		*******************************************
		* PHED-ONE's ULTIMATE GUIDE TO BLUEBOXING *
		*	   IN THE (LATE) 90s		  *
		*	      [FULL STOP]		  *
                *******************************************

				 PART-4
	  Advanced Routing and trunk verification and appendices

Well, this is the last and final part of my guide to blueboxing. By now you should be pretty much
well skooled on c5 and blueboxing from the UK using Home Direct and International 0800s. In fact,
you'r probably right now thinking about going out and blueboxing every c5 you come across...

Well, actually, as mentioned earlier, there are a lot of hurdles to conquer before you can go
out and do that, but then again, you read part-1 and should know most of the tricks.

This section will describe some of the more advanced routing tricks around, and because 
blueboxing is a whole lot more than just getting free calls, you might like to have some fun with
the stuff I'm going to mention.


ADVANCED ROUTING
~~~~~~~~~~~~~~~~

As mentioned throughout the guide, C5 trunks are routed as:

Terminal calls: Kp1-desc digit-area code-number-ST

Transit calls: Kp2-cc-desc digit-area code-number-ST

Some countries route slightly differently for Kp2, sometimes having the descriminating digit in
front of the country code, Macau (853) and Brunei (673) were examples of this, although Macau 
used a double-zero....

Macau Transit: Kp2-00-cc-area code-number-ST
Brunei Transit: Kp2-0-cc-area code-number-ST

Zero is usually the best place to start when routing a call from a newly seized number, zero is
almost universal to all countries, and even if a cable routing isn't available, zero will often
just route according to what is available, rather than hang-up or give a reorder.

Just to recap on the digits:
								
							SATELLITE: 1
								|=|
							||------|=|------||
								|=|




MILITARY: 3								 
									 /|OPERATOR: 2
    \______								 ||			
    / **** \===========						|        ||"Connecting you now"
___/>US ARMY\_____						|	 ||
|(---------------)|						|   ------|
\________________/						|   \-----|
								\------	  |
								    |	  |
								    |	  |
								   /-\	  |


		CABLE: 0					MICROWAVE/RADIO: 9
|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|   |[:::::::::::::::::::::::::::::]|[::
|							|   |				    |				
|							|   |				    |
|							|   |				    |
-------------------------------------------------------------------------------------------------


Some countries will attempt to distinguish real routing and "false" routing using codes. Some 
time ago the "182 trick" was introduced to the R1 signalled trunks in the US. All calls would 
route:
	KP18(pause)2ST.....KPnumber(pause)last digitST

A pause of around 68ms is generally used.

This may have been applied to countries of the Caribbean and Canada, and is worth noting in case
you find yourself blueboxing in these regions.

Calls routed without the 182 would still route, although they were flagged.

Some countries double-up the descriminating digits, so 0 would be 00 (see Macau above). In 
addition, a zero is prefixed before each digit in some cases, with 1 becoming 01. Very often the
doubling and adding of the zero in the descriminating digits occurs when the digits are in front
of the country-code, in order to avoid difficulties with routing.


LOCAL LEVEL, NATIONAL LEVEL AND INTERNATIONAL LEVEL
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It is important when routing calls to understand the principle that most of the worlds phone 
systems use "levels" for routing and switching calls. Local level would be the "local loop", i.e
the lines from houses and businesses to the local exchange. National level would be the trunks
interconnecting the exchanges, although national level could be split further into low-national
level, the trunks between local exchanges and main switching units, and high-national level being
the trunks interconnecting the main switches. International level is self explanitory, and would
be the trunks between international gateways.

In the UK, when using an ordinary subscriber phone, these levels are expressed in 0s...



/-------\	LOCAL LEVEL	/-------\			/-------\  [	 '		
|HOUSE	|~~~~~~~~~~~~~~~|~~~~~~~|  TEL	|			|  INT	|   \   '
|	|		|	| EXCHG	|  Trunk Level 0	|SWITCH	|''''\/  Trunk Level 00
|_______|		|	|_______|-----------------------|_______|     \  (International)
					   (National Level)                    \]


When a C5 call is made from, let's say, Sweden, to the UK, the SS7 trunks become temporarily
signalled using CCITT 5, because the originating country is using C5 and SS7 is backwards 
compatible (it has to be). Therefore, re-seizing the trunk would result in the UK end being 
seized, and you would then be free to route Kp1 within the UK.

But, it gets a lot better. It is possible to route to the "area code sender" of each exchange,
for instance, from a UK trunk, you would route:

	Kp1-2-area code without 0-ST

for instance: Kp1-2-1597-ST
(1597 - Llandrindod Wells)

You would route 2 as an operator, and this would give you a single "pleep". From area code level
you could then route to the individual exchanges:
	
	Kp1-2-exchange-ST

for instance: Kp1-2-82-ST
(82 - Llandrindod Wells town)

From local exchange level, you could then try routing to the 4 digit numbers within the exchange
code:

	Kp1-2-number-ST

for instance: Kp1-2-4467-ST

Re-seizure could be possible from there, allowing a considerable ammount of fun routing C5 local
microwave/cable/satellite!/military/ calls. The keyword in all this is EXPERIMENT and have fun
with it. There are probably a lot of tricks out there still unknown of, perhaps someone could 
work out how to do 3 way calling on C5....


INTERNATIONAL SENDERS
~~~~~~~~~~~~~~~~~~~~~

