 0001 TN 133 0 00 07 2000 ROOM10 NO DATE
REQ END {Quit}
Adding and Rearranging Extensions
=================================
The overlay program to load in order to add and rearrange extensions is
dependent on the type of extension:
Analogue - LD 10
Digital - LD 11
Once you've loaded the program, you'll get the familiar REQ prompt.
Here are some of the common actions you can take:
NEW - Add a new extension. With this command you have to specify each
data item individually.
CPY - Add a new extension by copying an existing unit.
CHG - Change any feature assigned to an existing extension.
MOV - Move an extension and all its features from an existing TN
location to a different TN location.
OUT - Delete an extension from the system.
END - Exit the Overlay Program.
Adding a New Extension
======================
To add a new extension you can respond to the REQ prompt with one of two
commands, namely NEW and CPY.
With the NEW command the system will in turn display each prompt in the
Terminal Number Data Block (TNB) to which you must type a response. This
method would typically be used only if there was not an existing extension
on the system with similar features to that which you are trying to add.
If however there is an existing extension, with similar features already in
the system, use the CPY command.
Example 1:
----------
In this example TN 9 9 with a DN of 2506 will be added by copying from an
existing TN 9 7.
>LD 10
REQ CPY 1 {Copy one new extension}
TYPE 500 {It's an analogue phone, so the type is 500}
CFTN 9 7 {Copy feature(s) from TN 9 7}
DES ROOM26 {It outputs the designation of TN 9 7}
TN 9 9 {Terminal number where the new extension is to be located
at}
DN 2506 {DN of new extension}
NEW 500 TN 009 0 00 09 DN 2506 {It outputs a confirmation of wot
You've just added}
REQ END {Quit}
Example 2:
----------
In this example TN 9 10 with a DN of 2507, and TN 9 14 with a DN of 2508,
will be added by copying the features from existing TN 9 7.
>LD 10
REQ CPY 2
TYPE 500
CFTN 9 7
DES ROOM26
SFMT TNDN {TNDN tells the system that each TN and DN will be
specified by the sysadmin for the new extensions.
AUTO may be typed instead, which requests the
system to automatically select the next free TNs
and DNs in the sequence starting with the
specified TN and DN.}
TN 9 10 {Type TN and DN for
DN 2507 1st new extension}
NEW 500 TN 009 0 00 10 DN 2507
TN 9 14 {Type TN and DN for
DN 2508 2nd new extension}
NEW 500 TN 009 0 00 14 DN 2508
REQ END {Quit}
Changing the DN of an Extension
===============================
Analogue Sets:
To change the DN of an analogue set load Overlay program 10.
In the example below the TN has already been established as TN 9 3.
The DN for TN 9 3 is to be changed to 2207.
>LD 10
REQ CHG
TYPE 500
TN 9 3
ECHG YES {Type YES to use the Easy Change method}
ITEM DN 2207
ITEM {Return through the next ITEM prompt}
REQ END {Quit}
Digital Sets:
Every digital extension will have at least one DN assigned. This DN is
termed the "Prime DN" and is assigned to key 0. M2008 and M2216 sets can
be assigned additional DNs. These are assigned to keys in the same way as
the Prime DN, the only difference being the key number that is assigned [
More on "Multiple DNs" will be covered in part two of this article - Snk ].
To change the DN of a digital set load Overlay program 11 as shown below.
The DN for TN 8 3 is to be Single Call Ringing (SCR) DN 2277.
>LD 11
REQ CHG
TYPE 2008
TN 8 3
ECHG YES
ITEM KEY 0 SCR 2277 {Specifying a SCR DN of 2277 on Key 0}
ITEM {Return}
REQ END {Quit}
Moving Extensions
=================
As mentioned earlier in the product description analogue and digital
extensions connect to different types of circuit card. Hence analogue and
digital sets cannot be interchanged by unplugging one type of set from the
socket and replacing it with the other type. A wiring change needs to be
performed by an engineer. Like extensions (analogue or digital) however
can be moved around the system by programming.
There are two commands that can be used to move extensions (CHG and MOV)
with Overlay programs 10 (analogue) or 11 (digital).
The two methods are demonstrated below.
