	Well we finally got some stuff to actully release the zine. Hopefully
  Next issue will be easyer to get out on time. I had a computer problem that 
  killed my hard drive witch had the only copy of the zine. Anyways I'm still
  working on the number directory. I've got quite a few number to call and make 
  sure they work.So if you plan on sending number please call them and make sure 
  they work. Thanks to everyone who help us get our 2nd issue out. Hopefully there
  will be alot more.

   ic0n


   Table Of Content (TOC)

  Verizon's Expanded Announcement System............ by captain b and ic0n
  Exchange Scanning............................................ by decoder
  ANI vs. ANAC What are they, and what's the difference?.......... by ic0n  
  Loop Maintenance Operations System (LMOS)............... by Brisk Attivo 
  How To Datu............................................ by Majestic 1/12 
  Maritime Telecommunication Network aka MTN...................... by ic0n  
  Frame Operations Management System (FOMS).................. by Anonymous
                     




                 Verizon's Expanded Announcement System
           Audio file portion by ic0n - Text file by Captain B

  To skip directly to listening to the supplemental audio file first, which will
  let you hear the menu prompts from inside the Expanded Announcement System, go
  to:
       http://goblin.crappyhosting.com/Expanded_Announcement.mp3

Telco error messages... We've all heard one at some point. An atypical error
message usually starts off with those 3 tones, known as S.I.T. (Special
Information Tones) followed by, "We're sorry. The number you have reached...
etc". But, have you ever wondered about the recording process for phone company
error messages, or how they're stored, accessed, modified, or deleted when need
be? Well, if you happen to live in my part of Verizon's service area, Verizon
maintains a phone system they call their Expanded Announcement System. Now, due
to the fairly potent nature of this system, I won't be disclosing certain
important specifics here, such as the phone number to dial, or the passcode to
enter in. But, I will tell you that once inside the system, you can listen to,
record, modify, or delete error messages. The thing I was kind of surprised to
learn about is that a single telco error message is usually 2 or more individual
recordings pieced together to form a single error message. And actually, the
system refers to those individual recordings as a "message". And, an entire
error message put together from those individual message recordings is called an
"announcement". Each individual message in an announcement is stored in a slot,
which the system refers to as a "position". And, every other position in an
announcement seems to be blank. (Doesn't contain a message). I think this is
because it contains a "message function" instead. Which, I believe tells the
system whether to play another message for the next position in the
announcement. And, if so, it would also tell it which one to play. Otherwise,
the announcement is deemed finished, and therefore ends if no message function
is contained in the next position. In other words, a message function serves as
the parameters within an announcement. And, as you probably guessed, there
exists a feature in the menus to "define a message function". And, although I
didn't mess with that feature to play it safe, I imagine it could be a fairly
involved process. By the way, if you were to record over an existing message
with one of your own, all announcements that used that particular message within
it would now feature your re-recording of that message. However, the system
seems to not allow for any recorded messages assigned for use in many
announcements to be recorded over. Apparently, this is some sort of failsafe
measure. However, you can always re-record a message that's hardly assigned much
for use within announcements, or Isn't assigned for use in any announcement.
Also, you can record a brand new message within any blank "message number" that
doesn't already contain a recorded message. Or, just use option 5 from within
the message administration menu (accessible from the main menu) to create a new
message/message number from scratch. The system information feature in the main
menu lets you listen to a list of open announcement numbers, message functions,
and open or unused message numbers. Unused message numbers are recorded,  but
unassigned messages. Different announcements and message functions are stored
seperately in individual announcement numbers, and message function numbers on
the system. Just like how the different messages are stored seperately in
individual message numbers. All in all, Verizon's Expanded Announcement System
is pretty complex and vast, with a storage of thousands of messages, and lots of
announcements and message functions. And, an almost limitless number of ways to
combine them all. As a result, I would guess it could take a pretty good amount
of time to put together an entire announcement. Especially if It's all done from
scratch, rather than through modifying or using any existing messages, message
functions, or announcements. But, I don't think I recommend spending long
sessions logged into the Expanded Announcement System in the first place.
Especially not during regular Verizon business hours. (It's just good common
sense). Also, I don't know whether this system is logging ANI, either. Besides,
It's pretty obvious that they intended this system to be for telco tech
personnel use only, anyway. By the way, you don't have to live in my local or
regional area to access the Expanded Announcement System, since It's dialable
through a standard 10 digit phone number.

Shout outs: ic0n (as always), Hopping Goblin, OldSkoolPhreak.com and all the
Agents of Freedom, Dual Parallel, Stankdawg.com and all the forum krew over
there, all the people behind the screens at hackerhost.com, CueBiz and the
Telco Insiders, Decoder, Unity, Phreakblaze, White Raven, Bagel, Reaver, and all
the old LPH krew. And, the countless people who've helped me an ic0n make our
site www.hackerhost.com/lph what It's grown into.

                            Exchange Scanning
                                by decoder

                                                  August 7th, 2003

	This is not a complete guide to exchange scanning.  There are plenty of
 files on the topic of scanning the full 10,000 block.  I will be focusing
 on the 'test' areas, most commonly found on the 'high end' (99xx) and 'low
 end'(00xx) of an exchange, as well as 'special' exchanges.  This should be
 a useful guide for the beginner, but also interesting and informative for
 even the most seasoned phreak.


 Note: Many people say that the telco has equipment in every central
      office to detect sequential dialing and excessive calls to toll-
      free numbers.  I do all of my scanning from home, by hand. I
      encourage everyone to use their own discretion.


 Introduction.
 -------------

 I happen to live in New York, where exchange scanning is pretty easy.  All
 of the test numbers can usually be found without too much time and effort,
 which is good because I am lazy.  My regional calling area consists of the
 following NPA's:

 212 Manhattan
 917 originally NYC wireless, now also includes land lines in Manhattan
 646 new Manhattan land lines and wireless
 718 Brooklyn, Queens, the Bronx and Staten Island
 347 overlap for 718
 516 Nassau County (Long Island)
 631 Suffolk County (Long Island) *(home of 2600)
 914 Westchester County *(where the X-Men are from)
 845 Rockland & Putnam Counties (and the southern part of Orange County)
 203 Greenwich & Byram Connecticut


 *[phreak phact: three of these NPA's (212, 914, & 203) are original 
  area codes from 1947. back then, customers didn't use the area codes,
  they were only for operators.]


 The most commonly know test number in these area codes is the 'verification'
 number, which can be found on (NPA)NXX-9901.  Keep in mind that this format
 only applies to Verizon owned, land-line exchanges.  (although there are a
 few exceptions)  These verification numbers give you the location of the
 central office, and usually list most of the exchanges handled by that
 particular c.o.  Many people know of the 'Elvis' verification number
 (718 238-9901).  If you've never heard it, give it a call, it's always good
 for a laugh.  There is also a verification number that lists an exchange
 that begins with a one (914 375-9901), which is apparently some kind of
 'inward' exchange. (when you call it, the first exchange listed is 146!)

 Most of these recordings are pretty old so some exchanges listed may not
 work anymore and, of course there are some new ones as well.  Sometimes, in
 places where there has been an area code change, the verification message
 will still give the old one.

 When the exchanges are listed in non-sequential order, the first ones listed
 are usually the oldest.  This is what should be of interest.  I have noticed
 that in my area that the oldest exchanges in a c.o. are where you will find
 most of the test messages, tones, payphone recordings, DATU's, etc.  In New
 York, these are found in the 'high end' (99xx) of an exchange, although
 sometimes they hide the good stuff.  There is a list of DATU's in NPA 718
 making its way around the net, and they are not located in the 'high end',
 they're all on random numbers.  The list has been out for a while and all of
 the numbers and codes still work. (most codes in 718 are NOT default, but
 the codes are kind of simple anyway)  This information originated on the PLA
 (phonelosers) forums, and was posted by an ex-employee of Verizon.  But
 finding a DATU shouldn't be the main objective of exchange scanning.  There
 are many other cool things you can find.