A feature of many C5 systems is the "international sender", these are primarily designed for 
operators to manually route calls to the specified country. These were used a lot in the American
R1 system, mainly due to the lack of a Kp2 signal in the standard dialset.

They are still usable, even though many countries don't actually have a use for them.

The format for using the international senders is:

	Kp1-011-countrycode-ST

From there, a single "pleep" is given, and you can Kp1 a number in the country the sender is
for, following the format:

	Kp1-desc digit-ac-number-ST

For some countries which disallow Kp2, a sender can be used to get around this.



	AND NOW...

	THE MOST CLOSELY GUARDED SECRET AMONG TELCOS TODAY!

		V E R I F I C A T I O N    T R U N KS

Verification trunks are special operator trunks that are used to clip onto calls to check the
status of the line. They can be used as line taps as well, by "them".

When someone calls an operator saying that a line has been engaged for a very long time, they
can check using these trunks to see if the person is talking on the line (and hear the call).
If no call is in progress, it will be silent. 

In countries that use inband systems, verification trunks are accessed using a special
combination of tones, known as a VERIFICATION SEIZE. In short, a verification tone of 280hz is
added to either f1 (2600hz) or f2 (2400hz) and the combination is played twice. For instance:

2400+280  for 200ms delay 50ms
2400+280  for 200ms delay 50ms

Another example would be:

2600+280  for 200ms delay 50ms
2600+280  for 200ms delay 50ms

Verification Seizes are very often features of hybrid R1-C5 connections, as R1 has room for many
more features than system 5.

After recieving the acknowledgement "PLEEP", routing can commence using elongated durations for
the MF digits, with control digits being around 120ms in duration (i.e Kp1, Kp2, ST etc) and 
standard digits at around 90ms, with delays of around 55ms - 68ms, this is mainly because 
verification trunks were designed for use by operators.

For a more detailed explaination, see www.809.cjb.net, in the files section and excellent guide
was written by NynexPhreak.

				APPENDICES
				==========

Corrections:
I mentioned 2 as being for military lines in earlier versions of Part 1 and 2. This is wrong,
2 is for operator lines and 3 is for military in most cases.

Earlier on in the guide I mentioned "mutating the tones", this is related to the tolerance of the
line.