Example using CHG
-----------------
In this example extension 2206 and 2404 want to swap locations but keep
their
existing DN and features. A listing of the two extensions will be taken
first and then the CHG command will be used to swap the extensions.
>LD 20
REQ PRT {Print Request}
TYPE DNB {Obtain the TNs for both DNs}
CUST 0
DN 2404 {Hitting SPACE after this allows you to enter more
than
one DN}
DN 2206
DATE {
PAGE {Return through these to except the defaults}
DES {
DN 2404
TYPE 500
TN 009 0 00 010 DES ROOM21 14 JAN 1992
DN 2206
TYPE 500
TN 009 0 00 02 DES ROOM78 14 JAN 1992
NACT {Next Action - just return through it}
REQ PRT {Print out the two TNs to compare differences}
TYPE TNB
TN 9 10
TN 9 2
DATE
PAGE
DES
DES ROOM21 {The system then outputs the two extension configs}
TN 009 0 00 10
TYPE 500
CDEN 4D
CUST 0
DN 2404
AST NO
IAPG O
HUNT 2403
TGAR 1
LDN NO
NCOS 3
SGRP 0
RNPG 0
LNRS 16
XLST
SCI 0
SCPW
CLS TLD DTN FBD XFA WTA FNA HTA ONP
LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD
CFTD SFD MRD C6A CNID
ICDD EHTD MCTD
GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA
UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD
MCRD
PLEV 02
FTR SSU 0010
FTR FDN 2502
FTR PHD
FTR RDL 12
DATE 14 JAN 1992
DES ROOM78
TN 009 0 00 02
TYPE 500
CDEN 4D
CUST 0
DN 2206
AST NO
IAPG O
HUNT 2501
TGAR 1
LDN NO
NCOS 3
SGRP 0
RNPG 0
LNRS 16
XLST
SCI 0
SCPW
CLS TLD DTN FBD XFA WTA FND HTA ONP
LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD
CFTD SFD MRD C6A CNID
ICDD EHTD MCTD
GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA
UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD
MCRD
PLEV 02
FTR CFW 4
FTR SSU 0010
FTR PHD
FTR RDL 12
DATE 14 JAN 1992
NACT {Return}
REQ END {Quit}
So, from those two printouts you can see that following changes need to be
made:
Changes to TN 9 10:
-------------------
Existing Change to
------------------------------
DN 2404 DN 2206
HUNT 2403 HUNT 2501
CLS FNA CLS FND
FTR FDN 2502 needs to be deleted
and FTR CFW 4 needs to be added
Changes to TN 9 2:
------------------
Existing Change to
------------------------------
DN 2206 DN 2404
HUNT 2501 HUNT 2403
CLS FND CLS FNA
FTR CFW 4 needs deleting
and FTR FDN 2502 needs to be added
The following solution shows how to do this:
>LD 10
REQ CHG
TYPE 500
TN 9 10
ECHG NO {We won't use Easy Change here, just so you can see the
differences}
DES ROOM21
DES
DN 2206
MIX {MIX is just the system telling you that this DN is
assigned
to more than one TN}
AST {Return through the items you don't want to change}
IAPG
HUNT 2501 {Change the HUNT number}
TGAR
LDN
NCOS
RNPG
SCPW
SGRP
CLS FND {Change the class of service to Forward No Answer Denied}
LNRS
SCI
PLEV
FTR CFW 4 {Add the feature Call Forward All Calls}
FTR XFDN {'X' before the mnemonic deletes the feature}
FTR
MIX {Just another warning, ignore}
REQ CHG
TYPE 500
TN 9 2
ECHG YES {We'll use Easy Change this time}
ITEM DN 2404
ITEM HUNT 2403 {Basically, all that's different is that you type the
item's mnemonic that needs to be changed, along with
the value(s)}
ITEM CLS FNA
ITEM FTR FDN 2502
FTR XCFW
FTR
ITEM
REQ END
A More Easy Way (using MOV)
===========================
In this example extension 2206 and 2404 want to swap locations but keep
their
existing DN and features. The MOV command will be used three times to do
this. But first you need to use LD 20 to get the TNs of the extensions and
a
spare TN. We'll be using TN 9 9 as the spare here (2206's TN is TN 9 2 and
2404's is TN 9 10).