 Other areas.
 ------------

 New York isn't the only place where the test numbers are in the 'high end'
 of the exchange.  Michigan, D.C., Maryland and many other places work the
 same way.  There are also areas where you should scan the 'low end'(00xx).
 This seems to be the format in California and Pennsylvania.  In Illinois, a
 good place to look is in 12xx, and I've even found an exchange in Texas
 where the tests are in 31xx.  Although the 'high end' and 'low end' are the
 most common, don't hesitate to check other sections.  If you find a 1000 hz.
 tone on NXX-6715, then scan out 67xx.

 If you want to know all the exchanges in your central office, I'm sure that
 there are websites where you can find such information.  If you can't find
 one, read a file on how to use a search engine.  Sometimes you can just open
 up your local phone book, and if you're lucky, the information will be in
 there.  One trick I use to find out which exchanges are the oldest is to
 check what the Government numbers are. (police station, court house, library,
 etc.)  It stands to reason that these places will have their numbers on the
 oldest exchange.  After all, the police station has obviously been there for
 a while, and I'm sure they wouldn't ever need to change their phone number.
 If you live in a small town and your central office only has one or two
 exchanges, then you don't have much work to do at all.


 The Scan.
 ---------

 I was inspired to do this scan when reading an old text file on exchange
 scanning. (it can be found in 'BIOC's Guide to Basic Telecommunications vol.
 one', as well as many other places)  First of all, the area code has changed
 since the file was written.(1980's?)  Also, some of the numbers worked, but
 most didn't, so I decided to scan the 100 numbers myself.  I found that a few
 of the original recordings were still there, but on different numbers.  I
 also found a few other cool things, so here is the updated and expanded
 version of that old text-file. (find the old scan, you'll see it's not much
 different than mine)  This should prove that 15 or 20 year old text files are
 still worth reading, not only to know your history, but they can also be
 semi-useful.  The old skool is alive and well.

 1(845)268-99xx:

 9901 welcome to the Congers DMS-100 central office, using codes 268,
     267, 261 and 979. (261 and 979 don't seem to work anymore)
 9903 rings once, then plays six DTMF tones
 9909 we're sorry, your call did not go through. will you please hang up
     and try your call again? this is a recording. (repeats, then rings
     again...) please hang up and try your call again. if you need
     assistance, dial your operator. please hang up now. this is a
     recording.
     *this is the most common recording on this number, but if you call
      it a few times, you'll get a few different things. try it out.
 9910 DATU (default user code)
 9911 DATU (default user code)
 9922 excuse me, please deposit five cents for the next two minutes or
      your call will be terminated. this is a recording.
 9926 (914) 268, 267, 261 Congers DMS-100 verification. (also will play
      the message on 9901 sometimes) *note the old NPA
 9933 {sit tones} we're sorry, the long distance company access code you
      dialed must be preceded by the digits 950. please hang up and try
      your call again. (I don't think they even use 950 anymore)
 9940 {sit tones} we're sorry. private calls are not accepted by this
      number. to complete your call, hang up, pick up again, dial *82 or
      on rotary phones 1182, then dial the number. if call id or call id
      with name are in use, your name and number may be displayed. this
      message is free. (this one was very informative. I'm surprised that
      they didn't tell me which end of the phone I should speak into)
 9947 {sit tones} we're sorry, you call cannot be completed as dialed.
      please check the number and dial again, or call your operator to
      help you. (also plays a similar message in a different voice)
 9960 loud tone (1000? hz.)
 9963 loud tone (1000? hz.)
 9967 rings once, then silence
 9977 {sit tones} we're sorry, your call cannot be completed as dialed
      from the phone you are using. please read the instruction card and
      dial again.
 9978 the call you have made requires a coin deposit. check the
      instructions on the payphone for the appropriate rate, and dial
      your call again.
 9999 rings, then low hum (weird)


 Comments.
 ---------

 Now lets see what I've found.  Two different verification numbers, a number
 that plays DTMF tones, a few of payphone recordings, some old error messages,
 tones, and two DATU's.  Don't ask me why there are two DATU's, I'm assuming
 that they don't do anything different.  I usually find twice as many test
 recordings in a New York 'high end' scan, but that old 'call id' message was
 something I haven't encountered before.  Even when you don't find much, you
 find something.

 All numbers not listed either ring out, are a fast busy, or play the regular
 disconnect message. (we're sorry,...268-99xx has been disconnected or is no
 longer in service...)  I usually do my scans at night, well after business
 hours, but I have reason to believe that 9900 is the direct number to the
 central office.  Sometimes when I scan during the day, someone will answer at
 9900 and say the name of the central office (as in where it is located,
 268=Congers, NY)  I've only encountered this a few times.  I never talked to
 them because I'm usually about to scan out the next 99 numbers, and I'm not
 looking for trouble.  Maybe one day when I'm bored, I'll try to social them.


 Special Exchanges.
 ------------------

 Most of the time, numbers such as the ANAC, time and weather, ringback and
 various other things are kept on special exchanges.  Almost all special
 exchanges can only be reached from that particular area, except for time and
 weather numbers, which can usually be reached from anywhere.  In New York,
 958-xxxx and 990-xxxx are ANAC's and 660+ your 7-digit phone number is the
 ringback.  In New Jersey, the ringback is 550.  Many states use 200 for the
 ANAC, from what I have heard. In California, you can get the time by dialing
 767-xxxx (which most people call 'popcorn', 767-2676 spells popcorn), or
 853-xxxx.  The 767 exchange is used in Northern California NPA's, and the 853
 is for Southern Cali.  There are a lot of places, like Boston and D.C., that
 still use 936 for time and weather.  976, 540, and 550 are also special
 exchanges, but they are all premium pay services, kind of like 900 numbers,
 so I wouldn't suggest scanning them unless you are beige boxing.  You're
 probably not going to find anything that interesting, but you never know.
 The time and weather numbers in NY are on the 976 exchange, so If I want to
 know the current weather conditions, it'll cost me 99 cents. What a bargain!

 There is also the little known 959 exchange, which is very different from
 other special exchanges.  It is owned by AT&T, and it is accessible from
 almost any area code. (except NY for some reason)  If you get lucky, you might
 hear things like test messages and different tones, just like you would when
 scanning the high and low end of any other exchange.  Try common numbers such
 as 1000, 1111, 1234, etc.  Sometimes the test numbers will be different in
 different area codes and sometimes they're the same.  I think that 959-1000 is
 the same everywhere.  Because these are AT&T's numbers, they can only be
 reached through AT&T.  The way to do this is to use AT&T's dial-around,
 10-10-288. (another one is 10-16-111, which also works the same for
 op-diverting, by the way)  Simply dial 10-10-288+ 1(NPA)959-xxxx.  You will
 not be charged for this call because it is a test exchange.  I can personally
 attest to the fact that it is free, but I can also personally attest to the
 fact that AT&T might get pissed off if you do it too much because they blocked
 my use of 10-10-288.  Don't feel too bad for me.  I can still use 10-10-288-0
 to op-divert to toll-free numbers, I just can't use it to make long distance
 calls or to call 959 numbers. Oh well.


 Conclusion.
 -----------

 Exchange scanning is fun and most of the time, it's free!  The telco doesn't
 charge you when you reach an error message, so you can call these numbers
 from a payphone without paying for it.  If you're scanning your exchange from
 home, then it's either free or just the price of a local call,(if you get the
 odd business or residence here and there).  I do strongly suggest getting an
 unlimited long distance plan so you can scan exchanges all over the country.
 (not to mention call up all the 'l33t phreaker confs)  It's always cool to be
 able to tell your friend who lives 1000 miles from you what his DATU and ANAC
 numbers are.


 Appendix.
 ---------

 I was planning on adding a few scans to this file, but I thought it would be a
 better idea to give people the chance to do some scanning for themselves.  To
 give you guys a starting point, I've added some numbers from scans I have done
 in the past.  If you take a look around in these exchanges, you will find many
 interesting things.


 (313)849-9906  due to weather conditions, all Ameritech circuits are
 		busy. please try your call again later.
 (313)324-9901  you have reached AT&T local services. DT RT MI BA DS0
 (570)387-0000  thank you for calling Bell Atlantic. due to an emergency
		condition, we are operating with a reduced staff, and if
		you stay on the line you may experience a delay. you may
		find it more convenient to call us back at another time
		for assistance.
 (570)387-0083  DATU (default codes) *(this one has a different voice, so
		far it's the only one I have found like it)
 (202)965-9970  you have just de-activated this feature
 (916)440-0017  we're sorry, your service has been interrupted. for
		fire, medical and police emergencies, dial 911. to
		discuss your account, please contact you local service
		provider. thank you.
 (916)440-0031  {sit tones) we're sorry. due to telephone company
		facility trouble, your call cannot be completed at this
		time. will you try your call again later.
 (212)967-9999  this is a test announcement. this is a test announcement
		for use at anytime in emergency cases. thank you.
		(this will also play a citibank message sometimes)
 (646)674-9901  you have reached Bell Atlantic office of west 36th st.,
		serving codes (646)674, (212)594, (917) 339.
 (914)345-9935  excuse me, please deposit 5 cents for the next two
		minutes or your call will be terminated. thank you for
		using Nynex. this is a recording.
 (415)499-0091  DATU (default user code)
 (618)654-1206  ANAC (this can be reached from anywhere, but it only
		reads back your 7-digit number)
 (409)724-3137  {sit tones} the call you have made requires an initial
		deposit. please hang up momentarily, listen for
		dialtone, deposit the amount specified on the
		instruction card, and dial your call again.
 (215)979-0045  (AT 629) welcome to the ATX long distance network.
		please contact customer service at 1(800)220-4900 to
		activate service.
 (215)979-0028 -(hold music)- thank you for calling Bell Atlantic. all
		of our lines are busy right now, but your call is
		important to us. please hold on, our next available
		representative will be with you shortly.
		-(more horrible hold music with singing!)-


               ANI vs. ANAC What are they, and what's the difference?
                       By: ic0n
                    Email: ic0n@oldskoolphreak.com 
                      URL: www.hackerhost.com/lph/

Since I showed up on the phreak scene, I've seen many phreaks mix up ANI and
ANAC. In this article, I'll explain what both are, what they're used for, and
the diffrence between the 2. Ill start with ANI.

ANI means Automatic Number Identification

This is a service that is mainly found on toll free numbers. But any telco
related number in your area might also have ANI.Larger Companys will also have
ANI on their networks. If they have an outdial feature there are very good
chances that will have ANI. I've read on quite a website that ANI is not offered
to the public, I think that if you have the money your local telco will be able
to help you out with getting this very expensive feature added to your wire pair
(your telephone). ANI information is transmitted as part of the digital stream
in the signaling protocal. At the end of each month the subcriber will be mailed
a log of every phone call they got for that given month. Included in the log are
the numbers of each caller along with the full name of who the number belongs
to. ANI may also be used to refer to any telephone number. Ani is used to bust
people doing toll fraud or anything else illegal over the telephone. Ani is a
service that is on an ANAC. Hotels and motels use something called ARI.

ARI stands for Automatic Room Identification which will allow the front desk to
see who's calling. There's also something called Ani 2 witch will give even more
information about you. The major thing about it is that you get a 2 digit code.
To find out if your area code is under ANI 2 op-divert threw a local operator to
an ANAC that has ANI 2. Example: 00 Pots (plan old telephone service) This 2
digit code will identify your line. Ani 2 will also identify The line number,
ARU, and DNIS.

ARU, Audio Response unit. Aru device that provides synthesized voice responses
to dtmf signaling input by processing calls based on the call-originator input
information received from a host data base information in the incoming call,
such as the time of day.

Line Number, The line you are accessing on their system.

DNIS, Dialed Number Identification Service Is a telephone service that
identifies for the receiver of a call the number that the caller dialed. It's a
common feature of 800 and 900 lines. If you have multiple 800 or 900 numbers to
the same destination, DNIS tells which number was called. DNIS works by passing
the touch tone digits (dual tone multi-frequency or MF digits) to the
destination where a  special, facility can read and display them or make them
available for call center programming.

Here's a list of every 2 digit code...

00 Plain Old Telephone Service (POTS) - non-coin service requiring no special
treatment

01 Multiparty line (more than 2) - ANI cannot be provided on 4 or 8 party lines.
The presence of this "01" code will cause an Operator Number Identification
(ONI) function to be performed at the distant location. The ONI feature routes
the call to a CAMA operator or to an Operator Services System (OSS) for
determination of the calling number.

02 ANI Failure - the originating switching system indicates (by the "02" code),
to the receiving office that the calling station has not been identified. If the
receiving switching system routes the call to a CAMA or Operator Services
System, the calling number may be verbally obtained and manually recorded. If
manual operator identification is not available, the receiving switching system
(e.g., an interLATA carrier without operator capabilities) may reject the call.

03-05 Unassigned

06 Station Level Rating - The "06" digit pair is used when the customer has
subscribed to a class of service in order to be provided with real time billing
information. For example, hotel/motels, served by PBXs, receive detailed billing
information, including the calling partys room number. When the originating
switching system doesn't receive the detailed billing information, e.g., room
number, this "06" code allows the call to be routed to an operator or operator
services system to obtain complete billing information. The rating and/or
billing information is then provided to the service subscriber. This code is
used only when the directory number, (DN) is not accompanied by an automatic,
room/account identification.

07 Special Operator Handling Required - calls generated from stations that
require further operator or Operator Services System screening are accompanied
by the "07" code. The code is used to route the call to an operator or Operator
Services System for further screening and to determine if the station has a
denied-originating class of service or special routing/billing procedures. If
the call is unauthorized, the calling party will be routed to a standard
intercept message.

08-09 Unassigned
10 Not assignable - conflict with 10X test code
11 Unassigned
12-19 Not assignable - conflict with international outpulsing code

20 Automatic Identified Outward Dialing (AIOD) - without AIOD, the billing
number for a PBX is the same as the PBX Directory Number (DN). With the AIOD
feature, the originating line number within the PBX is provided for charging
purposes. If the AIOD number is available when ANI is transmitted, code "00" is
sent. If not, the PBX DN is sent with ANI code "20". In either case, the AIOD
number is included in the AMA record.

21-22 Unassigned

23 Coin or Non-Coin - on calls using database access, e.g., 800, ANI II 23 is
used to indicate that the coin/non-coin status of the originating line cannot be
positively distinguished for ANI purposes by the SSP. The ANI II pair 23 is
substituted for the II pairs which would otherwise indicate that the non-coin
status is known, i.e., 00, or when there is ANI failure. ANI II 23 may be
substituted for a valid 2-digit ANI pair on 0-800 calls. In all other cases, ANI
II 23 should not be substituted for a valid 2-digit ANI II pair which is forward
to an SSP from an EAEO.

Some of the situations in which the ANI II 23 may be sent:

Calls from non-conforming end offices (CAMA or LAMA types) with combined
coin/non-coin trunk groups.

0-800 Calls
Type 1 Cellular Calls
Calls from PBX Trunks
Calls from Centrex Tie Lines

24 Code 24 identifies a toll free service call that has been translated to a
Plain Old Telephone Service (POTS) routable number via the toll free database
that originated for any non-pay station. If the received toll free number is not
converted to a POTS number, the database returns the received ANI code along
with the received toll free number. Thus, Code 24 indicates that this is a toll
free service call since that fact can no longer be recognized simply by
examining the called address.

25 Code 25 identifies a toll free service call that has been translated to a
Plain Old Telephone Service (POTS) routable number via the toll free database
that originated from any pay station, including inmate telephone service.
Specifically, ANI II digits 27, 29, and 70 will be replaced with Code 25 under
the above stated condition.

26 Unassigned

27 Code 27 identifies a line connected to a pay station which uses network
provided coin control signaling. II 27 is used to identify this type of pay
station line irrespective of whether the pay station is provided by a LEC or a
non-LEC. II 27 is transmitted from the originating end office on all calls made
from these lines.

28 Unassigned

29 Prison/Inmate Service - the ANI II digit pair 29 is used to designate lines
within a confinement/detention facility that are intended for inmate/detainee
use and require outward call screening and restriction (e.g., 0+ collect only
service). A confinement/detention facility may be defined as including, but not
limited to, Federal, State and/or Local prisons, juvenile facilities,
immigration and naturalization confinement/detention facilities, etc., which are
under the administration of Federal, State, City, County, or other Governmental
agencies. Prison/Inmate Service lines will be identified by the customer
requesting such call screening and restriction. In those cases where private
paystations are located in confinement/detention facilities, and the same call
restrictions applicable to Prison/Inmate Service required, the ANI II digit for
Prison/Inmate Service will apply if the line is identified for Prison/Inmate
Service by the customer.

30-32 Intercept - where the capability is provide to route intercept calls
(either directly or after an announcement recycle) to an access tandem with an
associated Telco Operator Services System, the following ANI codes should be
used:

30 Intercept (blank) - for calls to unassigned directory number (DN)

31 Intercept (trouble) - for calls to directory numbers (DN) that have been
manually placed in trouble-busy state by Telco personnel

32 Intercept (regular) - for calls to recently changed or disconnected numbers

33 Unassigned

34 Telco Operator Handled Call - after the Telco Operator Services System has
handled a call for an IC, it may change the standard ANI digits to "34", before
outpulsing the sequence to the IC, when the Telco performs all call handling
functions, e.g., billing. The code tells the IC that the BOC has performed
billing on the call and the IC only has to complete the call.

35-39 Unassigned
40-49 Unrestricted Use - locally determined by carrier
50-51 Unassigned

52 Outward Wide Area Telecommunications Service (OUTWATS) - this service allows
customers to make calls to a certain zone(s) or band(s) on a direct dialed basis
for a flat monthly charge or for a charge based on accumulated usage. OUTWATS
lines can dial station-to-station calls directly to points within the selected
band(s) or zone(s). The LEC performs a screening function to determine the
correct charging and routing for OUTWATS calls based on the customers class of
service and the service area of the call party. When these calls are routed to
the interexchange carrier via a combined WATS-POTS trunk group, it is necessary
to identify the WATS calls with the ANI code "52".

53-59 Unassigned

60 TRS - ANI II digit pair 60 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider and that the call
originated from an unrestricted line (i.e., a line for which there are no
billing restrictions). Accordingly, if no request for alternate billing is made,
the call will be billed to the calling line.

61 Cellular/Wireless PCS (Type 1) - The "61" digit pair is to be forwarded to
the interexchange carrier by the local exchange carrier for traffic originating
from a cellular/wireless PCS carrier over type 1 trunks. (Note: ANI information
accompanying digit pair "61" identifies only the originating cellular/wireless
PCS system, not the mobile directory placing the call.

62 Cellular/Wireless PCS (Type 2) - The "62" digit pair is to be forwarded to
the interexchange carrier by the cellular/wireless PCS carrier when routing
traffic over type 2 trunks through the local exchange carrier access tandem for
delivery to the interexchange carrier. (Note: ANI information accompanying digit
pair "62" identifies the mobile directory number placing the call but does not
necessarily identify the true call point of origin.)

63 Cellular/Wireless PCS (Roaming) - The "63" digit pair is to be forwarded to
the interexchange carrier by the cellular/wireless PCS subscriber "roaming" in
another cellular/wireless PCS network, over type 2 trunks through the local
exchange carrier access tandem for delivery to the interexchange carrier. (Note:
Use of 63 signifies that the "called number" is used only for network routing
and should not be disclosed to the cellular/wireless PCS subscriber. Also, ANI
information accompanying digit pair "63" identifies the mobile directory number
forwarding the call but doesn't necessarily identify the true forwarded-call
point of origin.)

64-65 Unassigned

66 TRS - ANI II digit pair 66 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider, and that the call
originates from a hotel/motel. The transport carrier can use this indication,
along with other information (e.g., whether the call was dialed 1+ or 0+) to
determine the appropriate billing arrangement (i.e., bill to room or alternate
bill).

67 TRS - ANI II digit pair 67 indicates that the associated call is a TRS call
delivered to a transport carrier from a TRS Provider and that the call
originated from a restricted line. Accordingly, sent paid calls should not be
allowed and additional screening, if available, should be performed to determine
the specific restrictions and type of alternate billing permitted.

68-69 Unassigned

70 Code 70 identifies a line connected to a pay station (including both coin and
coinless stations) which does not use network provided coin control signaling.

II 70 is used to identify this type pay station line irrespective of whether the
pay station is provided by a LEC or a non-LEC. II 70 is transmitted from the
originating end office on all calls made from these lines.

71-79 Unassigned
80-89 Reserved for Future Expansion "to" 3-digit Code
90-92 Unassigned

93 Access for private virtual network types of service: the ANI code "93"
indicates, to the IC, that the originating call is a private virtual network
type of service call.

94 Unassigned
95 Unassigned - conflict with Test Codes 958 and 959
96-99 Unassigned

Now on with ANAC.. ANAC stands for Automatic Number Announcement Circuit. When
you dial up an anac it will give you the telephone number you called the anac
from. This is very useful when out field phreaking with your beige box. By far
the most important when your at a telco can. At the end of this article I'll
include a list of local anacs. Some local anacs  will differ from switch to
switch. There also toll free anacs most get shutdown due to abuse or overuse.
Because of that I quit releasing anac lists. So do every  phreak a favor and use
local anac when and if possible. Hopefully, you now understand both ANI and
ANAC.


 Now here's a list of ANAC's they all worked as of 8/21/03

 Patlife Anac's
 
 800-492-0295 005736
 800-857-9139 200695
 800-584-9196 300265
 800-300-ic0n (4206) 202622
 800-877-Capt 009949
 800-789-4779 201867
 800-729-0059 302234
 888-253-8254 411198
 888-253-8253 411197
 888-253-8251 411196
 888-253-8249 411195
 888-253-8229 411193
 888-253-8227 411192
 888-253-8226 411191
 888-253-8225 411190
 888-776-5733 409159
 800-964-0221 401479
 888-535-0055 507433
 888-349-9971 505656
 888-578-7437 kru-sher 504872
 800-797-6088 200170
 800-803-6514 300433
 800-803-6521 300434
 800-803-6527 300435
 800-803-6528 301892
 800-803-6594 100973
 800-803-6544 300436
 800-293-6924 010614
 800-213-2233 008637
 800-483-2975 005976
 800-737-9628 002023
 800-729-0056 302234
 888-837-7230 503712
 888-837-7231 503713

 Ani2 (II)

 800-555-1140
 800-555-1180
 800-550-3124
 800-225-5313
 800-225-5214


 Atnt 
 
 800-532-7486 +1

 Mci
 
 800-314-4258
 800-333-3232
 800-444-0800
 800-444-2222
 800-444-3333
 800-444-4444
 800-444-5555
 800-552-8355
 800-555-1221
 800-797-5207
 800-967-5326 +2

 Other Anac's

 800-240-1411 +1 (even if blocked from area code)
 800-444-0872 +1 (even if blocked from area code)
 800-444-0866 +1 (even if blocked from area code)
 800-666-1379 +1 (even if blocked from area code)
 877-265-5343 8+1 (877-college)
 800-964-0176
 800-964-0221
 800-223-1104 195632
 888-221-0104 12345
 888 324 8686


  
  NPA  ANAC number      Geographic area  
  
  201  958              Hackensack/Jersey City/Newark/Paterson, NJ
  202  811              District of Columbia
  203  970              CT
  205  300-222-2222     Birmingham, AL
  205  300-555-5555     Many small towns in AL
  205  300-648-1111     Dora, AL
  205  300-765-4321     Bessemer, AL
  205  300-798-1111     Forestdale, AL
  205  300-833-3333     Birmingham
  205  557-2311         Birmingham, AL
  205  811              Pell City/Cropwell/Lincoln, AL
  205  841-1111         Tarrant, AL
  205  908-222-2222     Birmingham, AL
  206  411              WA (Not US West)
  207  958              ME
  209  830-2121         Stockton, CA
  209  211-9779         Stockton, CA
  212  958              Manhattan, NY
  213  114              Los Angeles, CA (GTE)
  213  1223             Los Angeles, CA (Some 1AESS switches)
  213  211-2345         Los Angeles, CA (English response)
  213  211-2346         Los Angeles, CA (DTMF response)
  213  760-2???         Los Angeles, CA (DMS switches)
  213  61056            Los Angeles, CA
  214  570              Dallas, TX
  214  790              Dallas, TX (GTE)
  214  970-222-2222     Dallas, TX
  214  970-611-1111     Dallas, TX (Southwestern Bell)
  215  410-xxxx         Philadelphia, PA
  215  511              Philadelphia, PA
  215  958              Philadelphia, PA
  216  331              Akron/Canton/Cleveland/Lorain/Youngstown, OH
  216  959-9892         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  217  200-xxx-xxxx     Champaign-Urbana/Springfield, IL
  219  550              Gary/Hammond/Michigan City/Southbend, IN
  219  559              Gary/Hammond/Michigan City/Southbend, IN
  301  958-9968         Hagerstown/Rockville, MD
  310  114              Long Beach, CA (On many GTE switches)
  310  1223             Long Beach, CA (Some 1AESS switches)
  310  211-2345         Long Beach, CA (English response)
  310  211-2346         Long Beach, CA (DTMF response)
  312  200              Chicago, IL
  312  290              Chicago, IL
  312  1-200-8825       Chicago, IL (Last four change rapidly)
  312  1-200-555-1212   Chicago, IL
  313  200-200-2002     Ann Arbor/Dearborn/Detroit, MI
  313  200-222-2222     Ann Arbor/Dearborn/Detroit, MI
  313  200-xxx-xxxx     Ann Arbor/Dearborn/Detroit, MI
  313  200200200200200  Ann Arbor/Dearborn/Detroit, MI
  314  410-xxxx#        Columbia/Jefferson City/St.Louis, MO
  315  953              Syracuse/Utica, NY
  315  958              Syracuse/Utica, NY
  315  998              Syracuse/Utica, NY
  317  310-222-2222     Indianapolis/Kokomo, IN
  317  559-222-2222     Indianapolis/Kokomo, IN
  317  743-1218         Indianapolis/Kokomo, IN
  401  200-200-4444     RI
  401  222-2222         RI
  402  311              Lincoln, NE
  404  311              Atlanta, GA
  404  940-xxx-xxxx     Atlanta, GA
  404  990              Atlanta, GA
  405  890-7777777      Enid/Oklahoma City, OK
  405  897              Enid/Oklahoma City, OK
  407  200-222-2222     Orlando/West Palm Beach, FL
  408  300-xxx-xxxx     San Jose, CA
  408  760              San Jose, CA
  408  940              San Jose, CA
  409  951              Beaumont/Galveston, TX
  409  970-xxxx         Beaumont/Galveston, TX
  410  200-6969         A
  410  200-555-1212     A
  410  811              Annapolis/Baltimore, MD
  412  711-6633         Pittsburgh, PA
  412  711-4411         Pittsburgh, PA
  412  999-xxxx         Pittsburgh, PA
  413  958              Pittsfield/Springfield, MA
  413  200-555-5555     Pittsfield/Springfield, MA
  414  330-2234         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  415  200-555-1212     San Francisco, CA
  415  211-2111         San Francisco, CA
  415  2222             San Francisco, CA
  415  640              San Francisco, CA
  415  760-2878         San Francisco, CA
  415  7600-2222        San Francisco, CA
  419  311              Toledo, OH
  440  959-9892         East Cleveland, OH
  502  2002222222       Frankfort/Louisville/Paducah/Shelbyville, KY
  502  997-555-1212     Frankfort/Louisville/Paducah/Shelbyville, KY
  503  611              Portland, OR
  503  999              Portland, OR (GTE)
  504  99882233         Baton Rouge/New Orleans, LA
  504  201-269-1111     Baton Rouge/New Orleans, LA
  504  998              Baton Rouge/New Orleans, LA
  504  99851-0000000000 Baton Rouge/New Orleans, LA
  508  958              Fall River/New Bedford/Worchester, MA
  508  200-222-1234     Fall River/New Bedford/Worchester, MA
  508  200-222-2222     Fall River/New Bedford/Worchester, MA
  508  26011            Fall River/New Bedford/Worchester, MA
  509  560              Spokane/Walla Walla/Yakima, WA
  512  830              Austin/Corpus Christi, TX
  512  970-xxxx         Austin/Corpus Christi, TX
  515  5463             Des Moines, IA
  515  811              Des Moines, IA
  516  958              Hempstead/Long Island, NY
  516  968              Hempstead/Long Island, NY
  517  200-222-2222     Bay City/Jackson/Lansing, MI
  517  200200200200200  Bay City/Jackson/Lansing, MI
  518  997              Albany/Schenectady/Troy, NY
  518  998              Albany/Schenectady/Troy, NY
  603  200-222-2222     NH
  606  997-555-1212     Ashland/Winchester, KY
  606  711              Ashland/Winchester, KY
  607  993              Binghamton/Elmira, NY
  609  958              Atlantic City/Camden/Trenton/Vineland, NJ
  610  958              Allentown/Reading, PA
  612  511              Minneapolis/St.Paul, MN
  614  200              Columbus/Steubenville, OH
  614  571              Columbus/Steubenville, OH
  615  200200200200200  Chatanooga/Knoxville/Nashville, TN
  615  2002222222       Chatanooga/Knoxville/Nashville, TN
  615  830              Nashville, TN
  616  200-222-2222     Battle Creek/Grand Rapids/Kalamazoo, MI
  617  200-222-1234     Boston, MA
  617  200-222-2222     Boston, MA
  617  200-444-4444     Boston, MA (Woburn, MA)
  617  220-2622         Boston, MA
  617  958              Boston, MA
  618  200-xxx-xxxx     Alton/Cairo/Mt.Vernon, IL
  618  930              Alton/Cairo/Mt.Vernon, IL
  619  211-2001         San Diego, CA
  703  811              Alexandria/Arlington/Roanoke, VA
  704  311              Asheville/Charlotte, NC
  708  1-200-555-1212   Chicago/Elgin, IL
  708  1-200-8825       Chicago/Elgin, IL (Last four change rapidly)
  708  200-6153         Chicago/Elgin, IL
  708  724-9951         Chicago/Elgin, IL
  708  356-9646         Chicago/Elgin, IL
  713  380              Houston, TX
  713  970-xxxx         Houston, TX
  713  811              Humble, TX
  714  114              Anaheim, CA (GTE)
  714  211-2121         Anaheim, CA (PacBell)
  714  211-2222         Anaheim, CA (Pacbell)
  716  511              Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
  716  990              Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
  717  958              Harrisburg/Scranton/Wilkes-Barre, PA
  718  958              Bronx/Brooklyn/Queens/Staten Island, NY
  802  2-222-222-2222   Vermont
  802  200-222-2222     Vermont
  802  1-700-222-2222   Vermont
  802  111-2222         Vermont
  805  114              Bakersfield/Santa Barbara, CA
  805  211-2345         Bakersfield/Santa Barbara, CA
  805  211-2346         Bakersfield/Santa Barbara, CA (Returns DTMF)
  805  830              Bakersfield/Santa Barbara, CA
  806  970-xxxx         Amarillo/Lubbock, TX
  810  200200200200200  Flint/Pontiac/Southfield/Troy, MI
  812  410-555-1212     Evansville, IN
  813  311              Ft. Meyers/St. Petersburg/Tampa, FL
  815  200-xxx-xxxx     La Salle/Rockford, IL
  815  290              La Salle/Rockford, IL
  817  211              Ft. Worth/Waco, TX
  817  970-611-1111     Ft. Worth/Waco, TX  (Southwestern Bell)
  818  1223             Pasadena, CA (Some 1AESS switches)
  818  211-2345         Pasadena, CA (English response)
  818  211-2346         Pasadena, CA (DTMF response)
  903  970-611-1111     Denison, TX
  906  1-200-222-2222   Marquette/Sault Ste. Marie, MI
  908  958              New Brunswick, NJ
  910  200              Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  910  311              Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  910  988              Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  914  990-1111         Peekskill/Poughkeepsie/White Plains/Yonkers, NY
  915  970-xxxx         Abilene/El Paso, TX
  916  211-2222         Sacramento, CA (Pac Bell)
  916  461              Sacramento, CA (Roseville Telepohone)
  919  200              Durham, NC
  919  711              Durham, NC

  Canada:
  204  644-xxxx         Manitoba
  306  115              Saskatchewan, Canada
  403  311              Alberta, Yukon and N.W. Territory
  403  908-222-2222     Alberta, Yukon and N.W. Territory
  403  999              Alberta, Yukon and N.W. Territory
  416  997-xxxx         Toronto, Ontario
  506  1-555-1313       New Brunswick
  514  320-xxxx         Montreal, Quebec
  519  320-xxxx         London, Ontario
  604  1116             British Columbia, Canada
  604  1211             British Columbia, Canada
  604  211              British Columbia, Canada
  613  320-2232         Ottawa, Ontario
  705  320-4567         North Bay/Saulte Ste. Marie, Ontario

  Australia:
  +61  03-552-4111      Victoria 03 area
  +612 19123            All major capital cities
  12722123

  United Kingdom:
  175

 Loop Maintenance Operations System (LMOS) 
           by Brisk Attivo


16.3.2. LOOP MAINTENANCE OPERATIONS SYSTEM (LMOS)

When a clerk takes a report in a repair service bureau 
that uses only manual methods, a trouble ticket is filled 
out. This ticket includes the customer's name, address, 
telephone number, and any pertinent information that may 
help to identify the trouble. All of this information is 
entered on the ticket manually, with the ticket eventually 
passing through many hands. In addition to this source of 
information, cable pair assignment, cable makeup 
information, and trouble history for each customer are 
kept on file in large bins or file tubs. This information 
is used by the tester to help isolate the problem. Through 
the use of LMOS, all of this information can be stored in 
a computer and displayed on CRTs at the 611 position and 
other locations. In addition to simplifying information 
retrieval, the accuracy and readability of the information 
will be greatly imporved. The CRT display will alow the 
RSB to advice the customer immediately of the status of 
the trouble, should the customer happen to make a followup 
inquiry. It also produces administrative reports including 
jeopardy reports, facility status reports, cable fill 
reports, and reports with respect to closed out troubles. 
LMOS includes documentation such as training materials and 
position practices.
LMOS can be installed separately or with the LSV or 
mechanized loop testing (MLT) modules, which mechanize 
important testing functions. The system economically 
viable for typical groupings of repair service bureaus 
that serve on-half million to five million lines.
Labor savings benefits result from:

(1) Mechanization of the line record.

(2) A mechanized service order inteface for automatic line 
record updating.

(3) The ability to centralize the repair service 
attendants for many repair service bureaus.

(4) A flexible report generator that produces standard 
statistics or processed trouble reports and special 
reports on demand.

(5) A repair force administration algorithm that optimizes 
the travel time of the repair personell.

LMOS is a 3-level network interconnected by data links as 
shown in Fig. 16-2. The hub of the network is an IBM 370 
computer and associated peripherals. The master line 
record data base is maintained in the hub, which can 
support up to five million working lines.

Fig. 16-2. Loop Maintenance Operations System

The second level of the system consists of a number of 
satellite locations which are linked with the central data 
base. A satellite consists of a PDP 11/70 minicomputer and 
associated peripheral equipment. Each satellite has an 
estimated capacity of one million lines. The satellites 
support almost all of the real-time transactions and 
provide response times on the order of 5 seconds or less 
for most transactions. Because these satellites have such 
a large capacity and since the cost of the minicomputer 
equipment is a minor portion of the overall system cost, a 
duplexed configuration is reccomended for reliability.
The third level of the system is at the repair service 
bureaus and centralized repair service attendant 
locations. Each location has a PDP 11/10 minicomputer 
which is linked with one of the satellite minicomputers. 
The repair service attenants and other personel interact 
with the system through CRT terminals, printers, and 
status entry devices which are special purpose data entry 
terminals that enter data with a TOUCH-TONE pad and 
display data on a light-emitting diode readout strip.
The lower limit on the capacity of a LMOS installation is 
based on economic constraints imposed by fixed cost items 
such as software support personnel, training center costs, 
and IBM 370 costs. This limit is estimated to be 500,000 
lines.

16.3.2.2 Operations

The following descriptions of ways that LMOS can be used 
in an operating company will further explain the 
organization and functions of the system.

The Repair Service Attendant Position.

Each repair service attendant position is equipped with a 
CRT terminal through with LMOS accepts trouble reports. 
Following keyboard entry of a customer telephone number or 
special service circuit number, LMOS responds with 5 
second with a CRT display that includes:

(1) Customer name, address, and service data such as 
disconnected, non-working, affiliated with a telephone 
answering service, or date of last trouble.

(2) An appointment time that can be offered to the 
customer if a repair visit appears to be neccessary.

(3) LSV or mechanized line testing system responses ( if 
installed at serving RSB) to LMOS initiations.

(4) Information on cable and other equipment failures that 
are known to be affecting the particular customer's 
circuit.

(5) Information on the initial report (if the current 
report is identified as a subsequent report) concering 
repair status, promised appointment time, and number of 
previous subsequent reports.

The appointment time mentioned above takes into account 
both of the back-log of trouble reports awaiting dispatch 
and the size of the craft force responsible for the 
corresponding repair coverage.
The LSV or mechanized line testing system response usually 
is not available at the time of the initial trouble report 
transmission, but is writen into a reserved space on the 
display as the repair service attendant is talking to the 
customer. REsponse time of these systems is on the order 
of 10 seconds and can be longer if delays are encountered 
because of test equipment usage.

As in the case of the appointment time offering, the LSV 
or mechanized line testing system response is made from 
the RSB covering the service in question and need not be 
the same RSB that contains the originating repair service 
attendant position. It is the independence of the repair 
service attendant from the responsible RSB that permits 
one of the more significant operational capabilities: 
centralization of the repair service attendant task. Such 
centralization is possible because all of the repair 
service attendant transactions are designed to operate 
with acces to all of the line records contained within the 
serving satellite minicomputer (this also implies acess to 
all LSV and mechanized line testing systems covering these 
lines). Thus, 24-hour coverage and other desirable 
features possible with a centralized repair service 
attendant location are provided within the LMOS design.

16.3.2.3 RSB Handling of the Trouble REports

Once a trouble report has been entered in LMOS, the line 
record data base is accessed and a basic output report is 
transmitted within seconds to a printer at the appropriate 
RSB. In addition to the trouble report and line record 
data, this paper document contains:

(1) Assignment information.
)2) Service and equipment information.
(3) Trouble history for the past 40 days.
(4) Warning of potential trouble causes such as cable 
failures.

As repair action takes place following a trouble reports, 
status updates, such as test results and trouble reports 
closeouts, are entered into LMOS in the RSB, using status 
entry devices described previously.
LMOS will aid in the dispatching of the repair force 
through the use of a repair force administration module 
that will provide a CRT-equipped dispatcher with a short 
list of reccomended dispatches each time a member of the 
repair force calls in for a new dispatch. Repair force 
administration will take into account the repair work 
backlog, available repair force, promised appointment 
times, and travel times.
Note that since ach line record is keyed to a serving RSB, 
LMOS permits functional repair operations such as coin 
telephone repair centers and PBX repair centers; the basic 
output report always arrives at the correct serving RSB or 
repair center.

16.3.2.4 Control of Testing

Not only can the repair service attendant position trigger 
LSV action against a particular telephone number, but also 
RSB personnel can use LMOS to drive a LSV in an automatic 
verification mode. This is done by using a RSB CRT 
terminal to enter a list of telephone number, a particular 
cable complement, a range of central office equipments, or 
a specifc class and period of closed-out trouble reports 
such as all-test-OKs for the last two days. LMOS then 
acceses its data base for cross-reference lists that 
provide the appropriate telephone numbers and initiates 
automatic sequential line status verification against the 
telephone number list. Results are printed out at the 
requesting RSB within seconds of completion. The testing 
capabilities of the mechanized line testing system can be 
used by LMOS in the same manner.

16.3.2.5 Operational REports

Over and above individual trouble report tracking, LMOS 
provides three basic classees of operational reports: one 
covering open troubles, one covering closed-out reports, 
and one covering the line record and equipment file.
Open trouble reports are used to aid in the hour-to-hour 
administration of the RSB. An example of this kind of 
reportis the jeopardy report, which flags trouble reports 
in jeopardy of missing their appointment times.
Closed-out trouble reports relate to troubles that have 
been closed out within the last 40 days.
Line record and equipment reports fall into three 
categories:

(1) Batch reports that use the line record file as input, 
for example: all circuits on temporary suspension can be 
listed by telephone number.

(2) Batch reports that list unallowed multiple assignments 
of cable and pair or central office equipment.

(3) Equipment reports that are fixed in format but that 
are available inr elat time in response to CRT-entered 
transactions, for example :cable pair versus telephoen 
number by complement.

Since many of these reports can be retrieved from a 
centralized location, the potential for a formal program 
of centralized analysis exists under LMOS. Note that some 
reports will be useful in connection with with operating 
company activities other than maintenance such as business 
office and network administration activities.

16.3.3. AUTOMATED REPAIR SERVICE BUREAU (ARSB)

Both LSV and LMOS initially were designed as stand-alone 
systems, LSV as a manually operated line verification 
system and LMOS as a mechanized line record and trouble 
administration system. Recently, and interface was 
provided for LSV so that it can be directed from a LMOS 
operator's position to run its sequence of measurements on 
a particular line. This is a first step toward a total RSB 
system concept.
Developpment is under way for a mechanized line testing 
(MLT) system, which is an improved version of the LSV. In 
addition to improved testing capabilities, it will have 
the ability to test in the presence of known terminations. 
In the new arrangement, the MLT system, working in 
conjunction with LMOS, will have a priori knowledge of 
expected values and allowable deviations for aparticular 
line being tested. For example, when testing a ground 
start PBX line, it would know that -48 volts is the normal 
on-hook condition, whereas this would indicate a fault for 
a station line. The new system also will make routine 
rapid scan measurements automatically during the early 
morning hours when lines are normally idle. All of these 
developments are part of what will be known as the 
automated repair service bureau (ARSB).



                             How To Datu
                         By: Majestic 1/12


         " ( Warning Disclaimer ) All material(s) in this text file are 
           intended for informational use only, it is not the authors
           intent to endorse fraud or help others in the pursuit of
           fraud.  The author accepts no responsablity for any and
           all Fraudulant Activities that may come from the viewing
           of this text file. By downloading this file you the viewer
           accept all resposabliity for any repercutions that may 
           come from abusing this information. "

           " Information is free, Crime costs! "  Majestic 1/12
          

                I have come to realize that the world of Phreaking is 
           alot like Trial and Error,  I myself hand scan all the numbers
           I come to own, and feel this is the only real way to extract
           all the information needed to continue on my ventures.
                

		Like all Phreakers I set out to discover the mad world of
           " ESS " and ways to make free calls.  I came to discover a " PBX "
           or " Diverter " was not at all hard to find.  Keeping the number
           secure was yet another matter!  I went to all of the normal places
           on the net to view text files from the old Skool Era, and found 
           alot of the material I had already known.  It wasn't until I 
           actually started calling into the " Voice Bridges " that I became
           really interested in the " Datu Systems ".  I had friends that
           were really into REMOB back in the day, telling me how much fun it
           was to listen in on the conversations thier nieghbors held.  
                

		When I found my first Datu, with Passcode, I thought I was 
           going to be able to play phone god and take over lines,
           this was my first mistake.  Sure I called in, entered a random
           number and was givin the prompt listed below.  Being the
           inexperienced lamer at the time, I started trying the Permenant 
           Signal Rlease, followed by a quick call back to check the line!  
           I was defeated, as my attempt to take out a phone was deflected 
           by my own stupidity!  I called the Datu up again and actually 
           listened to the woman's automated voice.  

           	This time when I pressed # 9, I heard " Permanent Signal Release
           Disabled, ( Pause ) ... OK Audio Monitor ... " After this I was
           redirected to the Datu Main Menu and I hung up!  After further 
           investigation into the Datu functions it was brought to my attention
           that along with the default codes to access the Datu, there were also
           sets of Admin Defaults that were needed  in order to actually set up 
           the functions.        
           

     	   	So with this I give you the information needed to help guide you
           to understanding the world of the Datu!  Please read the information
           closely, as it will indeed give you insight! 


Step # 1: Dial Datu Access Number.
Step # 2: Enter Datu Password.
Step # 3: Dial Seven digit subscriber line number.
Step # 4: Datu will respond with " Connected to XXX - XXXX " 
          " OK "
          "Connected to XXX - XXXX, Busy LIne, Audio Monitor "
          Non pair gain lines proceed to Step # 7:
          " Note " If the line is busy the Datu will not access the DC 
          by-pass pair or the Metallic Access Unit.
Step # 5: SLC lines: If the line is idle Datu will respond " Pair Gain
          Line " Followed by " Processing " ( " Processing " may be 
          repeated for up to 25 seconds. ) Datu will voice message:
          ____________________________________________________________
          Single PartyLine               (GOOD)
          Multi-Party LIne               Followed by
          Coin LIne                      " Enter RT Number "
          ____________________________________________________________
          Channel Not available          (No Bad Channel test results)
          PGTC Failure/By-Pass           If same recording is heard 
          Pair Busy                      repeatededly, alert supervisor
          Pair Gain System Alarm         (Alert Supervisor)
          ____________________________________________________________
step # 6: If Good ( Or Bad ) Channel test results, enter the RT number,
          Dial" * " to end,( " ** " to toggle on or off the Alpha Mode. )
          Enter the pair number, Dial " * " to end.
          Dial " 0 * " to existing DC Test Pair. Datu will connect to the
          by-pass Pair or call the Metallic Access Unit in the RT, except
          when bypass is busy or Pair Gain system is in Alarm.
          See Step # 7 after Connection to remote site.


Step # 7: Line Preperation Functional Dial Codes:
           2 = Audio Monitor
          33 = Short Tip and Ring to Ground
          37 = Short Ring to ground ( Tip Open )
          38 = Short Tip to Ground ( Ring Open )            
          44 = High Level Tone on Tip and Ring
          47 = Gigh Level Tone on Ring ( Tip Grounded )
          48 = High Level Tone on Tip ( Ring Grounded )
           5 = Low Level Tone
           6 = Open Line
           7 = Short Line ( Tip to Ring )
           9 = Permanent Signal Release
           # = New Subscriber Line
          ## = Force Disconnect


"MJ Notes"     When accessing a Datu Unit you must know the Passcode which
               is usually a default of " 1234 or 2345 " I have noticed that
               when a Datu is called it will after prompted move straight to 
               Step # 7 Line Preperation Function Dial Codes.  The Audio 
               Monitor option will sound with a low level sctratch type beep
               that cannot be decoded as talking to the human ear. this will
               only happen if the phone line called is currently busy.  It has 
               come to my attention that you also have to setup the Datu 
               through the Admin Codes in order to actually have used the Datu
               correctly, otherwise you are accessing a totally dead and useless          
               Phone Utility.  The only use for a Datu without Admin features 
               promted is to tell if someone is on thier phone, and yes boys and
               girls you are able to do that by just dialing the persons phone
               number.

