




  BIOC AGENT 003'S COURSE IN   [BASIC TELECOMMUNICATIONS]     Part I
   Revised 18-July-84                   Word Processed by Tharrys Ridenow

 [PREFACE]:
  In this course, I plan to cover as much  material  as  possible  relating  to
telecommunications.   First  in  the  syllabus are  the Long-Distance (LD) Ser-
vices, which are the topic of Part I.  In future issues, such subjects  as  the
network, colored boxes, telephone electronics, central office equipment, opera-
tors, special #'s, and much, much more will be covered.

 [LONG-DISTANCE SERVICES]:
  In an attempt to offer lower prices, alternatives to Bell have been  set  up.
Services  such  as  SPRINT, Metrofone, ITT, MCI, Travelnet, and many others are
all familiar to us.  These services are known as  Specialized  Common  Carriers
(SCC's)  or  Other Common Carriers (OCC's).  <Don't confuse this with Switching
Control Center, also known as SCC.>
  The basis of all these services are that they on their own  switching  equip-
--More--(7%)
ment.   First,  we  will  look at those services which use a local dial-up. The
--More--(7%)
principle of these are:
--More--(8%)
 1)  You dial the local #,
--More--(8%)
 2)  When it picks up, you get a second dial tone, then enter a code.
--More--(8%)
 3)  You then enter the destination #, and voila!, you're  connected!   A  free
     call!

  Next we will look at several of the services...
  (Note:  A/C and NPA are abbreviations for Area Code, pfx=prefix, sfx=suffix)

 SPRINT:
  Sprint, also known as SPC, was one of the first  LD  services.   Many  boards
contain  SPC  #'s,  and I plan to include a list of them as an appendix to this
course so you can find your local #.  (Another, more dangerous, way is by  cal-
ling 1-800-521-4949, asking the nice lady at the other end of the line for your
local SPRINT access number, complaining that your autodialer had  it  but  just
crashed.)
  The codes for SPC are 8 digits long.  SPC is not considered safe, since  many
people have been busted on it!  It is common knowledge that SPRINT has declared
war on phreaks.  So, fight back (with care)!
  Some dialups:  914-997-1616      415-777-1211     415-832-5016
  Format:  At tone--->  8 digit code+A/C+pfx+sufx

 METROFONE:
  Metrofone, run by Western Union, is very popular among phone phreaks  due  to
the large abundance of codes and it (at the time of this writing) is considered
--More--(17%)
fairly safe. 
  Recently (7/84), Metrofone has allegedly been placing "trap codes"  on  BBS's
which are being traced.  I suggest that you hack your own for safety purposes.
  The code is 6 digits long.  To find out the local dial-up for your area,  use
the procedure under SPRINT with 800-325-1403.
  Format:  At tone--->  6 digit code+A/C+pfx+sufx

 ITT:
  ITT is a little different in that upon hearing the dial  tone  after  calling
the  local  access  #,  you enter the A/C and then the #.  You will then hear a
short tone, then immediately enter your 7 digit access code.
  Format:  At tone--->  A/C+pfx+sufx, beep, 7 digit access code

 MCI:
  MCI has dial-ups in most areas but the codes are not interchangable (i.e.,  a
code that works for the New York dial-up will not work for the Boston dial-up.)
  Format:  At tone--->  5 digit code+A/C+pfx+sufx

 MCI CREDIT CARD  (MCI CC):
  This MCI service,  also known as MCI Execunet,  is for people  who  travel  a
lot  (i.e. business pigs) and need a code that works in several places.  There-
fore, the codes on THIS system are interchangable throughout the  dial-ups  un-
--More--(25%)
like the regular MCI service.
  Format:  At tone--->  7 digit code+A/C+pfx+sufx

 SKYLINE:
  SBS Skyline is a new service owned by IBM, Comsat, and  Aetna.   It  has  the
same  local  access  # across the country:  950-1088.  It is supposed to have 6
(possibly 8) digit codes and is alleged to be very dangerous.
  Most of the services in 950 have crystal clear connections.