>LD 10
REQ MOV
TYPE 500
TN 9 10
TOTN 9 9
REQ MOV
TYPE 500
TN 9 2
TOTN 9 10
REQ MOV
TYPE 500
TN 9 9
TOTN 9 2
REQ END
[ That's pretty much self-explanatory so I won't bother with any comments -
Snk ]
Deleting an Extension
=====================
This process will delete the extension number (DN) and all the features
currently assigned to a TN, making the TN spare.
Respond to the REQ prompt by typing OUT to delete an extension (shown
below):
>LD 10
REQ OUT
TYPE 500
TN 9 2 {TN of the DN to delete}
REQ END
Misc. Operations
================
Setting the Time and Date
-------------------------
To set the time and date you use overlay program 2. Once LD 2 is loaded,
you
will receive a "." Prompt instead of a ">". This is because LD 2 used to be
a maintenance program.
At the . prompt test the current date and time by typing:
.TTAD {No carriage return is needed}
To set the time and date type:
.STAD <day> <month> <year> <hour> <min> <sec>
The clock is set when you hit return.
To exit from LD 2, just type **** (no return needed).
Backing Up the System Data
--------------------------
Meridian 1 automatically backs up data changes during the midnight routine.
However, after extensive changes have been made, it's advisable that a
manual
back up is performed as follows:
>LD 43
.EDD {Execute a data dump}
Wait for the system to display "DATABASE BACKUP COMPLETE" then type **** to
exit.
Re-enabling Digital TNs
-----------------------
If a digital phone is unplugged from its socket, the TN may be disabled
during a background routine [ ie. da fone won't work :) - Snk ]. To re-
enable it, do the following:
>LD 11
REQ CHG
TYPE 2008 {Digital phone}
TN 8 5 {TN that needs re-enabling}
ECHG YES
ITEM {Just return on the first ITEM prompt and the system will
re-enable the TN but not make any changes to it}
REQ END
---
Ok, that's all i'm gonna type for this article, can't be arsed to type
anymore. Hope you found some of that useful. I'm off to do some
tracking.....see you in the next one..
Sneeka
sneeka1@hotmail.com
--EOF
C E L L U L A R T R A C K 1 N G
===============================================================================
|---> Methods Used To Track Cellular Phones <---
|| --------------------------------------
||-=By=-
\\--------> -=Tradeser=-
\\
\\---------> tollphree.com
As cellular telephony has advanced with wireless locating, many
emergency calls have moved to wireless media. Cellular emergency
calls cannot be traced back automatically, nor can cell-phone
users be located when in transit. In March 1996, the FCC required
that all wireless carriers be equipped with a locating feature by
the year 2001. The wireless industry has been scrambling for a
solution ever since. Yet, I think that is a load if BS. The FCC
and NSA most likely have had away to track and listen to all
cellular phones in the US sense cellular phone were invented.
Almost every wireless location technology was as originally
conceived for defense purposes and National security purpsoes.
The idea being to track enemy spies or criminals within US boarders
radio communications back to him or her. These strategies used to
track them was fall into a few different tracking methods I have
reasearded. These techniques are GPS, Triangulation, Radio Cameras
and Time Difference of Arrival tracking.
Wireless communication in wartime was based on tactical
communications and signal processing, For this purpose, portable
communications devices were developed that would become the ancestors
of the modern cellular handset. There is a solution to the caller
location problem that is dependent on the Global Positioning System
(GPS). GPS is a satellite-based technology that is used to locate you
on the suface if the earth with those GPS hand held devices and to
help boats and airplanes navigate.
Right now there are so many manufacturers of handsets across the
globe, That I don't care anymore about which cell manufacturers claim
are the best. Give me a Nokia and I'm set. Now that units are
shrinking in size dramatically, and the biggest problems involved
in installing a GPS into ever-smaller handsets will make someones
job a nightmare. Moreover, the idea of developing GPS-based locating
technology may be doubtful in itself. While GPS works fine if one
is guiding a missile or helping a jumbo jet navigate its way across
the ocean, using it on the ground would prove a few major problems
because the signal would be blocked by thousands of natural and
man-made obstructions such as my aluminum hat I wear to block the
CIA from reading my mind. Well any way...