                    Now then I have givin you enough info on how to Datu, Now 
               I will give you the actual Datu numbers and  you can attempt to 
               Datu all by yourselves...  Play nice now ya'll!

Datu Numbers: 
 
                rea:                    NPA:               Datu:             
Code:
              
               Laurelton                718                528-8374          
2345
                                                              -8375               
                                                              -8375                          
               L.I.C                    718                472-0567          
2345
                                                              -0572             
                                                              -0576             
               Flushing                 718                460-2775          
2345
                                                              -4055             
                                                              -2861             
                                                              -4155             
               Forest Hills             718                520-1207          
2345
                                                              -1320             
                                                              -1518             
                                                              -1553             
               Astoria                  718                728-2432             
                                                               2345          
2345
                                                           278-                 
                                                           626-                                                                                                                         
204-                 
                                                           956-                 
                                                           267-                 
               Astoria Contd...         718                726-2722          
2345
                                                               2811             
                                                           274-                 
                                                           932-                  
                                                           721-
                                                           545-
                                                           777-
                                                           546                                                                                                                   
               Newton                   718                424-0157          
2345 
                                                               0173
                                                           429-
                                                           639-
                                                           426-
                                                           565-
                                                           507-
                                                           936-
                                                           803-
               Newton Contd...          718                651-9129          
2345 
                                                               9139
                                                               3308
                                                           672-
                                                           478- 
                                                           779-    
                                                           334-
                                                           205-




             Yes Folks those are all valid Datu Numbers, enough that you could 
             go read " Decoder's " Exchange Scanning " Article and figure out
             how you yourself can begin scanning out the local Datu's that may be in 
             your own Area.  Be advised that not all states have Datu test Units,
             Or it may be that I have just not found them yet... I hand scan all
             the numbers I get, and it takes alot of time, but I do get a very good
             amount of numbers that would be passed up on if scanned through a 
             wardialer...  I recommend Hand Scanning it is Uber 1337!

             " Props to Decoder, Twinkee the Kid, White Sword, ic0n, Dick
               Pickleson, Lucky 225, Dialect, Dark Cube, Night Wolf, Royal
               and the rest of the 31337 Phreakers doing what we know to be right..... "

                                                              
         " I am a 404 ... "


  Maritime Telecommunication Network aka MTN
       By ic0n 
   e-mail ic0n at houseofphreak dot org

 Quite sometime ago i went on a ship, That had telephones on it.
 Being the phreak i am I decided i would mess around with it since
 I've never heard anyone talk about it. First off these are satellite 
 telephones. I don't remember the make nor the type of phone they where 
 using. I was on a Carnival ship that witch has phones in every 'stateroom'
 (ships way of saying hotel room) All calls going back into the United States
 cost around 1.50 a minute. I don't remember about the international calls.
 I would guess thats around 3 bucks! Carnival blackmales anyone who goes on 
 a cruse because that don't allow you to calling cards,credit cards nor collect
 calls. Heres what was told to everyone. 

 'Please note Since Communications at sea are via Satellite, guest maynot use 
  credit cards,calling card nor collect calls.' 

 What they try and make you do is use your phone in your room witch will be directly 
 added to your bill. If i remember correctly the system they used was called  'Shore to ship'

 After going threw some old notebooks i found 2 numbers for ship to shore.
  877-225-7447
  732-335-3284



 From http://www.carlsontravel.com

 Using your credit card: 1-877-823-6000
 The cost is $8.50/minute once connected*.


 Billed to your telephone: 1-900-555-6000
 The cost is $8.95/minute once connected*. 
 You will need the Cruise Line and Ship Name in order to be connected.
 Refer to the cruise codes once you begin dialing.

 Please remember to give your friends and family the Cruise Line and Ship
 Name that youre sailing on. Enjoy your cruise and thank you for booking
 through Carlson Wagonlit Travel.

 *Additional charges may be charged to the passenger depending on the cruise
 line. Print this information sheer to contact future Carlson Wagonlit Travel
 cruisers!

 CRUISE CODES

 CRUISE LINE               CODE        CRUISE LINE                    CODE 
 Celebrity Cruise Line     700       Princess Cruises                  300 
 Crystal Cruises           180       Radisson Seven Seas Cruises       800 
 Cunard Line               340       Royal Caribbean International     200 
 Disney Cruise Line        900       Seabourn Cruise Line              380 
 Holland America Line      400       Silversea Cruises                 470 
 Norwegian Coastal Voyage  600       Windstar Cruises                  530 
 Norwegian Cruise Line     500       World Explorer Cruises            550 
 Orient Lines              360 


       Frame Operations Management System (FOMS)
                  by Anonymous
                from http://www.oldskoolphreak.com

LEGAL NOTICE - YOU MUST READ
Qwest computers and the Qwest network are Qwest property.
Only authorized persons may use them for legal and proper purposes as
determined solely by Qwest.  By using them, you consent to monitoring.

DESTINATION:  foms

xxxxxXX UMI Destination >xxxxXX
Using DNS to resolve 'xxxxXX'...
Trying 123.45.67.89 @ TCP Port 23...

--> Connection Established <--


UNIX(r) System V Release 4 / UTS 4.5 (xxxxXX) (1)

login: xxxxxxx
Password:
UNIX System V Release 4 / UTS 4.5 (UTS Global, LLC)
xxxxXX
Copyright (c) 1984, 1990 AT&T
Copyright (c) 1990, 1993 UNIX System Laboratories, Inc.
Copyright (c) 2000, 2003 UTS Global, LLC
All Rights Reserved
UTS is a registered trademark of UTS Blobal, LLC.
Last login: <date/time>

LAST LOGIN: <date/time>

UNIX System "xxxxXX"
Release 4 500


**** UTS SYSTEM "XXXXXX" ****

****************************************************************
*                       Proprietary System                     *
*     Authorized access ONLY. Users subject to monitoring.     *
*                    ALL other use probhibited.                *
****************************************************************



FOMS/SWITCH problems ??? Call the IT Unified Help Desk

All Qwest employees are directed to dial 8XX-XXX-HELP (4357)

They are there 24 hours a day - 7 day a week to help you
and determiine trouble source , soulutions and to coordinate
resolution with the appropriate support group. Password resets
require a call to the RMA Hotline at 1-8XX-XXX-XXXX

Jeopardy reason tables have been updated for all wirecenters.  Below
is a list of permissible jeopardies.

a1	Assignment Error on F1 Facilities [CP or UDC]
a2	Assignment Error on Office Equipment (OE)
a3	Reserved for Future Assignment Error Category
a4	Assingment Error Tie Pair
a5	Assingment Error TRE [Reg Units, DSL]
a6	Qwest Wiring/Inventory issue [Line Sharing, DSL]
a7	Stenciling Error Splitter or DSLAM
a8	Splitter not connected to DLEC side, Splitter not avail.
a9	Load Coil Detected [Line Share only not used for DSL]
s1	Failed Synch Test [Line Share Only]

FOMS for Xxxxxxxxxx, Xxxxxxxxxx and Xxxxxxxxxx

COT Note: fnd_winback has been modified to only show uncompleted orders
COT Note: fnd_ufo can be used at wc prompt to list unprinted ords & admin
COT Note: fnd_cancel can be used at wc prompt to list canceled ords
***********************************************************************
Press RETURN KEY to continue


 


 
     