 CALLING CARDS:
  Calling Cards are Bell's version of SPRINT, MCI, etc.  Calling Cards are used
primarily  from pay phones.  The format is:  NPA+pfx+sufx+CCCC.  NPA is usually
the A/C of the billed # that the call is to be billed to.  This may be replaced
by  a  three digit RAO (Revenue Accounting Office) code in some NPA's or a spe-
cial billing number.  Pfx-sufx is the number that the call is billed to.   CCCC
is  a checkcode (or PIN, Personal Identification Number) that adds the security
to calling cards.  The codes used to be predictable until 1983.  Now  CCCC  ap-
pears  to  be  sequentially  generated so the codes cannot be calculated from a
formula!
  The easiest way to find these codes is in a busy  airport  or  college  where
they  are  used a lot.  Just get close and copy down someone's code (if you are
that unscrupulous!).  Don't rip off poor people--  go  for  the  rich  business
--More--(34%)
pigs!        
  You usually call the operator to make a CC call but on many  fortress  fones,
you  can  dial 0+<the number you want to call> and you will get a recording and
tone where you enter your calling card #.  By pressing the # sign  (octothorpe)
after  each call instead of hanging up, you can make many calls at once without
having to retype the CC # each time.  This is good for busy numbers.  Also,  if
you  want  to call the # of the card, i.e. the billed #, you just have to enter
the last four digits of the CC # at the tone.
  Now, suppose you do get a real operator.  Since mostly  business  people  use
calling  cards,  it  is suggested that you act a little like a business person-
i.e. rushed, older, businesslike, and slightly pissed at the operator (keyword:
slightly).   All  you  have to tell her is the CC #.  If she asks for the # you
are calling from, tell her, but change the last digit or two.  If she asks  you
more  questions,  she  is probably suspicious, so hang up.  Although you SHOULD
make up some answers to certain questions to satisfy the operator that you  are
legit.  The  most  important thing you should know when making a CC call is the
area code and city of the card.
  Finally, in case the operator is listening, always talk businesslike for  the
first few seconds until the operator clicks off (they have been known to listen
in on calls [understatement!]).  Also, always  use  CC's  from  pay  phones  or
charge-a-call fones only!

--More--(45%)
  CAUTION:       All the CC codes are now rapidly checked due to CCIS (Common
            Channel Inter-office Signaling) and ESS (Electronic Switching
            System).  If you try to hack CC codes you can be fairly sure that
            Bell security (affectionately known in the phreaking world as the
            Gestapo) will get a message from the CO (Central Office, i.e.
            exchange)!

 [800 SERVICES]:
  You are probably all familiar with WATS.  WATS #'s (Wide Area Telephone  Ser-
vice,  otherwise  known  as 800 #'s) are very popular due to the fact that they
are toll-free.  They often contain WATS extenders.  Extenders  were  originally
used  by  salesmen  in the field who called up their company's 800 # (INWATS #)
and then used the company's low-priced OUTWATS line to make the call.  This  is
cheaper  to  the  company  than  using the Bell calling card which makes a sur-
charge.
  On the original extenders there were no codes!  Companies soon realized  that
their #'s were being used and added the present-day security codes.  The sales-
man would then dial the 800 number and enter the code (usually  4  digits),  he
would  then  receive  a second dial tone from the company's PBX (Private Branch
Exchange - their own switching equipment, i.e. switchboard).  He would then ac-
cess  the OUTWATS line by dialing 8 or 9 and then the #.  These codes were ori-
ginally hand-hacked, but some pioneer phreak (Captain Crunch) added  an  inter-
--More--(56%)
face  to  Charlie,  his Apple ][ computer, which was capable of generating DTMF
tones (Dual Tone Multi Frequency, i.e. generic term  for  touchtone  (TM))  and
trying  all  the  codes.  The only problem was that Ma Bell got suspicious when
they saw that someone had called the Joe Blow Rubber Company 800 # in  Califor-
nia 4,568 times at 2 am and each call lasted for only 1 second!

 TRAVELNET:
  Travelnet is a service, owned by GM, that uses WATS as well as  local  access
#'s.   The  800  #  is  800-521-8400.  
Format:  At tone---> 8 digit code, tone, A/C+pfx+sufx.
  Travelnet is also unique in that it accepts voice recognition for those times
when  touch-tone  is not available (how convenient!).  If you don't do anything
after the tone, you will hear a voice that says "Authorization #, please."  You
then say each digit slowly.  It will beep after you say each digit.  After each
group of digits, it will repeat what you have said.  Say YES if  it  is  right,
otherwise  say NO.  If the authorization code is correct, it will say thank you
and then ask for the destination #.  Follow the same procedure as  above.   The
voice system is very user friendly and you should have no problems with it.

 TEL-TEC:
  Tel-Tec is at 800-323-3026.  In my experiences, you usually get a very s***!ty
connection.   This  I use for last resorts.  Format:  AT tone---> 6 digit code+
--More--(66%)
A/C+pfx+sufx.  Tel-Tex (for TX only):  800-432-2071.

  Caution:      Like the 950 exchange, 800 numbers can be easily traced.  This
           doesn't mean that they trace everything, though.

 OTHERS:
  There are many other 800 services and PBX's (such as Dimension 2000  at  800-
848-9000).   There  is  just  not enough room to discuss them all.  As you have
probably noticed I have posted no codes.  Check the phreak section  of  various
BBS's to find the latest codes or hack them yourself.  I suggest that you don't
use codes found on BBS's though, since they may be traps!  Hand-hack good  pos-
sibilities  or  use  a "smart" modem with a hacking program (contact your local
pirate).

 [HOW MA BELL CATCHES PHONE HACKERS]:
  Besides suspicion and random checks, Ma Bell sets up  "trap  numbers."   Trap
numbers were set up on certain dial-ups such as Sprint, MCI, etc.  Whenever the
dialup is called a "trouble card" is dropped at the central office.  This means
that a record of the called #, the CALLER'S #, and time are printed out.  These
cards (or printouts in an ESS CO) are usually ignored unless  SPC  or  somebody
detects  fraud, i.e., unauthorised use of a customer's account.  Then they call
Bell and find out the name and number and instantly nail the  phreak  who  made
--More--(75%)
the  call.   They  will  then  either demand that you pay some enormous fee and
they'll forget the whole matter; give them info on other phreaks, boards, etc.;
or  prosecute  you on the federal rap of Theft of Communications Service, which
carries fines of up to 10 years in jail and/or $10,000.  They don't usually  go
for  legal action first, though.  If you don't actually use any codes, they can
still nail you for harassing fone calls.
  "Trap and Trace" is another favorite of the Gestapo.  With  this  method  you
cannot hang up until the trace is completed!
  Why does Bell help their competition?  Actually, it is rather simple.  People
were  using  SPRINT  to break into Bell's ESS computers.  Bell could only trace
the calls back to SPRINT.  So, SPRINT helps Bell catch the people it wants  and
vice-versa.  ("You rub my back and I'll rub yours" type of deal.)
  By the way, trap numbers are also how Bell catches people who make  harassing
phone calls to private residences.
  Also, certain TelCo exchanges running ESS  (see  Part  IV)  generate  reports
called  the  "800  Exceptional Calling Report" which lists people who have made
extensive or long calls to 800 #'s.  Since many people use legit 800's  a  lot,
they also wind up on the list.  If Bell does have a certain problem with an 800
#, though, they just have to check their records.
  If Bell has sufficient reason to suspect you of illegal activities, they  may
put  a  pen  recorder  on your line to record every single digit you dial along
with other pertinent information.
--More--(87%)
  Finally, do not forget that these services have a copy of the number that you
called.  So, if a customer says that he didn't call a certain #, they will usu-
ally call up that # and try to find out who did call at that time.
  So, to be safer on SPC, MCI, and others, follow the following suggestions:
  1)  Use a fortress fone (pay phone) whenever possible.   Although  they  have
been  known  to  stake out pay fones...   Just don't use the same fone over and
over again.  In other words, move around.
  2)  Only call institutional switchboards, businesses that have no  record  of
your call, and friends who are instant amnesiacs.
  3)  Try to keep all calls under 15 minutes when possible.
  Note:  No system is totally safe!  When  I  classify  something  as  safe  or
dangerous,  that is my opinion as well as that of several other phreaks.  These
opinions are based on how many people have been busted on them,  what  type  of
equipment  they are using, and inside information.  I cannot possibly guarantee
that you will not be caught.  Actually, with CCIS and  ESS  nothing  is  really
safe  anymore.  Besides, what phun whould there be in life without a few risks?
Also, I have known people who used 800 #'s and SCC's for  several  years  daily
with  no  problems..   I also know people who used a system for a week and were
busted!

  At this point, I would like to mention the "official" phreak newsletter, TAP.
TAP  contains  much information about phone phreaking and other illegal activi-
--More--(98%)
ties.  Send an SASE for their info sheet, "What the hell is  TAP?"   Their  ad-
dress is:
                    TAP
                    Room 603
                    147 West 42nd Street
                    New York, New York  10036

Please enter either [file-name], [l], [h], [q], or [?] 






      BIOC AGENT 003'S COURSE IN    [BASIC TELECOMMUNICATIONS]   Part II
   Revised 18-July-84                   Word Processed by Tharrys Ridenow

 PREFACE:
    In Part II, we will explore the various special Bell #'s, such  as:   CN/A,
AT&T Newslines, loops, 99XX #'s, ANI, ringback, and a few others.

 CN/A  :  Customer Name and Address

    CN/A, which stands for Customer Name and Address, are bureaus that exist so
that  authorized Bell employees can find out the name and address of any custo-
mer in the Bell System.  All #'s are maintained on file including unlisted #'s.

  Here's how it works:

 1)  You have a # and you want to find out who owns it, e.g. (914) 555-1234.
 2)  You look up the CN/A # for that NPA in the list below.   In  the  example,
--More--(3%)
the NPA is 914 and the CN/A # is 518-471-8111.
 3)  You then call up the CN/A # (during business hours) and say something like
"Hi,  this  is  John Jones from the residential service center in Miami.  Can I
have the customers name at 914-555-1234.  That #  is  914-555-1234."   Make  up
your  own REAL sounding name, though.  Or, if you sound mature enough, just say
"Look up 914-555-1234 please."
 4)  If you sound natural and cheery, the operator will ask no questions.

NOTE:  Due to the break-up, several operating companies are now asking  for  ID
#'s when you make a request.  This has recenty happened to me in 617 and I just
told the operator that I was calling from the so-and-so business office in  New
York, and she said that she'll put it through this time!


Here's the list:

 NPA   CN/A #        NPA   CN/A #        NPA   CN/A #        NPA   CN/A #
 ---  ------------   ---  ------------   ---  ------------   ---  ------------
 201  201-676-7070   202  202-384-9620   203  203-789-6815   204  204-949-0900
 205  205-988-7000   206  206-382-8000   207  617-787-5300   208  303-293-2333
 209  415-546-0118   212  518-471-8111   213  213-501-3255   214  214-698-9711
 215  412-633-5600   216  614-464-2345   217  217-525-7000   218  402-345-0600
--More--(9%)
 219  317-265-4834   301  301-534-1168   302  412-633-5600   303  303-293-2333
 304  304-344-8041   305  912-784-0440   306  306-347-2878   307  303-292-2333
 308  402-345-0600   309  217-525-7000   312  312-769-9600   313  313-223-8690
 314  314-726-7142   315  518-471-8111   316  816-275-2782   317  317-265-4834
 318  504-245-5330   319  402-345-0600   401  617-787-5300   402  402-345-0600
 403  403-425-2652   404  912-784-0440   405  405-236-6121   406  303-293-2333
 408  415-543-6374   412  412-633-5600   413  617-787-5300   414  608-252-6932
 415  415-546-0107   416  416-922-6686   417  314-726-7142   418  514-287-5151
 419  614-464-2345   501  405-236-6121   502  502-583-2861   503  503-241-3440
 504  504-245-5330   505  303-293-2333   506  506-648-3041   507  402-345-0600
 509  206-382-8000   512  512-828-2501   513  614-464-2345   514  514-287-5151
 515  402-345-0600   516  518-471-8111   517  313-232-8690   518  518-471-8111
 519  416-922-6686   601  601-961-0877   602  303-293-2333   603  617-787-5300
 604  CLOSED 9/82!   605  402-345-0600   606  502-583-2861   607  518-471-8111
 608  414-252-6932   609  201-676-7070   612  402-345-0600   613  416-922-6686
 614  614-464-2345   615  615-373-5791   616  313-223-8690   617  617-787-5300
 618  217-525-7000   701  402-345-0600   702  415-546-0118   703  804-747-1411
 704  912-784-9111   705  416-922-6686   707  415-546-0107   709  ****N/A*****
 712  402-345-0600   713  713-820-4112   714  213-501-3255   715  608-252-6932
 716  518-471-8111   717  412-633-5600   801  303-293-2333   802  617-787-5300
 803  912-784-0440   804  304-344-8040   805  415-546-0118   806  512-828-2501
 807  416-922-6686   808  212-334-4336   809  212-334-4336   812  317-265-4834
--More--(16%)
 813  813-228-7871   814  412-633-5600   815  217-525-7000   816  816-275-2782
 817  214-698-9711   819  514-287-5151   901  615-373-5791   902  902-421-4110
 903  ****N/A*****   904  912-784-0440   906  313-223-8690   907  ****N/A*****
 912  912-784-0440   913  816-275-2782   914  518-471-8111   915  512-828-2501
 916  415-546-0118   918  405-236-6121   919  912-784-0440

    Bell uses these #'s find out who owns a # that a customer claims  he  never
called.

    Some CN/A #'s remain the same for long periods of  time;  others,  such  as
those  in  NPA's 213 (and other California Area Codes) change quite frequently.
The 213 CN/A  (also used for the new NPA's 818 and 619) usually  remains  some-
where in the 213-501-XXXX exchange.
    For the CN/A # for the 900 SAC and the 976 exchange call the local  CN/A  #
or 212-334-3611.
 NOTE:  This is the most complete list of CN/A #'s in my possession  which  was
procured from by business office.
    Another "cheap way" of doing a CN/A without knowing the CN/A # is  to  call
the local business office of the area where the fone # you want to check is lo-
cated.  Then make an inquiry into something.  When the representative asks  for
your  #,  give  him  the # you want checked.  Chances are that he will say, "Is
this Mr. X" and you now know who the line belongs to.
--More--(22%)
    Incidentally, if you tell the Telco to make your directory  listing  appear
as  Jack  Meoff,  Yog  Sothoth, or a similar pseudonym with no address you will
avoid an unlisted # charge.  Also, if some a**hole tried to pull a CN/A on your
#  (or  your  BBS #), the CN/A operator will tell them that the line belongs to
Yog Sothoth.  You can still have the  bill  sent  to  your  real name,  though,
without affecting the CN/A.
    There is also a type of reverse CN/A bureau.  This is  usually  called  NON
PUB  DA or TOLL LIB.  These #'s would most certainly change immediately if they
were published here.  With these #'s you tell them the name and locality.  Then
they  shake  you down for your name, supervisor's name, etc. if you haven't al-
ready told them.  They will ask you a few other questions which, if you  answer
them  with  the  right  incantation or practice the art of "social engineering"
(AKA bulls***!ting) you have the unlisted #!  You can also get detailed  billing
information from these bureaus.

  AT&T NEWSLINES:
    Newslines are recordings that Bell employees call up to find out the latest
info on stock, technology, et cetera concerning the Bell System.
    Here are the #'s that are currently known to phreaks (at least me, anyway):

 201-483-3800  New Jersey     203-771-4921  Connecticut   212-393-2151 New York
 213-621-4141  California     213-829-0111  CA--GTE    213-449-8830  California
--More--(29%)
 312-368-8000  Illinois       313-223-7223  Michigan   314-247-5511  Montana
 408-493-5000  California   412-633-3333  Pennsylvania  414-678-3511 Wisconsin
 416-929-4323  Ontario      503-228-6271  Oregon   513-421-9060  Ohio
 516-234-9914  New York     518-471-2272  New York  617-955-1111  Massachusetts
 702-789-6711  Nevada       713-224-6116  Texas   714-238-1111 California
 717-255-5555  Pennsylvania  717-787-1031  Pennsylvania  802-955-1111  Vermont
 808-533-4426  Hawaii   813-223-5666  Florida   914-948-8100  New York
 916-480-8000  California

  Rev--  With the break-up, some of the above #'s are going to change, but AT&T
still plans on keeping this service.
    Also, many of the smaller companies, such as NY Telephone, have  their  own
newswires.  Here is a list of NYTelco newswires:
  212-395-2200             314-476-4492            516-234-9914
  518-471-2272             716-847-1950            914-390-2055


 LOOPS
  First of all, you must understand the concept of loops.   I  think  that  the
best way that this is understood is the way that Phred Phreek explained it...

    "No self-respecting Phone Phreak can go through life without knowing what a
--More--(34%)
loop is, how to use one, and the types that are available.
    "The loop is a great alternative communication medium that has many  poten-
tial  uses  that haven't even been tapped yet.  In order to explain what a loop
is, it would be helpful to visualise two fone  numbers  (lines)  just  floating
around  in  the  Telco Central Office (CO).  Now, if you (and a friend perhaps)
were to call these two numbers at the same time, POOOOFFF!!!, you are now  con-
nected  together.   I  hear  what  you're  saying out there- 'Big deal' or 'Why
should Ma Bell collect here two MSU's  (MeSsage  Units)  for  one  lousy  phone
call?'
    "Well...  think again.  Haven't you ever wanted someone to  call  you  back
but  were  reluctant to give out your home phone number (like the last time you
tried to get your friend's unlisted number from the business office)?   Or  how
about  a  collect call to your friend waiting on a loop, who will gladly accept
the charges?  Or better yet, stumbling upon a loop that has multi-user capacity
(for  those  late-night  conferences).  Best of all is finding a non-supervised
loop that doesn't charge any MSU's or tolls to one or both  parties.   Example:
many moons ago, a loop affectionately known as 'The 332 Loop' was non-sup (i.e.
non supervised) on the tone side.  I had my friend in California dial the  free
(non-sup) side, (212) 332-9906 and I diled the side that charged, 332-9900.  As
you can see, I was charged one MSU, and my friend was  charged  zilch,  for  as
long as we wished to talk!"

--More--(41%)
    Ahhh...  have I perked your interest yet?  If so, here is  how  to  find  a
loop of your very own.  First, do all of your loop searching at NIGHT!  This is
because the loops serve a genuine test function which the Telco uses during the
day.   (We  don't  want  to run into an irate lineman, do we?)  To find a loop,
having two #'s is a definite plus.  If not, have a friend  dial  #'s  from  his
phone.  Last resort, try calling from two adjacent pay phones.
    Now, get your trusty white pages (*), and turn to the page where  it  lists
the  # of MSU's from your exchange (or exchanges in your primary calling area).
The idea is to find a loop that is within your primary calling area or is  only
1  MSU  in your area (call area A).  This is so you don't go bankrupt trying to
find a loop.  Write down all of these exchanges and do a 99XX scan of those ex-
changes.  (99XX scanning will be discussed shortly.)
    Before we get up to 99XX scanning, we will look at some other loop info:

   Loops are found in pairs which are usually close to each other.   For  exam-
ple,  in  NPA 212, where the infamous loops are found, there is a standard loop
format:
   Manhattan and Bronx:    NNX-9977/9979
   Brooklyn and Queens:    NNX-9900/9906

    NNX is the exchange to be scanned.  Here are  some  loops  that  have  been
found  in  NYC.   These are used mostly by phreaks and call-in lines for pirate
--More--(47%)
radio stations:

  212-220-9900/9906    212-283-9977/9979     212-352-9900/9906
  212-365-9977/9979    212-529-9900/9906     212-562-9977/9979
  212-982-9977/9979    212-986-9977/9979

    [Editor's note:  On the West Coast, the plan can change  slightly:  in  the
San  Francisco  Bay Area loops are found in the 00XX prefix, such as the one in
415-540-0044/0045.  Loops are rather scarce in the 415 area,  but  the  pair in
0044/0045 is a good bet when scanning, like the standard format above.]

    The lower # is the tone side (singing switch).   The  higher  #  is  always
silent.   The tone disappears on the lower # when somebody calls the other side
of the loop.  If you are on the higher number, you'll have  to  listen  to  the
clicks  to  see  if  somebody dialed-in.  The NYC 982 & 986 loops are different
from others.  Usually when you park on a loop, you will hear who ever calls  in
on  the other half.  When they're done, the next caller (if any) will be queued
in, one after another.  On the NYC 982 & 986, you sometimes can't get any  more
callers  in  after  the first.  Furthermore, if you park one of these loops and
there is nobody on the other end for more than 4 minutes, you may be  automati-
cally  disconnected.   These  loops are good for backup purposes when all other
loops are busy.
--More--(53%)

             
 99XX Scanning:
    Many exchanges in the Bell System have a wide variety of test #'s and other
"goodies," such as loops.
    These "goodies" are usually found between 9900 and 9999 in your  local  ex-
change.   If  you  have the time and initiative, scan your exchange and you may
become lucky!
    Here are my findings in 914-268:
       9901:  Verification (recording of a/c and exchange)
       9936:  Voice # to the Telco CO
       9937:  Voice # to the Telco CO
       9941:  Carrier
       9960:  Osc. Tone (tone side loop)
       9963:  Tone  (stops: muted)
       9966:  Carrier
       9968:  Tone that disappears--responds to certain touchtone keys
    Most of the #'s between 9900 and 9999 will ring, be busy, go to  a  special
intercept  operator  ("what  #,  please")  or  will go  to  a  "the  # you have
reached..." recording.  What you find depends upon the switching  equipment  in
the exchange and the Telco operating company.
    When searching for loops, you may find one of the  following  possibilities
when you find one:
--More--(58%)
  1.   You can hear through the loop (not muted) but  there  is  a  1/2  second
       click every 10 seconds that interrupts the audio.  This type is good for
       backup use but the @#$&% click is super annoying.
  2.   One side of the loop is busy; try it again later.
  3.   The tone disappears, but you cannot hear through it (the loop is muted,
       try again in a month or so).
  4.   You get the "The # you have reached..." recording.  No loop there!

    Most loops are muted (#3),  but their status does change from time to time.
It all depends if the  Telco  maintenance  personnel  remember  to  "throw  the
switch" i.e. turn off the loop.
    Since I have done the above 914-268-99XX scan, Congers (268) has  installed
new switching equipment (DMS100).  Some of the numbers are the same, but I have
noted that on the DMS100, the recordings are also stored in  this  area.   268-
9903,  9906,  9909,  and  9912 are all different recordings.  Also, there are 2
fortress fone recordings at 268-9911 (deposit 5 cents  or  else)  and  268-9913
(deposit  10  cents).  None of these recordings supe and alot of other 99XX #'s
don't supe either.
    In Washington, there is a sweep tone test at (202) 560-9944.   [Sweep  tone
tests  are  used  to  detect  infinity  transmitters (aka harmonic bugs) on the
line.  In the 415 area, NNX-0046 is almost always a sweep tone test.]

--More--(64%)
In NYC (212), you'll find the infamous loop lines (as mentioned above).
    It will be easier to scan your exchange if you make up a chart like this:


 .------------------NPA-NNX-(99/00) XX SCAN CHART----------------.
 |  Number    .=0==.=1==.=2==.=3==.=4==.=5==.=6==.=7==.=8==.=9== |
 |  990       :    :    :    :    :    :    :    :    :    :     |
 |  000       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  991       :    :    :    :    :    :    :    :    :    :     |
 |  001       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  992       :    :    :    :    :    :    :    :    :    :     |
 |  002       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  993       :    :    :    :    :    :    :    :    :    :     |
 |  003       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  994       :    :    :    :    :    :    :    :    :    :     |
 |  004       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  995       :    :    :    :    :    :    :    :    :    :     |
--More--(70%)
 |  005       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  996       :    :    :    :    :    :    :    :    :    :     |
 |  006       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  997       :    :    :    :    :    :    :    :    :    :     |
 |  007       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  998       :    :    :    :    :    :    :    :    :    :     |
 |  009       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 |  999       :    :    :    :    :    :    :    :    :    :     |
 |  009       :    :    :    :    :    :    :    :    :    :     |
 |---------------------------------------------------------------|
 | B- Busy   (try again at another time)    C- Carrier (computer)|
 | I- ignore (at a higher #= loop)  O- intercept Operator ("What |
 | # you callin'?"   R- rings  (try again at another time)       |
 | Rn- Recording (make a note of what types)  S- sweep tone test |
 | T- tone (tone at a lower # + ignore)  V- voice # to the Telco |
 | Central Office, usually answer with the city name and area.   |
 \---------------------------------------------------------------/

--More--(76%)
   This leaves you with 100 boxes (1 for  each  number  between  (99/00)00  and
(99/00)99.  You should make your boxes big enough so you can write some sort of
shorthand like that given above in them.
   There will be others and you should find interesting tones, noises, and oth-
er test functions.  Also, the more important the exchange is, the more you will
find.  For example, in 914-623, I found well over 10 voice #'s!
    Also, loops are USUALLY, but not EXCLUSIVELY found in the  99/00XX  series.
For example, 713-324-1799/1499 is a loop.

    What is the perfect loop?  Here is what I would look for:
 1.  Non-sup on one or both sides.  To check for a non-sup loop, go to a  tone-
first  fortress  fone and dial the #.  If it asks for a dime, it is supervised.
If the call goes through, then it is non-suped!
 2.  800 loops would be a plus.  They are not necessarily  found  between  9900
and 9999, though.  I would check the 1XXX series first.
 3.  Multi-user loops are also a plus for those late night conferences.

  NOTE:  If there is nothing in the 99XX area in your exchange or if 99XX is
         used for actual numbers, then try 0XXX and 1XXX scanning in that  ord-
         er.

    Finally, remember that it is only a local call to find out what your CO has
--More--(82%)
in store for you.  If you find anything interesting, be sure to drop me a line.

  NOTE:  Your local white pages can be a valuable asset.  You can also order
         other fone books from your business office (usually free for books
         within your operating company's district).  A large fone book, such as
         Manhattan, contains much more info in the first few pages than other
         books.

 ANI  :   Automatic Number Identification

    Automatic Number Identification is a number that you call up that will tell
you what # you are calling from.
    This has a few uses.  First, were you ever somewhere and  the  fone  didn't
have a # printed on it?  Or perhaps you were fooling around in some cans (those
big boxes on fone poles that contain terminals for lineman use--to be discussed
in a future chapter) and you want to know what the line # is?
    In NPA 914, the ANI is 990.  In NPA's 212 and 516, ANI is 958.  This varies
from area to area.  Here is a list of some ANI's I've seen:
       211/311     401-222-2222   890-751-5191    202-222-2222  222-222-222
       1-XXX-1111 (in some 914 area, esp.  under  step-by-step  switching,  you
       have to dial 1-990-1111)             (760-1111 in 415 area code)

--More--(88%)
    To find ANI for other areas, check 3 digit #'s first, usually  in  the  9XX
series (excluding 911, please!).  In areas under step-by-step, try 1-9XX-1111.
    ANI may also be in 99XX.  Last resort, try to get friendly with your neigh-
bor who works for the fone company.

 RINGBACK

    Ringback, as its name implies, calls back the # you are at  when  you  dial
the ringback #.
    Ringback, in NPA 914, is 660.  You dial 660+ the last 4 digits of the  fone
#  you're  calling  from.  You will then get a tone.  Hangup quickly and pickup
again in about 2 seconds.  You will then get a second tone,  hangup  AGAIN  and
the fone will ring.
    In NYC, it is also 660, but you may have to press 6 or 7 before you hang up
for the first time (ie, at the first tone).
    Other ringback numbers include:
       331 [619/714]   536+nnnn [305]  958+nnnn [202]  (nnnn=last 4 digits of
       fone #)   26011- this 5 digit format is used primarily on step-by-step.
       The last 2 digits (11) are dummy digits.    890-897-nnnn
       119911/11010/0009910  GTE
       350, 850, 580, 890 -nnnn (415 area, payphones)

--More--(93%)
    The reason you get the tone when you pick-up after it rings is  because  in
some  areas,  people  were  using ringback as an in-house intercom.  They would
dial ringback, and when it stopped ringing, they would pickup and talk with the
person  on  the  other extension.  Bell didn't like this since there is usually
only 1 piece of common control equipment in each exchange that does  the  ring-
back.  When people used this as an intercom, repairmen and linemen couldn't get
through!  In some areas, especially under step-by-step, ringback can  still  be
used  as an intercom.  Also, under step-by-step, the ringback procedure is usu-
ally simple.  For example, in one area you would  dial  26011  and  hangup;  it
would then ringback.

 TOUCH-TONE TEST

    In areas that have a touch-tone test, you dial  the  ringback  #.   At  the
first tone, you touchtone digits 1-0.  If they are correct it will beep twice.
    I have also seen a DTMF test in some areas at 890-751-5191.

  Coming Soon:
    In the next part, we will look at the numbering plan and dialing procedures
(ie international, etc.).

  Breakup of Bell:
--More--(98%)
    The operating companies are not going to change all the switching equipment
around.   While  there  will be some changes, most of the information here will
remain pertinent after January 1, 1984.  Just substitute the  word  "fone  net-
work" or "telco" for "Bell System."

    December 8, 1983
    Acknowledgements:  TAP, Phred Phreek, Judas Gerard, The Magician, and  Dark
Priest.




{G-Files} Command <?>: 

Please enter either [file-name], [l], [h], [q], or [?] 