Traditional network solutions work on the principle of
triangulation. There are two approaches to triangulation. The
first is based on angle of arrival, the second on time of arrival.
In a typical scenario, a communications network consists of two to
five base stations. Finding the caller is a matter of calculating
the call’s line of bearing. Theoretically, the caller will be found
at the intersection of the two lines of the angle of arrival, which
could be up to a 125 meters square. Time of arrival is used with at
least three base stations. Callers are found by measuring the time
required for the messages to be transacted. When time is translated
to distance it becomes possible to trace our line up the call to its
source.
Triangulation is a step up from GPS, but here again a clear line of
sight is imperative for the process to be effective. The trouble
is that most of today's cellular traffic is generated in big cities
with massive permanent structures all around.
U.S. Wireless has created a solution that overcomes the line-of-sight
problems associated with GPS and triangulation. "Radio Cameras" a
PC-sized locator that is deployed downtown and in rural places where
a small number of stations are available. The boxes are installed at
base stations throughout their operational area. There they go
through a "learning" process, by which calls are identified and
"fingerprinted" based on their location.
Every call received by the base station gets a location-fingerprint
which the camera recognizes down the road. This solution overcomes
the line of sight problems that you get with GPS-dependent locating
technology and triangulation. Because a Radio Camera is not
triangulating but fingerprinting, it does not require the cooperation
of two or three bases.
The Radio Camera technology also exceeds the limit for accuracy
stated by the FCC ruling. To meet the FCC's requirement, location
must be accurate up to 125 meters. Radio cameras are accurate to 20
to 40 meters, which is four or five times more accurate that the rule
requires. This is not a bonus but a necessity. If you're chasing down
criminal or some PLA kid with a stolen cell, you need to get as close
to the mark as possible to make an arrest.
Time Difference of Arrival (TDOA) measures the time required for a
signal to travel from a handset to a base station. When this process
is duplicated three or four times, it provides the data needed to
perform a mathematical process known as hyperbolic trilateralization.
Similar to triangulation, trilateralization works with very
high-speed measurements. Because it works in nanoseconds, the process
provides extremely accurate location information that can be used to
track vehicles in motion, or someone making a call in a sky scraper.
Welp, that all I can write about methods of cellular tracking right
now. But, I have been reading about this tracking method called
MicroBurst. All I know right now is that a trucking company in the
US uses it to for position tracking of their trucks.
8 0 9 P H 3 3 R F 4 C T 0 R D I G I T 4 L C 5
===============================================================================
/-------------------------------------------------------\
8-0-9
809 INTERNATIONAL COMMUNICATIONS PRESENTS....
\-------------------------------------------------------/
greetz to: PTT Gabon, Chennai Telephones (heh), Sovintel,
Mongolise Telecom, Swaziland Posts and Telegraphs, France
Telecom, Telephone Services of Trinidad and Tobago (TSTT),
Myanmar Posts, Telegraphs and Telephones
(Run by Brigadier General Win Tin...LOL)
more greetz to:
_dave, Psyclone, Polymorph, hybrid, Shadow, b00ger, cf
Saman, Darkcyde, gamma_, c0, pyke, hopye, Keltic Phr0st
Jasun, backa, Mister-X, zomba, ptek, xio, Dr.Fonk, xohs
michella, substance, dr_phace, Rockman, Guru Josh (heh),
defiant, ganjaman, deginge, everyone at LoK...
groups: Darkcyde, Ground Phloor Industries, MeD, GBH,
and OlderGeneration (OG)
---------------------------------------------------------
AN OVERVIEW OF DIGITAL CCITT SYSTEM 5 AND ITS USES
---------------------------------------------------------
UK NZ USA TRINIDAD
---------------------------------------------------------
dynamics, NynexPhreak, RedBlade, Lucky225, pyke
---------------------------------------------------------
"sHinInG hApPy pHrEaKeRs sHaRiNg k0Dez"
A fairly recent development in signalling has been the digitisation
of CCITT 5, allowing faster connections and a cost effective switching
solution with the robust nature of System 5 and the advantages of a
digital switching system.
It's not surprising therefore that so many countries now use digital c5
to switch their international traffic.