As for mixing in tones with the seize, these are known as GUARD TONES, I don't think I made that
clear enough. Other examples of guard tones include: 2100, 210, 550, 1800, 2800, 440, 280, 3100,
3900, and many others. In fact almost any tone could be used as a guard tone.

While on the subject of guard tones, some countries do require guard tones to be placed as a 
middle tone in some cases. The function of this is to keep the line in the same state before
the seize is sent:

	TONE			DUR	DEL
	2600+2400	-	180	30
	2100		-	180	30
	2400+2397	-	180	30

This example was for when China was on C5, it's not C5 anymore, but this seize may be used by
other nations, who knows.

Another example is Nicaragua, on their C5 trunks they use (according to Destructive Jungle.. :))

	TONE			DUR	DEL	
	2600+2400+2100	-	130	800
	2400+2400+2100	-	330

This would result, I'm told, in a single "chirp" acknowledging the second tone only, and allow
Kp1 routing. This seize apparently still works, although not reccomended as the route is heavily
monitored due to people caning it.

CCITT R1
~~~~~~~~
Now, a long time ago, and to some extent nowadays, system R1 was the system that linked the US. 
It used a single frequency 2600hz tone for controlling the status of trunks, using a tone-on 
(free) and a tone-off (in use) system.

It used interregister signals comprised of MF (multifrequency) tones which were compound tones 
and were used to route calls between trunk exchanges.

It was a pretty basic system, and can be found in some VERY remote parts of the US/Canada, and is
used to some extent in the Caribbean region. It may be found in other parts of the world too, 
especially in poorer countries, and in some parts of Eastern Europe. I heard from a friend that 
Italy uses R1 as the signalling system in some rural towns. A similar system is used by the 
French, called Socotel, which uses MF and single frequency tones.

People used to bluebox the R1 system, by sending the 2600hz tone to tell the trunk the call had 
hung up, when in fact it hadn't meaning that they had an open trunk to dial out of using the MF 
dialset. This is theoretically achievable, but the US is mainly SS7, and muting of forward audio 
can be a problem.

Mark Tabas wrote an excellent series of files on blueboxing R1, known as "Better Homes and 
Blueboxing". BillSF's "Hitchikers Guide to the Phone System" describes R1 as well as Neondreamers
"Analogue Siganalling Systems". Also, "Signalling Systems and the Bluebox Revamped" has an 
excellent section on R1. These files contain more information on R1 than I aim to include here.

The R1 dialset is similar to the CCITT 5 dialset, although Kp2 is not included. In older R1 
systems MF digits had a duration of 68ms, although it has since been updated to except digits 
with a 55ms duration for greater compatibility with CCITT 5.


CCITT R2
~~~~~~~~

CCITT R2 is an extremely complicated system, it can be signalled using up to 6 different methods!
There are digital versions, which use timeslot signalling, and are pretty much un-blueboxable.

The many analogue versions are blueboxable, but seem not to be as blueboxed as heavily as R1 and
C5 are. R2 uses outband tones to signal it, these are theoretically above the voice frequency 
band of the connection. 3825hz is used in Brazil for the signalling of analogue R2 calls. It is
send as:

3825hz for 150ms delay around 35ms
3825hz for 1500ms

A pause would result, and then the R2 digits would be send. The convention with R2 is that each 
digit is send in a long burst until the switch "replies" requesting the next digit. Because of
this two-directional signalling, R2 is a comparatively slow system. It (R2 digital) is used by 
Belize Telecom for interworking with PBXs and for their Voice-Over IP services, and apparently 
adds up to 8 seconds onto the routing time of the call for every switch it travels through.

But it has advantages to the telco as it can be digital, and the out-of-band analogue version
is less susceptable to false realease (such as wistling causing it to hang-up). R2 has more 
features than conventional in-band systems, and this is one of the reasons why it is being used
increasingly accross the world. Most CCITT 4 trunks in Europe have been replaced with R2, and 
it is used extensively on the PSTNs of many Latin American countries.

It can also be set-up to use the same tones as CCITT 4, apparently for low-bandwidth connections.
Many different and strange R2 systems have been set-up by telcos, sometimes with forward tones
in the backward direction and sometimes with just forward tones being sent in an en bloc fashion.

BillSF:

"   R2 is the most versatile end-to-end 
system ever developed. It is a two-way system like C7 and comes in two forms, 
analog and digital, both fully compatible with each other. R2 has completely 
replaced C4, with the possible exception of a few very remote areas where it 
works into R2 using using registers. Two groups of fifteen, two of six MF 
tones are used for each direction, the high frequency group forward and the 
low group backward. Line signalling can be digital with two channels or out- 
of-band at 3825Hz, DC, or in cases of limited bandwidth on trunks, can use the 
C4 line signals, just the 2040 + 2400Hz or 3000Hz or even backward signals 
sent in a forward direction. The signals can be digitally quantised using the 
A-law or u-law codec standards, resulting in compatible signals for analog 
lines. In international working, only a small part of the standard is man- 
datory with a massive number of options available. For national working, an 
ample number of MF combinations are "reserved for national use", providing 
an expandable system with virtually limitless capabilities.   "

(Taken from "Signalling systems and the bluebox revamped")

R2 Register signals

------------------------------------------------------------
Forward   1380    1500    1620    1740    1860    1980  [Hz]
------------------------------------------------------------
Backward  1140    1020    900     780     660     540   [Hz]
------------------------------------------------------------
Digit
  1        x       x
  2        x               x
  3                x       x
  4        x                       x
  5                x               x
  6                        x       x
  7        x                               x
  8                x                       x
  9                        x               x
  10                               x       x
  11       x                                       x
  12               x                               x
  13                       x                       x
  14                               x               x 
  15                                       x       x
-----------------------------------------------------------

These are translated as:


-----------------------------------------------------------                    
                    Forward Signals
-----------------------------------------------------------
Digit         Group I               Group II
-----------------------------------------------------------
  1             1                   Normal subscriber
  2             2                   Priviledged subscriber
  3             3                   Test subscriber 
  4             4                   Payfone 
  5             5                   Operator
  6             6                      ?
  7             7                   Normal subscriber
  8             8                      ?
  9             9                   Priviledged subscriber
 10            10                   Operator
 11            KP2E                 Forwarded call
 12            KP2                  Reserved
 13            Reserved             Reserved
 14            Reserved             Reserved
 15            ST                   Reserved
----------------------------------------------------------


-----------------------------------------------------------------------------
                        Backward signals
-----------------------------------------------------------------------------
Digit         Group A                       Group B
-----------------------------------------------------------------------------
  1           Send next digit (x+1)         Sub.vacant, call tracing (BAD) 
  2           Send previous digit (x-1)     Send guide tone
  3           Receive group B signals       Subscriber busy       
  4           National net failure          Net Failure
  5           Specify subscriber type       Disconnected number
  6           Connect voicechannel          Subscriber vacant - Sup
  7           Send (x-2)                    Subscriber vacant - Non-Sup
  8           Send (x-3)                    Subscriber malfunction
  9              ?                                ?
 10           Reserved                      The number has changed
-----------------------------------------------------------------------------



                  R2 Line signals, non-PCM (3825Hz)


---------------------------------------------------------------
 Signal                           Direction        Duration[ms]
---------------------------------------------------------------
 Seizing                            -->               50 or 150
 Seizing ACK (wink)                 <--               50 (or longer)
 Answer                             <--               150
 Metering (count)                   <--               100
 Clear back                         <--               600
 Clear Forward                      -->               1500
---------------------------------------------------------------

The backward signals are used to ask the calling CO questions while
dialing. This may cause problems since you may not know when to send
digits and when to send info, especially signals like send x-2 may
cause headaches. One way to find this out is usually by testing
different orders. Usually the subscriber type question is only sent when
making national calls and is asked after all the digits have been sent.
On intl. calls the subscriber type is asked after the CC (like on R1).
The thing is that the Telco knows these things and are trying their best to
make life hard for boxers by programming their equipment to send questions
at unexpected times.

A boxed call may take place as follows:

Dial number 555-1212

 CO1                   CO2
---------------------------
 Clear Forward ->
 Seize         ->
           <- Seizing ACK

 I-5 ->
                     <-A-1 (send next digit)
 I-5 ->             
                     <-A-1
 I-5 ->              
                     <-A-1
 I-1 ->               
                     <-A-1
 I-2 ->               
                     <-A-1
 I-1 ->          
                     <-A-1
 I-2 ->               
                     <-A-5 or A-3 (specify subscriber)
 II-5 -> (operator)
                     <-B-6 (no ST needed on local calls)
----------------------------

---> Taken from "Signalling Systems and the Bluebox Revamped"


CCITT 3 (MF2/AC9)
~~~~~~~~~~~~~~~~~

This was the old system used in the UK. The last MF2 trunks were removed in 1991 when the UK 
became fully common channel signalled using CCITT 6 and 7. It used a 2280hz tone to signal calls
on a tone-on/tone-off basis as with R1. 

This was phreaked extensively by phone phreakers throughout the 70s, 80s and very early 90s.
It was a very simple system to bluebox, and involved sending:

2280hz for 1000  delay 60	--> Disconnect tone
2280hz for 80    delay 60	--> Trigger tone	
2280hz for 80    delay 60	--> Trigger tone

This would result in a wink from the trunk, from where routing could be achieved with CCITT 3
address digits. The digits would then be send, preceeded by Code14, and waiting for the 
step-by-step acknowledgement by the exchange. In some cases, pulse dialling could be used.

This system may be found on national networks in parts of Eastern Europe, Russia, Africa, 
in remote areas of Asia and South America. Rumour has is that it is in use in South Africa, the
outback in Australia and Sweden to some extent.

+-------------------------+------+------+------+------+-----+-------+
|UK MF2 Forward signalling|  1   | 1380 | 1500 |   0  | 400 |  50   |
|                         |  2   | 1380 | 1620 |   0  | 400 |  50   |
|                         |  3   | 1500 | 1620 |   0  | 400 |  50   |
|                         |  4   | 1380 | 1740 |   0  | 400 |  50   |
|                         |  5   | 1500 | 1740 |   0  | 400 |  50   |
|                         |  6   | 1620 | 1740 |   0  | 400 |  50   |
|                         |  7   | 1380 | 1860 |   0  | 400 |  50   |
|                         |  8   | 1500 | 1860 |   0  | 400 |  50   |
|                         |  9   | 1620 | 1860 |   0  | 400 |  50   |
|                         |  0   | 1740 | 1860 |   0  | 400 |  50   |
|                         | 11   | 1380 | 1980 |   0  | 400 |  50   |
|                         | 12   | 1500 | 1980 |   0  | 400 |  50   |
|                         | 13   | 1620 | 1980 |   0  | 400 |  50   |
|                         | 14   | 1740 | 1980 |   0  | 400 |  50   |
|                         | 15   | 1860 | 1980 |   0  | 400 |  50   |
+-------------------------+------+------+------+------+-----+-------+
|UK MF2 Back/w signalling |  1   | 1140 | 1020 |   0  | 400 |  50   |
|                         |  2   | 1140 |  900 |   0  | 400 |  50   |
|                         |  3   | 1020 |  900 |   0  | 400 |  50   |
|                         |  4   | 1140 |  780 |   0  | 400 |  50   |
|                         |  5   | 1020 |  780 |   0  | 400 |  50   |
|                         |  6   |  900 |  780 |   0  | 400 |  50   |
|                         |  7   | 1140 |  660 |   0  | 400 |  50   |
|                         |  8   | 1020 |  660 |   0  | 400 |  50   |
|                         |  9   |  900 |  660 |   0  | 400 |  50   |
|                         |  0   |  780 |  660 |   0  | 400 |  50   |
|                         | 11   | 1140 |  540 |   0  | 400 |  50   |
|                         | 12   | 1020 |  540 |   0  | 400 |  50   |
|                         | 13   |  900 |  540 |   0  | 400 |  50   |
|                         | 14   |  780 |  540 |   0  | 400 |  50   |
|                         | 15   |  660 |  540 |   0  | 400 |  50   |
+-------------------------+------+------+------+------+-----+-------+


CCITT 4
~~~~~~~

Hardly used in modern systems, CCITT4 is a binary digit based system. It is inband and uses voice
frequencies to signal it. It was the old "European System" that linked Europe together. It 
predates CCITT 5, and is from the 1950s. It was designed with operators in mind, and the result
is it is very simple to bluebox if you use the correct tones and routings.

It is extensively used in Africa, but may be found in remote places in Russia and Eastern Europe 
such as the Urals where many exchanges date back to the 1920s. It may also be found in limited 
use in remote parts of Asia, in developing nations. 

CCITT 4 has had somewhat of a renaisance, as R2 can be configured to use the CCITT4 signals on
low bandwidth connections or when it needs to be interworked.

The address signals have 35mS pause between each beep and 100mS pause (minimum) between each 
digit. Minimum time to send a digit (including pause) is 345mS. 

   x:     2040                35mS (binary "1") 
   y:     2400                35mS (binary "0") 
   X:     2040                100mS 
   Y:     2400                100mS 
   XX:    2040                350mS 
   YY:    2400                350mS 
   P:     2040+2400           150mS 

   Clear Forward:     PXX 
   Transit Seizure:   PX 
   Forward Transfer:  PYY --> Sometimes used in R2 as a break tone
   Terminal Seizure:  PY 

ADDRESS SIGNALS:
			    1    2    3    4
      
      1               y    y    y    x
      2               y    y    x    y
      3               y    y    x    x
      4               y    x    y    y
      5               y    x    y    x
      6               y    x    x    y
      7               y    x    x    x
      8               x    y    y    y
      9               x    y    y    x
      0               x    y    x    y





SOCOTEL
~~~~~~~

I've never encountered Socotel, as far as I know... BillSF wrote the following on the subject
of the French SOCOTEL system. As for its uses today, it's probably only used in rural areas of
France and/or French colonies or former French colonies, it may well be found in Ivory Coast 
and other such places.

Socotel is a general system developed by the French. It is a hodgepodge of many systems, using 
MFC, pulse tone, pulse AC and pulse DC system. Most (all?) line signalling tones can be used. 
An inband system can use 2500Hz as a clear forward and 1700 or 1900Hz for seize or, in Socotel 
terms, "confirm". Most line signalling today is "out of band", but unlike normal outband 
signalling, it is below band: DC, 50Hz or 100Hz. It is a "brute force" system using 100V levels, 
insuring no customer has a chance of getting it directly! Call setup on the AC systems often has 
a very characteristic sound of of short bursts of 50Hz or 100Hz buzz, followed by the 
characteristic French series of 500 Hz beeps to alert the customer that the call has been 
received from the Socotel by the end office and is now being (pulse) dialed. Calls often don't 
make it through all the gateways of a Socotel system, sometimes giving the French phreak a 
surprise access where it stuck! 








"No fair, this trunk won't route!"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Well, there are lots of nasties that telcos use to prevent you from routing there trunks...

The Basics:

-* Unidirectional trunks, these only call Kp1 or nearby on Kp2.

HOW TO GET AROUND THEM: Kp1 into the country, re-seize then route Kp2 according to the template
the country uses. Also, try using an international sender: Kp1-011-cc-ST and then you can Kp1
to the country the sender is for.


-* Non standard routing, i.e discriminating digit in the wrong place, doubling of the dd etc.

HOW TO GET AROUND THEM: Experiment! Move the descriminating digit to the front of the dialstring.
Also, try adding a 0 to the digit, Kp2-00-44-181-811-8181-ST... 01 has been known to work as 
well. Social engineer the Code11 is need be...


-* Calls terminate after about 5 minutes, they just hang-up!

HOW TO GET AROUND THEM: Try sending the seize AFTER answer.


-* Trunks wait... pause... and then give an reorder.

HOW TO GET AROUND THEM: Make sure it's hearing the digits, esp the Kp. Also, maybe the dialling
is too quick or too slow. Zone 1 c5s use quick dialling.


-* After hearing the first few digits, it makes a noise and hangs up...

HOW TO GET AROUND THEM: Either you are on a unidirectional trunk, or it uses non-standard 
routing. Try those tips first. If you still get a problem, try routing to Code11...

Kp1-2-Code11-ST

If that doesen't work, then the country you are boxing could use a routing "trick" such as 
Iceland used to use (c5 until about July 1999). As one time: Kp1-01-44-number-ST would work.
The code then changed to some bizarre pattern that meant you had to MF in the route from the UK
your call was coming from (?) something like:

Kp1-01-44-ST-Kp2-44-0-areacode you want to call-number you want to call-ST

This was given to me by an anonymous party.


Other problems may be that FORWARD AUDIO MUTING is used. The CCIS protion of the route detects
the loss of surpervision at the distant C5 end and mutes forward audio. This is a problem R1 
blueboxers have in the US. Also, a friend of mine who is on Telewest and who used to be on NTL
tells me that cable digital local loops and switches are ultra-sensitive to calls being hung-up
"PLEEP PLEEP" and therefore give errors if seizes are sent before answer on certain routes
and are known to be VERY temperamental.



CONCLUSION
==========

Well that just about wraps up this detailed guide. A lot of this info was typed/passed on to me
by an associate who would like to remain anonymous. I have no details for this guy, so don't ask.

It's been... ok, writing this guide. It took a lot of time but I feel it makes a nice file to end
the 20th century with. It'd be nice to see some people starting with R2 blueboxing, it would be
good to develop that.

I hope you've all enjoyed reading this guide, and have learned about the joys of international
switching.

I have one final note before I leave you to experiment with this: 

			**-BLUEBOXING IS NOT JUST ABOUT FREE CALLS-**

When people see blueboxing in this light it REALLY makes my blood boil. I didn't spend half a 
year or more writing a guide so that some theif can get "get free callz". The point of this guide
is to educate people on the fun that can be had routing calls, and learning hands-on about 
switching and signalling. The information in here is hot, and I really would hate it if someone
started abusing this information for the single purpose of free calls. Yes, free calls are nice,
and part of blueboxing is getting a free call. Afterall, British Telecom deserve it because they
bleed the nation dry with such overpriced call charges and services. But I'd like to think that
this guide would inspire you people (yes, YOU) to take an interest in the systems I've discussed.

When blueboxing, I really do reccomend you spread your calls over several numbers to minimise the
impact and keep you out of trouble. Bear in mind that "they" _do_ know what you are doing, and
if you have ever done a scan of numbers, they will have a monolog on your line. Also, they do 
have logs of you, and they can set-up CCITT 5/MF logging, although these logs are known to be 
innaccurate (afterall MF is voice frequency, and line faults do occur in international switching)
and therefore are not fully admisable for a conviction. 

So my advice is, have fun, take care and please don't just use it for free calls, it's worth more
than that surely.

Well, it's December the 27th, 16:58 and the year is 1999. I expect some people will be reading 
this in maybe in even 10 years time, such is the longevity of a long guide to this sort of thing.

- de-phone/phed-one/dynamics

blue.box@nicaragua.com