Digital c5 is in essence, CCITT 5, but with the tones encoded into
digital format. Addition proceedures for this system have to be set-up
meaning that each trunk is alloted a timeslice for signalling. Similar
to SS7, a signalling link is operational, and digital c5 is common
channel signalled.
All system 5 signalls are present in this system, and the signalling
cycle is the same for the most part. For those of you who are
unfamiliar with system 5, a typical simplified signalling cycle would
look like this:
OUTGOING INT GATEWAY----------------------------INCOMING INT GATEWAY
[ DMS / xESS ] | | [DMS / xESS ]
| seizure f1 |
|--------------------------->|
| proceed-to-send f2 |
|<---------------------------|
| address info |
|--------------------------->|-TRANSLATED AND ROUTED
| answer f1 |
|<---------------------------|
| acknowledgement f1 |
|--------------------------->|
| |
| S P E E C H |
| |
| clear back f2 |
|<---------------------------|
| acknowledgement f1 |
|--------------------------->|
| clear forward f1/f2 |
|--------------------------->|
| release guard f1/f2 |
|<---------------------------|
| |
f1 = 2400 Hz f2 = 2600 Hz
The cycle above is based on the analogue inband version, but the
digital cycle is identical, only the tones are data packets and are
transmitted on a seperate signalling link.
ADVANTAGES AND DISADVANTAGES
============================
"tEll mE wHaT's sO gOoD aBoUt tHis..."
The system has many advantages, post-dialling delay is shorter using
digital system 5 as compared to the analogue-inband version. Digital
multiplexing can be used, and the system is far less susceptable to
tone-imitation fraud [blueboxing to me and you ;) ]. Links can be
monitored with great ease, and digital switches are used with the
system, allowing all the advantages of these switches to telephone
companies.
In addition to the many advantages, it's much cheaper to install that
SS7. A typical digital c5 system would require a digital switch, DCME
equipment and E1 trunks for the encoded links. SS7 requires more
equipment such as line cards, and the ITU/CCITT reccomendations for
SS7 are very flexible meaning that compatibility issues can be a
problem. The system 5 specs are much more rigid, meaning greater
compatibility between networks.
One downside of system 5 digital is that it cannot carry ANI/CLI at
present. This is due to the absence of this reccomendation from the
System 5 spec to date. I'm sure at a later stage, this could be
included, allowing ANI/CLI to be passed via digital-c5 links. This
would be extremely advantageous, because one of the main international
ANI/CLI passing "hurdles" with SS7 is compatibility of the various
"flavours" of SS7, whereas digital c5 is a far more tightly spec'd
system, allowing ANI/CLI to be passed easily if it were specified in
the system.
TYPICAL STRUCTURE OF A SMALL NETWORK USING DIGITAL SYSTEM 5 FOR
===============================================================
INTERNATIONAL CONNECTIONS
=========================
"dIgItaL c5? iT's kIndA lIkE mIcRoSofT uNix (bUt wItHouT tHe bUgs)"
One disadvantage of digital-c5 is that interworking the system using a
single stage of conversion is difficult. As a result, the interworking
process between the international gateway and the national network is
generally done in 2 stages.
Typically, stage 1 converts the digital c5 signals into an MF based
regional system such as R2 or R1 (North American/Bell System MF), R1
is favoured generally because it is comparatively basic and very
compatible with most national systems. The second stage converts the
R1 routing into the national system, this being SS7, SS6, R2 etc.
- Conversion Diagram
C5 converted to R1 R1 converted to SS7
/---------------\ /---------------\
|INTERNATIONAL | |NATIONAL | On to the
===DIGITAL C5==>|GATEWAY SWITCH |--R1-->|GATEWAY SWITCH |-----SS7---->
|(Digital) | |(Digital) | national net
\---------------/ \---------------/
In theory, it could be left as North American MF-R1 or the intermediate
system used in stage 1 of the conversion for countries whose national
networks are analogue based on that system. This would generally be
unusual, as SS7 holds many advantages for national networks and these
are generally modernised first.
There are a lot of examples of this method of interworking. For
example, Cable&Wireless St Kitts and Nevis (Skantel)...
ST KITTS
/-----------------------\
| |Eastern Caribbean Microwave System
| /------\....|....................................
| |5-ESS |D-C5|Eastern Caribbean Fibre System [D-C5]
| \------/----|------------------------------------
| | |
| R1 | NEVIS
| /------\ | /---------------\
| |DMS100| | SS7 | /------\ |
| \------/...|.......|..|DMS100| |
| ST KITTS SWITCH | | \------/ |
| | | NEVIS SWITCH |
\-----------------------/ | |
| |
| |
| |
| |
\---------------/
As you can see, the digital c5 link is first converted to R1, then
converting the R1 routing to SS7. A 5ESS forms the international
gateway, with the St Kitts switch being the national network gateway as
well as serving St Kitts. On calls to this island, clear background
dialling is audible (a tell tale sign of R1), but call set-up times are
top-speed and quality of calls is excellent due to the digital nature
of the systems used. An acknowledging "pleep" is heard from the R1
portion on answer, and the call path set-up.
This pattern is similar in Belize too, where Belize telecom use digital
c5 for links to the US, and then have an R1 link between their
international 5ESS switch gateway and their national gateway. In both
examples, the national network is SS7 signalled. Belize telecom use
system R2 for PBX links.
---------
|COROZAL|
|DMS 100|
---------
|
|SS7
|
-------------
|ORANGE WALK|
| DMS 100 |
-------------
\
\SS7
\
\
-------------
|BELIZE CITY|
| DMS 100 |
-------------
/
/
/
/
/SS7 Digitally Encoded C5
/ AT&T MCI TELMEX } E1s
------------- | | | }
| NAT GATEWY| --------------------
OPERATORS--| BELMOPAN |...........|5ESS [Dig Enc C5] |
| DMS100 | R1 |INT GATEWAY SWITCH|
/------------\ --------------------
|SS7 \
------------- \
|SAN IGNACIO| \ SS7
| DMS 100 | \
------------- \
\
\__-------------
| DANGRIGA |
| DMS 100 |
-------------
/
/
/
/
/
/
/SS7
/
/
/
/
/
-------------
|PUNTA GORDA|
| DMS 100 |
-------------
The diagram above is very simplified, there are many more switches
than those shown, but I think you get the idea that they are all
DMS100s and the national network is SS7.
All international calls go via the appropriate carriers on Digital C5
switched trunks, acknowledgment "cheeps" are sent on answer of incoming
transit calls, these are from the R1 link between gateways.
All calls are muted until an answer signal is recieved, as standard
with the DMS100 switch. The reason that the International Gateway is a
5ESS is because no DMS250/300 was available at the time, as with the
St Kitts example.
Both countries are relatively small, and signalling times for
digital-c5 connections are generally marginally longer, it would be
interesting to see the performance of digital-c5 with busier routes
in a larger switching environment. The c5 signalling cycle seems to
be rather long, although when packetised as with digital-c5 it is of
course a lot quicker. I think the main delaying portion of the journey
is in the interworking stage when 2 stages are used in the process.
In theory, digital-c5 could perform well even on the busiest routes
and might be a viable solution for busier international switching
environments that still have not digitised fully as of yet.
In fact, while on the subject, system 5 is still the most popular
world system in use. As I have mentioned before, due to its sheer
versitility and different types, it can be found to some in extent
in most countries. For instance, CCITT5bis, an early MF compelled
system (i.e forward and backward dialling as with R2) was specified
and Denmark ordered some 5bis equipment in the 80s. With the addition
of the digital version, it makes CCITT5 one of the most widely adopted
standards in the world today.
CONCLUSION
==========
"hE's gOiNg tO bLab aBoUt hOw aMazIng iT is"
All in all, digital C5 forms an excellent system for switching transit
calls. Despite some minor disadvantages, many of which could be
resolved by "patching" the system with additions, it lives up to the
robust and dependable reputation which System 5 enjoys, and combines
the simplicity and dependability of time-proven switching methods with
modern, digital methods. This results in an efficient and
cost-effective switching system, and is finding application globally.
(Wow, I do really love c5... Obsessed? Understatement.)
- dynamics
Darkcyde/809
"tHanK-yOu aNd gOodByE...."
wtf?? no pleep?!?!?
E N D
===============================================================================
[c] D4RKCYDE. 1997,1998,1999,2000 http://f41th.com #darkcyde efnet.
G L O B A L F E A R.
...click.
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed