[ D4RKCYDE ] yyyyyssssyyyy yyyyssssyyyy yyyy yyyy |lS$$ yy $$$$ """" yy lS$$ S$$$ S$$$$$ $$$$$ S$$$ssssyyyy :|lS$ ""yyyyy yyyyssss|lS$ lS$$ lS$$ yy$$$$$ lS$$ yy lS$$ :||lS$$ $$$$$ :|lS yy :|lS |lS$ |lS$ $$ yyyy |lS$ $$ |lS$ :::|l ,$$$$$ ::|l $$ ::|l :|lS :|lS $$ :|lS :|lS $$ :|lS ::::| $$$$$$ :::| $$ :::| ::|l ::|l $$ ::|l ::|l $$ ::|l .:::: ....... .:::....:::: .::| ..:|....:::| .::| .. .::| [ F41TH ISSUE 12: FEB 2OOO ] ... http://f41th.com .... . : : | +-------> hybrid @f41th.com <-------+ http://hybrid.dtmf.org +-------> zomba @f41th.com <-------+ http://zomba.org +-------> jasun @f41th.com <-------+ http://fatality.co.uk +-------> shadowx @f41th.com <-------+ http://f41th.com/~sx +-------> force @f41th.com <-------+ http://f41th.com/~force +-------> downtime @f41th.com <-------+ http://f41th.com/~dt +-------> shylock @f41th.com <-------+ http://f41th.com/~shy +-------> digiphreq @f41th.com <-------+ http://f41th.com/~digi | : . +-------> FIND US ON THE PSTN B1TCH. #darkcyde efnet. : : . . ============================================================================== 9x, b4b0, prez, loophole, ep1d, tip, jimjones, gr1p, guidob, dynamics, datawar, crypt, reb, type0, skyper, w1cked, siezer, oeb, psyclone, is. R E S P E K T. I N I I T. ============================================================================== Welcome to f41th issue 12, this month hosted by me(hybrid)!. This issue is kind of small compared to the previous issues, but heh, wait until you see f41th 13.. we are planning a one-off complete oday issue.. so keep any eye on f41th.com for updates. I'd like to say thanks to the krew at dtmf.org for hosting f41th.com and to all the ppl mirroring f41th on their sites, werd. I dont really know what to say in this editorial, so I will keep it short. Some of the articles in this issue are a bit "risky" -- taken from the elite f41th oday archives at darkcyde HQ, we know you fear. later. -hybrid. M A I L B 4 G =============================================================================== From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 18:59:49 2000 Delivered-To: hybrid@dtmf.org Subject: press inquiry I am a journalist on The Sunday Times, London, and am researching an article on cracking/hacking. Please could you give me a call on 011 44 171 782 5686 (From US) or 0171 782 5686 (from UK). Alternatively, pse could you email me a number and I will call you. Thanks. Jon Ungoed-Thomas =============================================================================== From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:00 2000 Delivered-To: hybrid@dtmf.org Subject: RE: press inquiry Very interested in talking to you - as soon as possible, really. I am on 0171 782 5686 or 07771 536255. Thanks. =============================================================================== From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:10 2000 Delivered-To: hybrid@dtmf.org Subject: RE: press inquiry Got your email address on google search on internet under search terms satellite and hacking. Would you be able to call me today? I am in the office. Thanks. =============================================================================== From Jonathan.Ungoed-Thomas@sunday-times.co.uk Thu Feb 17 19:00:19 2000 Delivered-To: hybrid@dtmf.org Subject: RE: press inquiry Hybrid, still waiting for your call... =============================================================================== R E M O T E I N F O R M A T I O N I N T E R C E P T I O N =============================================================================== . . ___::http://_:::hybrid.DTMF:___::org::___::___:::: / || || |_| __ || || || _|| || | | | | :__|| |:_ | | : :: | || |:_ |/ | | : \ | | _ | __:|: _::_ | |: | | --: --<_____ |___ |_|__\____||_ ||_ ||_ ||____ |_|\__>-- |/ |/:::BL4CKM1LK:|/ |/:: |/::@%$!|/ : : : : : : . . . . Remote Information Interception Over The International PSTN. A Very Brief Overview of Remote Telecommunications "Spying". by hybrid =============================================================================== In this article I will discuss various "information gathering" techniques which can be covertly deployed, implementing the PSTN as a trojan. I'm not going to discuss the standard "microfone in the wall" scenarios because that is to obvious, the basis of this article is that no-one needs to actually break into your house and place some bullshit listening device in a coffee mug, they dont need to. Nearly every single premisis on this planet has some kind of telecommunications equipment installed, if someone was to "bug" you, the harware needed to carry out such a task is allready in place.. (The Subscriber Loop), think about it, what is a standard domestic phone line? -- In most casess its a pair of copper wires going into a persons home and back to the local exchange, frame point, creating a loop. To break things down even more.. what is on the customer terminating end of that bundle of copper wires? -- A Microphone and A Speaker, (Transmission). If you dont know much about electronics, or have no common sense, you'll probably be thinking, "big deal"... Well, the point is that a telephone speaker can be turned into a micophone when in idle state by reversing the circuit of the customer loop, essencially becoming a room bug when you place the handset down. Now this is just a VERY simple example of what I am going to discuss in this article. To begin with, I'll list some of the most likely "targets" for a digital sniper. ========================================+======================================= WHO/WHAT | WHY ========================================|======================================= Scientific Research | Depending on the level of | "research" some entitys may wish | to have detailed knowledge of | just what the other entitys are | doing, usually when some kind of | academic competition is | concerned, and depending on the | level of scientific research. ========================================|======================================= Diplomatic Internal Government | People/Organisations that are | involved in any government work | are likely targets to "buging" | usually in the interests of | intellegence gathering on the | other-side's part. Worldwide | governments percieve it as | imperitive to possess knowledge | of what other governments are | upto, right down to the smallest | detail. ========================================|====================================== Business People/Organisations | Its common knowledge that | competing companys like to know | what the opposition is upto, and | what strategic advantage they | may have. In this case financial | reasons are usually the | foundation. ========================================|====================================== Crime "Suspects" | Usually when law agencies | suspect some kind of organised | crime, or need more evidence | they will use resources to | gather information. Very | obvious, if someone's down with | somthing, they are a target to | this activity. ========================================|====================================== Attorneys | These people will do anything to | know what the "opposition" has | up their sleve. They'll bug each | other, aswell as clients. ========================================+====================================== The list could go on forever.. The main basis is, if A wants to know what B is doing, they'll try their best to find out somehow, and vise versa. It could be any scenario. Now, I'm not going to drift out of the scope of this article, because the idea is to discuss how someone can be "buged" just by using the PSTN and nothing more. Now, the scary thing is, a single person with a telephone can be just as "dangerous" than a fully trained covert "spy" with a briefcase full of 007 warez.. To emphasise and explain this, I'm going to set up two scenarios. The first scenario is domestic, the second is more business based. We'll start with the first scenario and suppose that "Mr A" is the target, and "Mr B" is the sniper. Mr B has no purpose or has no reason to spy on Mr A, he just feels like it.. to make things a little more interesting, Mr A (the target) lives in Virginia (703) and Mr B (the sniper) lives in another country, lets say, England (+44). To save me writting a big essay, I'll list some of the more effective methods that Mr B could implement in order to gather as much information about mr A as possible (using a telephone and nothing more) ================================+============================================== OBJECTIVE | ACTION ================================|============================================== Find out Mr A's Contacts | Telephone Records/Bills: who does mr A | Call? Examining Mr A's most commonly | called numbers would reveal a great deal | about his activitys, perhaps even more | effective than simply listening to his | telephone conversations. Essentialy an | entire profile could be built up on | someone just by looking at their | phone records: ie: what taxi companys | they use, when and what time they go | out, what kind of food they like, etc. | Telephone records are considered | sensitive information for this matter, | but can be obtained by customer request | (fax) or someone in the phone | company(BOC) requesting to view them for | billing purposes. Customer records are | also kept in an array of databases | concerning the maintanance of a local | exchange. See * Note. ================================|============================================== Monitor Mr A's Calls (realtime) | Perhaps slightly more elaborate, but | easily achieved. Mr A's line information | can be modifyied at the local switching | office to induce a number of occurances. | Using ManMachineLanguage, a subscriber | line can be setup to trigger an | automatic conference call with a "silent | number" whenever mr A pics his phone up. | Aswell as this, a subscriber trunk can | be configured to loop to 2 POT lines | (similtaniously), ie: routed to Mr A, | aswell as a loopline (which can be | remotely dialed into). Mr B could | effectivly "sit on the trunk". ================================|============================================== Audibly Monitor Mr A's House | The simple scenario would be that Mr A | has an AnswerPhone, which in most casess | would have a remote-room monitor | function built into it. Believe it or | not, these kind of answerphones DO | EXIST! It's a gimic built into an | answerphone that allows a person to | phone there own number when they are | away from there house, plug in the 2 | digit answerphone code, and then be | presented with a menu such as "1. listen | to messages, 2. record OGM, 3. room | monitor".. So they can check out what is | going on in there house while they are | away. The scary thing is, these | answerphones have 2 digit passcodes, | which are plugged in while the OGM | occurs, an answerphone can also be | remotely switched on/off by ringing it | 10 times and hanging up and calling | back. Using this "room monitor" function | Mr B can do just that.. monitor audible | room activity. See * Note for the more | plausable method. ================================|============================================== Find Additional Information | The most common threat to any subscriber | to the phone company is the fact that | RBOCs hold detailed account information | concerning their customers, which can be | obtained for reference by an "engineer" | or such.. for example, one piece of | information leads to another, ie: the | customers prefered method of paying the | IXC bill will lead to bank details and | from there, credit details and status, | to social security information. ================================+============================================== * Taken from (http://www.tscm.com) A very interesting site. "A Soft Wiretap, is a modification to the software used to run the phone system. This can be done at the telephone company, or in the case of a business, the PBX. A soft wiretap is a preferred method to tap a phone, easy to catch on a PBX, but tough to find in the phone company's system. (It is sometimes called a REMOBS, ESS, or translation tap). This type of tap is very popular with large law enforcement agencies, larger corporations, and with hackers who find it quite simple to gain access via maintenance software." So, in my lame example, Mr B now has a FULL background on Mr A, just by using his telephone. In the next scenario, we'll consider that Company A wants internal information on the workings of Comany B. It is important to take into acocunt that companys are very secretive when it comes to the internal workings/operations of the company concerned, due to the simple fact that any informational leaked from that particular company could prove bennificial to their compitors. Therefore, most companys that operate strategic buisness plans etc, will go to great lenghts to safegaurd that backbone or inter workings of their companys workforce, ie: the securing of database systems and accounts, employee information. The problem is the more security that is implememented, the harder it can be for a legitiamte company employee to access data, therfore this decreses work efficiancy. However, it is important that a company locks down on the availability of there companys internal workings, as in some cases, a leak to a competitor could result in colosal financial loss. I remember reading somewhere that the biggest security hole/weakness in ANY network is not the network itself, but the people that interact with it. A machine cannot be psycologicaly stered to do somthing over the telephone, a person can. A company with a workforce that is un-educated to the risks of information leaks can be a very vulnerable target to anyone wishing to gain such information. Particualry vulnerable are lower-level employees, who may hold a lower level of respect to the workings of the company than an employee who has a close relationship with the hiearchial workings of a company. I believe that the biggest (and commonly overlooked) security flaw in any company, is the companys internal phone system, PBX and Voicemail networks. Employees are given the sense that a company voicemail system is for "employees only" and therefore see fit to discuss company sensitive matters on such systems. Most employees are un-aware that they are able to remotely check their voicemail from home, they just use it to COMMUNICATE with other members of the company, to the standard employee, they tend to build up a mental image that the internal Voicemail system is just "one big answerphone", and that is all they will ever need to know about it. I have yet to see a Voicemail system that CANNOT be accessed via an external line. The fact is, voicemail is designed to be an asset to the internal communication of the company, and therfore must be remotely accessable, which in its own sense is the biggest security hole. A typical voicemail system will handle thousands of internal/external messages every working day, and STORE them all on backup devices, digital or tape driven. Most employees dont care for the security of the "work" voicemailboxes, simply because it's "work" and just that, it does not concern them on a personal level, so users tend to be lazy with passcodes (they dont even need one to access voicemail from their workphones). Now, lets suppose that Company A hold an interest in how Company B's financial status. Remotely "they" can dial into Company B's PBX, probably a listed number, get an automated recording, then find the Voicemail login prompt by trying a few well-known numerical login patterns, ie: *# (octel) *81 (meridian) *7 (audix).. or in alot of cases, the employee VoiceMail login menu option will be presented in the IVR menu at the dialin prompt. Once prompted to login, Company A could be essentially stealthing through the entire of company B's voicemail system in seconds.. picking up contact numbers, account information, financial status, ideas etc along the way. A "sophisticated" method would involve a slightly higher aim than just intercepting emplopyee voicemail. All voicemail and pbx networks have to be administered by someone 24 hours a day, and therefore all have remote administration capabilitys. A few things to note, all voicemail messages varying from system to system are backed up on storage mediums, digital or analouge, and can be remotely downloaded for "audit" purposess. A potential spy, could in essance download the entire pbx database for the company they have interests in, ie: company incoming/outgoing phone records, voice data, commonly used conference lines, etc. Another thing to note, is that alot of companys like to use teleconferencing as a means to communicate with remote clients etc. Usually if an employee is invited to attend the teleconference they will be left a voicemail message from the host containing the dialin and password information for the conference call. Again, the possible security risks are endless, and are always overlooked by companys.. "It's just a phone". Anyway, I've illistrated some of the simple methods that can be used by an intruder to remotely spy on someone/somthing. I find it very interesting as to how such obvious things such as common-sense telecom security is always overlooked. Even more interesting is how a large company can spend ALOT of time and money securing and maintaining server's in fear that an intruder could gain internal information about their company, when a single person could pick up a telephone and filter all their companys operations in a matter of seconds. The fact is, most administators do not see a phone system as an imediate threat to security, and will spend little or no time whatsover looking into securing their own phone system. http://hybrid.dtmf.org ====================== S Y S T E M X T E S T A C C E S S S U B S Y S T E M ============================================================================== SystemX Test Access Connection Customer Line Testing on Digital Exchanges. hybrid _\'/_gBH ============================================ To allow testing of subscriber's lines, each subcriber has a Test Access relay in their SLU. The Test Access relay can connect the subs line to a 4-wire testng circuit called a "Test Common Highway." This arrangment is shown bellow. SLU Line Controller __________________________________________________ _________ ___ | .______________._________________________|__| |_ | # | | | | || 2 wires | | .... | |___|---|------O // TA1 // TA2 | |__:__:___| subs | O O | | | | | | .________|_____| | | | | | |::::::::|::::: | | | | | Switch | | | | ____|____ | Plane >|--->> | / 2 wires / 2 wires |_________| | | | | | | TA2 | From the | | | | | Module | | | | | | Controller | | | O -50v | |_________|______________|_________________________| | | | Test | Test The Test Access Relay | Line | Exchange ===================== ::::::::::::::::::::::::: Test Common Highway The MC can send an instruction via the Line Controller to operate Test Access relay (TA) in the SLU. With TA operated, the subscriber's line can be tested via the Test Line Pair of the Test Common Highway an contact TA1. The subscriber's line circuit can be tested via the Test Exchange pair of the Test Common Highway an contact TA2. If "Test Line" is connected to "Test Exchange" is is possible to monitor calls. The "Test Line" and "Test Exchange" pairs together comprise 1 Test Common Highway. The P-SWITCH ============ Following the Test Common Highway back from the SLU, we find it is connected to a piece of equipment called the P-SWITCH. The P-Switch is located in the Auxiliary Module and has 12 Test Common highways (Numbered 0 to 11) connected to it. 11 are availiable for connection to SLU's and 1 for the connection to Per Line Auxiliarys (PLA's). For design reasons, there cannot be more than 24 SLU's connected to each Test Common Highway. Because there are a maximum number of 8 subs per SLU, the maximum number of subs that can be connected to 1 Test Common Highway is 24x8= 192 subs. This means that 11 Test Common Highways can handle upto 2112 subs. However, a Concentrator has a maximum of 2048 subs. So the Test Common Highway is only connected to 128 subs. The Test Access relay contacts are simply teed off its associated Test Common Highway as shown bellow. _______________________ | _ | | To Test Access >> _| | 4 wires 24 SLU's .. | relay contacts >> _}--|---/---. per Test : | SLU 0 _| | | Common ----: |_______________________| | Highway : ___________:___________ / 4 wires : | _ | | : | To Test Access >> _| | | Test Access Relay :. | relay contacts >> _}--|-------O to Test Common | SLU 23 _| | | Highway Connections |_______________________| | =================== ::::::::::::::::::::::::: | _______________________ | | _ | | | To Test Access >> _| | | 4 wires 24 SLU's .. | relay contacts >> _}--|-------+---/---. per Test : | SLU 24 _| | | | Common ----: |_______________________| | | Highway : ___________:___________ | | : | _ | | | : | To Test Access >> _| | | | :. | relay contacts >> _}--|-------+-------O | SLU 47 _| | | | |_______________________| | | ::::::::::::::::::::::::: | / 4 wires ___________:___________ | | | : _ | | | Less than | To Test Access >> _| | | | 4 wires 24 SLU's .. | relay contacts >> _}--|-------+-------+---/---. on last : | SLU 255 _| | | | | Test ------: |_______________________| | | | Common : | | | Highway :. O O O TCH/0 TCH/1 TCH/11 ::::::To the P-SWITCH:::::: P-Q Links ========= There are 12 Test Common Highway's conencted to the P-SWITCH. Connected between the P-Switch and the Local Exchange are up to 4, 2 wire input/output circuits, known as P-Q Links. These are controlled by the Local Exchange PUS and can be used to test either the Line or the Exchange side of an SLU. The way in which this is done is shown bellow. The P-SWITCH/P-Q Link to Test Common Highway Connection ======================================================= LineSide| 2 wires | | reed relay | TCH/0 --------+---/-----------+---------------+---------------+-------> >>>>> --------+---/-----------+---------------+---------------+-------> ExchSide| 2 wires | | | LineSide| | | | TCH/1 --------+---------------+---------------+---------------+-------> >>>>> --------+---------------+---------------+---------------+-------> ExchSide| | | | LineSide| | | | TCH/2 --------+---------------+---------------+---------------+-------> >>>>> --------+---------------+---------------+---------------+-------> ExchSide| |(N) | | LineSide|(M) | | | TCH/3 --------+---------------+---------------+---------------+-------> >>>>> --------+---------------+---------------+---------------+-------> ExchSide| | | | / 2 wires / 2 wires / 2 wires / 2 wires | | | | TCH/11 --------+---------------+---------------+---------------+--------> >>>>>> --------+---------------+---------------+---------------+--------> | | | | | | | | | | | | (0) (1) (2) (3) ::::::::::::::::::::::::::::::::::::::::::::::::::: ::::::: P-Q Links to Test Network Equipment ::::::: ::::::::::::::::::::::::::::::::::::::::::::::::::: The connections between the Test Common Highways and the P-Q Links are made by reed relays. These relays are controlled by the Auxilliary Controller. (The Auxilliary Controller is part of the Auxilliary Module). Instructions to opertate these read relays are origionated by the Test Network Subsystem in the Local Exchange. They are then passed via MTS to the Module Controller, which passes them on to the Auxilliary Controller. If the reed relay marked (M) is operated, then P-Q Link 0 will be connected to the line side pair of the Test Common Highway 3. This will enable any of the subs connected to the Test Common Highway 3 to be tested, simply by operating their associated Test Access relay. Similarly, if reed relay (N) is operated, it will connect P-Q Link 1 to the Test Common Highway 2, exchange side. Monitoring ========== If "Test Line" and "Test Exchange" are connected toghether, it is possible to monitor the subs line. This is achieved by operating two reed relays on one P-Q Link as shown bellow. SLU Line Controller _______________________________ _________ | _________.______/._______|_____| | ___ | | | 2 wires | | |--------------->> | # | | : TA1 : TA2 | | ..... | To Switch Plane |___|---|---O// //O | |__:___:__| ::::::::::::::: | | | ______|________| | | | | | | | | | | |(TA2) | | | | | ___|___ | | | / 2 wires / |_______| | | | | | | | | | | | O -50v | |:::::::::::::::::: |___|____________|______________| ::From the Module:: | | ::Controller::::::: | | ::::::::::::::::::: | | : : _________________ : : 2 wires | | : |______/.____________|___._____________|________ : | : | | | : P-SWITCH | | 2 wires | / 2 wires | |___________________/.____________|___:_____________|________ TA relay shown operated | : | |___:_____________| : Monitoring The Subscriber Line : ============================== : ::: P-Q Link to Test ::: Network Equipment RSC Connections SystemX/X Local RCU Exchange Remote Test Network ================================================================ The total resistance of the test pair between the Test Equipment and the subscribers termination shall not exceed 2000ohms. Therefore RCU DSSS's can also be served from the TNS in the Main Exchange via P-SWITCH in the RCU and Q-SWITCH in the Main, providing the test pair does not exceed 2000ohmz. The prefered location of the Test Unit is to be as close as possible to the Test Network equipment. Exchanges built to SEP2 and SEP3 connection to RSC using Modern LTS. ==================================================================== Sub <--------x ----- x --------> Exchange <------. | ----- | .-------> | |_______| | |_____|_____| DSSS (Located at RCU) | | | | ____|_|_____ | | | P-SWITCH | |____________| | | | | ===============|=|====================================================== | | ____|_|_____ | | | Q-SWITCH | MINI TNS (Located at RCU) | | | | | | | | -----|----O-O-----|-------------O------------------O----- | __|_|___ | ____|____ _______|_______ | |Pseudo | | | | | | | |D/E Swt | | |R-SWITCH | | Test Network | |_| |_| |_________| | Controller | |_____::_| | | | |_______________| | || Built-in Line Test ___|________ | | || Equipment | V24 ACCESS | | | || |____________| | | || | | | || | | ===============|==||================================|==========|========= | || | | | || | | | Test (V24) (TNS) Dial-Back <<..| Pair | | via the main || | (MCS) Exchange Switch || | | Local VDT || | (I/O)------>> __||___________ | | | | | | | Test Unit LTS |____________________| | |_______________| | | ________________| | | | | | (MMI ACCESS) | | RCU | | MAIN EXCHANGE | __|__ | | M | | |_____| | | | (V24 or X25) | | | | =======================|======================|============================ | | | | __________|__________ __|__ | | | M | | LTS PROCESSOR | |_____| OMC |_____________________| | | |________ | | RSC | ________|_________ | |MML DIRECT ACCESS | ________ | | : | || ||_________| |_O/_____|_________| ||______|| (Users Terminal) | | --oooooo-- | | __|__ __|__ ________ (SystemX Terminal) | M || M | || ||_________ |_____||_____| _\'/_ ||______|| | | | --oooooo-- | (V24) (V24) _|_ | __|__ | M |________________| | M | Other Admin |___| |_____| Users Subscriber Line Test Codes * Determine Switch Type ========================== Exchange Type | SALT | FRB | CPI(EN) | CPI(DN) | LPI(EN) | LPI(DN) ==============|=======|=======|=========|=========|=========|======== | | | | | | TXS |175/01 | | |838 (L4) | | |175/03 |839 | |836 (L5) | | |175 |819/174| |810/176 | | |185 |184 | |186 | | |183 |182 | |180 | | |82801 |88 | |80 | | |833802 |89 | |839 | | |91757 |819 | |810 | | | | | | | | ==============|=======|=======|=========|=========|=========|======== | | | | | | TXD |175 | | |176 | | | | | | | | ==============|=======|=======|=========|=========|=========|======== | | | | | | TXE |175 |174 |180 |176/172 |187 |188 |188 | | |186 |188 | | | | | | | ==============|=======|=======|=========|=========|=========|======== | | | | | | TXE4 |175 |174 |180 |176 |187 |188 | | | | | | ==============|=======|=======|=========|=========|=========|======== | | | | | | AXE10 |175 |174 | | | | | | | | | | ==============+=======+=======+=========+=========+=========+======== The TXD Exchange ================ SALT TEST ========= Dial 175.. system will announce the Customers Number (the line you are on) Replace the reciever. Line Test Takes place. Possible delay of upto 30 seconds before ringing is recieved (ringback test). If ringing recieved OK - if no ring fault condition announced when handset lifted. If line tests OK "Dial Next Test" is announced followed by interrupted dial tone. 1. DIAL TEST - Dial 1. ...On DialTone: Dial 1 through to 0 for Loop Disconnect or 1 through to 9 * 0 for MF. If OK "Testing OK" announced. 2. COIN PULSE TEST (POA Only) - Dial 3. ...On PayTone: Insert coins. 1 KHz tone pulse for each coin indication. 3. SPM TEST - Dial 4. ...Supplies 20 SPM pulses (10 long, 10 short). To exit SALT test, replace handset. CPI TEST ======== Dial 176 followed by national number (eg 176 0171-313-3700) 1. LINE FREE - intersupted 1 KHz tone for 7 seconds. Trace tone applied to number. Timeout after 5 minutes. If the customer attempts to make a call, then trace tone removed and engaged tone returned to engineer. Trace Tone reapplied if line becomes free within 5 minutes. 2. LINE SPARE - NU Tone returned. 3. IDENTIFICATION OF B WIRE - Good Earth applied to B Wire returns NU Tone to engineer. Tone removed when earth removed. The AXE10 Exchange ================== SALT TEST ========= Dial access code 175 from the line to be tested. When dialtone is recieved replace the handset. After initial checks telephone will ring, on answer DT recieved. Subsequent tests can be made by dialing the following order codes. ORDER CODE | TEST | DIAL | RESULT ============|============|===================|========================== 2 | insulation | replace reciever | phone rings, | test A-B | lift reciever | tone returned. ============|============|===================|========================== 3 | insulation | replace reciever | phone rings, | test to | lift reciever | tone returned. | earth | | ============|============|===================|=========================== 4 | insulation | replace reciever | phone rings, | test to | lift reciever | tone returned. | -48v | | ============|============|===================|=========================== 5 | insulation | replace reciever | phone rings, | test A&B | lift reciever | tone returned. | loop to | | | earth | | ============|============|===================|=========================== 6 | polarity | | tone returned ============|============|===================|=========================== 7 | loop | | tone returned | resistance | | ============|============|===================|=========================== 8 | dial test | dial 0 | tone returned | keypad MF | dial 0 | tone returned | keypad | dial 123456789*0# | tone returned ============|============|===================|=========================== 9 | bell test | replace reciever | phone rings | | lift reciever | tone returned ============|============|===================|=========================== 10 | service | press button | tone returned | button | | ============|============|===================|=========================== 11 | SPM test | | meter steps * ============|============|===================|=========================== 12 | SALT EQM | | tone returned | test | | ============+============+===================+=========================== * On SPM test 10 pulses are returned. After completion of each successful ordered test another test can be obtained by dialing another Order Code immediatly. Tones Returned: DT = (DIAL TONE) Test Passed ET = (ENGAGED TONE) Test Acceptable FT = (600Hz at 260Ms, 260Ms OFF, 1400Hz at 260Ms ON, 260Ms OFF) Failure. CPI (Cable Pair Identification) =============================== Speaker Circuits: Where digital (TXD) unit exists, in order to gain full access to CPI, it is essential that all speaker circuits be connected to this unit, as access to TXD is not possible from Strowger (TXS) or electronic (TXS) or electionic (TXE). In cases where there is a mix of TXS and TXE only, it would be benificial to connect the speaker circuit to TXS, as when the exchange is modernised, the TXS unit will be the first to be converted into TXD. This will eliminate the problem of having the speaker circuit numbers at a later date. To access CPI from TXD, in all cases, the full national number must be used. This facility is not automaticaly provided and must be requested from Data Managment. _\'/_gBH ping? M E R 1 D I 4 N R E M O T E A D M I N I S T 4 T 1 0 N =============================================================================== Meridian 1 PBX Administration Typed up and slightly edited by Sneeka =-=-=-=-=-=-=-=-=-=-=-=-=-=-= (sneeka1@hotmail.com) Well, seeing as i've found an official Meridian 1 Sysadmin Manual, i thought i might as well type it up. Most of it is pretty simple stuff, so i guess it's mainly for ppl out there just getting started on PBXs, but i've left out the really patronising stuff :) I've decided to split this article into two parts. This first part has two sections. The first deals with a general overview of Meridian 1 and all the equipment associated with it, and the second deals with actually administrating the pbx, in terms of extension manipulation etc. The next part will (hopefully) appear in the next issue of F41TH and will contain info about all the various features etc that you can apply to extensions. Anyway, on with the text.... (btw - some of the longer output captures were taken from my pbx at work (stops me getting finger-strain) so it's not like all the samples are from the same pbx, which means there are some differences between outputs as the shorter ones were just copied out of the manual) Sneeka --- SECTION 1: PRODUCT DESCRIPTION =============================== Meridian 1 ========== Meridian 1, which is the prime Integrated Services Private Branch Exchange (ISPBX) offering in the BT product portfolio, meets the most demanding telecommunications needs of the 90s. Its extensive selection of facilities, features and options provides a highly attractive solution to the communications requirements of a wide variety of customers. Meridian 1 System Types/Options =============================== There are currently four Meridian 1 options available in the UK, namely, Option 11, 51, 61 and 71. The system size range from the small wall mounted Option 11 which caters for between 30 & 200 extensions up to the Option 71 which can handle up to 10,000 ports. The table below shows the basic data on the Meridian 1 Options: Type/Option | Theoretical Max No. | CPUs | of Ports* | --------------+-------------------------+--------------- | | 11 | 250 | 1 51 | 1000 | 1 61 | 2000 | 2 71 | 10000 | 2 *A port is the common term given to exchange lines, private circuits and extensions etc. The main difference between the various Options is the port capacity. The Option 61 and 71 systems also have two CPUs for security purposes. Telephone Sets ============== The Meridian 1 system supports two types of telephone:- a. Meridian 1 Digital Feature Phones. These phones are specifically designed for Meridian 1. There are four types available in the UK, the M2006, M2008, M2616 and M2216. b. Analogue Phones These are any BT general purpose telephone. The Meridian 1 refers to these as 500 sets. M2006 ===== The M2006 is equipped with six programmable keys, a HOLD key and a RLS (Release) key. The bottom key (Key 0) will always contain a Directory Number (DN) and is designated as the Prime DN. The remaining five programmable keys can be programmed with Meridian 1 features such as Call Forwarding. A red message waiting lamp is provided for use with Meridian Mail. On-Hook dialling is available with the M2006 by the user must lift the handset to speak to the other party. M2008 ===== The M2008 is similar to the M2006 with the following exceptions: o Multiple DN capability. o Eight programmable keys. o Optional 2x24 character display. The bottom key (Key 0) is always used for the Prime DN. (Keys 1-7 can be programmed with Meridian 1 features or additional DNs) If the display module is fitted, the top key, (Key 7) will always be used for programming the display. M2616 ===== The M2616 is capable of the following features: o 16 programmable keys. o Two way hands free operation. o Optional key expansion modules. o Optional 2x24 character display. The bottom key (Key 0) is always used for Prime DN. The top left hand key (Key 15) is always used for the hands free/mute. If the display module is fitted, the top right hand key (Key 7), will always be used for programming the display. M2216 - Automatic Call Distribution (ACD) Feature Phone ======================================================= The M2216 is designed to be used in high volume traffic situations associated with Automatic Call Distribution operation. The M2216 have the following characteristics:- o Two headset jacks, (one have a "listen only" option). o Optional key expansion modules. o A 2x24 character display is provided as standard. Features of the M2216 are similar to the M2616. Display Module ============== This option provides a 2x24 character display for M2008 and M2616 (additional power required for the M2008). The display provides alpha-numeric information for:- o Calling / called DN. o Re-routed calls. o Optional Call Party Name Display. (CPND) o Date and Time. o Feature activation assistance. Prompts make the activation of features easier. A screen menu exists for the following which is accessed by pressing key 7 on the set:- o Adjust key click o Activation / deactivation of call timer o Independant volume controls (handset, buzz, ring, on-hook dial) o Screen contrast level o Predial recall (last number which was dialled) o Idle screen format (preferred layout of date and time) o Lauguage selection: English/French/French Canadian/German/Dutch/Spanish Key Expansion Module ==================== The Key Expansion Module is available for use with the M2616 and M2216 ACD sets. Each expansion module gives an extra 22 keys and up to two modules can be added. M2250 Attendant Console ======================= All Meridian 1s can be equipped with a system console(s) (M2250). The console is designed to handle a high volume of calls and there are over 100 call processing feature to choose from that can be assigned to the console. Central Answering Position (CAP) ================================ The Central Answering Position (CAP) is an alternative to the attendant console, and must use a Meridian M2616 or M2216 ACD telephone. It provides many console features including responding ro requests for information, transferring, parking, and placing calls. With the addition of an optional key expansion module(s), the CAP can also have Direct Station Select and Busy Lamp Field features. The equipment required for a CAP is: o an M2616 or M2216 ACD digital telephone o an LCD display o optional key expansion module(s) Extension Circuit Card Capacities ================================= An analogue telephone connects into the Meridian 1 using a Flexible Analogue Line Card (FALC). The digital feature phone connects into the Meridian 1 using a Digital Line Card (DGTL LC). The maximum number of extensions that can be provided on an extension card is 16 on a FALC and 16 (Voice and Data) on a DGTL LC. Digital sets have a data adapter fitted into the telephone foot to allow data to be sent through the Meridian 1 to/from a terminal or computer. Referencing Extensions ====================== A system administrator needs to know how to reference an extension in order to change the features assigned it. The term given to the number that is used to ring the extension is the "Directory Number" (DN). Note that extension users will probably talk in terms of their "Extension Number" rather than "Directory Number". The length of the DN can range from 2 to 7 digits in length. In all examples in this document 4 digits DNs are used. The term given to the physical point at which an extension connects to the system is the "Terminal Number" (TN) and is comprised of the following:- For Types 51, 61 and 71 the TN consists of:- Superloop | Shelf | Card Slot | Unit (Port) -------------+-----------+--------------+-------------- (0-159) | (0/1) | (0-15) | (0-15) eg | eg | eg | eg 004 | 0 | 08 | 01 [ Sorry about the ascii table, but i think you get the drift - Snk ] and Option 11 systems the TN consists of:- Card Slot | Unit (Port) ------------+------------- (0-20) | (0-15) eg | eg 11 | 10 --- SECTION 2: EXTENSION MOVES AND CHANGES ====================================== Administration of a Meridian 1 system can be carried out using three different methods. These are:- Using a Teletypewriter (TTY) Terminal: -------------------------------------- This is the primary method through which all administration functions are available. [ Basically, just calling a dialup with Terminate, Hyperterminal ..or wotever you use - Snk] Using the Attendant Console: ---------------------------- If the system is equipped with Attendant Administration (AA) software package limited admin functions are available from the M2250 attendant console. Using Telephone Extensions: --------------------------- Extension moves can be performed from telephone extensions if your system is equipped with the Automatic Set Relocaton (SR) software package. Later in this document, you will find the procedure for listing what software you have available on the system. On Option 11, you can add a new extension by plugging the new telephone into a spare socket and keying a short code. The features allocated to the new extension are copied from a predefined template (Model Set). Admin From The Teletypewriter (TTY) Terminal ============================================ [ Ok, this is where it really gets patronising, so i'll leave out the obvious points - Snk ] Logging in and out of the system ================================ When the TTY terminal has not been used recently, the screen will turn itself off. If this is the case press return to refresh the screen. If no one is logged into the system the screen will display: OVR111 IDLE If someone is already logged in, it will display: OVL000 To login type LOGI and hit return. It'll then prompt you for a password with 'PASS' if there's a password set. You'll then get a chevron prompt: > To logout, just type LOGO, hit return, and hangup. Loading Overlay Programs ======================== Each Overlay program has a reference number and is brought into memory by typing: LD XX where XX is the program number. The system will come back with a REQ. To exit from a Overlay program, type END and return. The table below is a list of frequently used Overlay programs: Type To Add, Change or Delete To Print --------------------------------------------------------------------------- Analogue 500 sets 10 20 Digital sets 11 20 Customer Data Block 15 21 Speed Call Lists 18 20 Trunk Routes -- 21 Trunk Members -- 20 ACD Queues 23 23 Configuration -- 22 Print Software Packages -- 22 List Unused Units (TNs) -- 20 Set Time/Date 2 2 Data Backup 43 -- Authorisation Codes 88 88 Console Configuration 12 20 Station Print -- 81 Group Hunting Lists 18 20 Group Hunting Pilot DNs 57 57 Scheduled Access Restriction (SAR) 88 88 Flexible Feature Codes 57 57 Call Party Name Display 95 95 Correcting Mistakes =================== The backspace key doesn't remove characters on the Meridian system. You use *'s to correct any mistakes as follows: * Cancels the current line and prompts for input. ** Takes you back to the REQ prompt of the current Overlay program. **** Aborts the current Overlay program. Printing Extension Details =========================== Overlay program 20 is used to print the features assigned to an extension. In order to do this the TN must be known. Find out the TN number by doing the following: >LD 20 {Load program} REQ PRT {Meaning Print} TYPE DNB CUST 0 {To identify the customer if 'multi-customer is work is used. Always set to 0 if multi-customer is not used} DN 5004 {The DN number} DATE { PAGE { Just return through all of these to except the defaults DES { You should get back something like this: DN 5004 TYPE 500 TN 004 0 00 008 DES ROOM26 15 JAN 1992 NACT {Meaning Next Action, just return through it} REQ END {Exit from the overlay program} The TN number is 4 8 (ie. the non-0's in the TN field seperated by a space). The system also displayed the "designation (DES)" which is a 6 character field in the extension's data that can be used for remarks or comments. Printing the Terminal Number Data Block (TNB) of an Extension ============================================================= >LD 20 REQ PRT TYPE TNB TN 4 8 {The TN number} DATE PAGE DES [ Output ] DES ROOM26 TN 004 0 00 08 TYPE 500 CDEN 4D CUST 0 DN 5004 AST NO IAPG O HUNT 2406 TGAR 1 LDN NO NCOS 3 SGRP 0 RNPG 0 LNRS 16 XLST SCI 0 SCPW CLS TLD DTN FBD XFA WTA FNA HTA ONP LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD CFTD SFD MRD C6A CNID ICDD EHTD MCTD GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD MCRD PLEV 02 FTR CFW 4 FTR SSU 0010 FTR FDN 2502 FTR PHD FTR RDL 12 DATE 14 JAN 1992 NACT REQ END Finding a Spare TN ================== To List Unused Units (LUU) do the following: >LD 20 REQ LUU TYPE 500 {To obtain a list of analogue units} TN {Return through this} TYPE 500 TN 009 0 00 02 4D TYPE 500 TN 009 0 00 09 4D TYPE 500 TN 009 0 00 12 4D TYPE 500 TN 009 0 00 22 4D REQ LUU TYPE 2000 {To obtain a list of digital units} TN TYPE 2000 TN 004 0 00 16 8D DTA TYPE 2000 TN 004 0 00 17 8D DTA TYPE 2000 TN 004 0 00 18 8D DTA TYPE 2000 TN 004 0 00 19 8D DTA TYPE 2000 TN 004 0 00 20 8D DTA TYPE 2000 TN 004 0 00 21 8D DTA TYPE 2000 TN 004 0 00 22 8D DTA TYPE 2000 TN 004 0 00 23 8D DTA TYPE 2000 TN 004 0 00 24 8D DTA TYPE 2000 TN 004 0 00 25 8D DTA TYPE 2000 TN 004 0 00 30 8D DTA TYPE 2000 TN 004 0 00 31 8D DTA TYPE 2000 TN 005 0 00 16 8D DTA REQ END {Quit} Finding a Spare DN ================== Spare DNs can be found by listing DNs in a number range and checking it for gaps. In this example a list of DNs in use in the range 2500 to 2599 has been requested. REQ PRT TYPE DNB CUST 0 DN 25 DATE PAGE DES DN 2501 TYPE SL1 TN 008 0 00 01 KEY 00 DES ROOM21 15 JAN 1992 (2006) DN 2502 TYPE SL1 TN 008 0 00 02 KEY 00 DES ROOM26 15 JAN 1992 (2008) TN 008 0 00 03 KEY 03 DES ROOM34 15 JAN 1992 (2016) DN 2503 TYPE SL1 TN 008 0 00 02 KEY 03 DES ROOM67 15 JAN 1992 (2008) TN 008 0 00 03 KEY 00 DES ROOM43 15 JAN 1992 (2616) DN 2504 TYPE 500 TN 009 0 00 07 DES ROOM34 15 JAN 1992 DN 2505 TYPE 500 TN 009 0 00 08 KEY 00 DES ROOM56 15 JAN 1992 DN 2509 TYPE SL1 TN 008 0 00 00 KEY 06 DES ROOM47 15 JAN 1992 (2008) >From this printout you can see that DNs 2500, 2506 to 2508 and 2510 to 2599 are free. Listing Extensions with a Particular Feature Assigned ===================================================== Overlay program 81, termed 'Station Print' is useful for obtaining a list of extensions that have a particular feature assigned. For example to list all extensions in a Pickup Group (Number 1) use Overlay Program 81 as shown below. [ btw - for those who don't know, pickup groups are are groups of extensions that can answer a call coming in on another fone...so, if you had a Managing department, anyone in that group could answer any call coming in on another fone as long as it's part of the managing group number - Snk ] >LD 81 REQ LST CUST 0 DATE PAGE DES FEAT RNP {Requesting that any extension in a ringing number pickup group is listed} RNPG 1 {Requesting only extensions that are in Pickup Group 1) FEAT {Feature}{Cust} {Group} {Terminal No.} {Type} {Designation} {DateChanged} PUA 00 0001 TN 005 0 00 08 2000 ROOM21 25 MAR 1999 PUA 00 0001 TN 005 0 00 13 2000 ROOM24 25 MAR 1999 PUA 00 0001 TN 005 0 00 14 2000 ROOM56 25 MAR 1999 PUA 00 0001 TN 006 0 00 01 2000 ROOM65 25 MAR 1999 PUA 00 0001 TN 006 0 00 03 2000 ROOM11 25 MAR 1999 PUA 00 0001 TN 006 0 00 12 2000 ROOM70 25 MAR 1999 PUA 00 0001 TN 133 0 00 04 2000 ROOM34 NO DATE PUA 00 0001 TN 133 0 00 05 2000 ROOM23 NO DATE PUA 00 0001 TN 133 0 00 06 2000 ROOM12 NO DATE PUA 00 0001 TN 133 0 00 07 2000 ROOM10 NO DATE REQ END {Quit} Adding and Rearranging Extensions ================================= The overlay program to load in order to add and rearrange extensions is dependent on the type of extension: Analogue - LD 10 Digital - LD 11 Once you've loaded the program, you'll get the familiar REQ prompt. Here are some of the common actions you can take: NEW - Add a new extension. With this command you have to specify each data item individually. CPY - Add a new extension by copying an existing unit. CHG - Change any feature assigned to an existing extension. MOV - Move an extension and all its features from an existing TN location to a different TN location. OUT - Delete an extension from the system. END - Exit the Overlay Program. Adding a New Extension ====================== To add a new extension you can respond to the REQ prompt with one of two commands, namely NEW and CPY. With the NEW command the system will in turn display each prompt in the Terminal Number Data Block (TNB) to which you must type a response. This method would typically be used only if there was not an existing extension on the system with similar features to that which you are trying to add. If however there is an existing extension, with similar features already in the system, use the CPY command. Example 1: ---------- In this example TN 9 9 with a DN of 2506 will be added by copying from an existing TN 9 7. >LD 10 REQ CPY 1 {Copy one new extension} TYPE 500 {It's an analogue phone, so the type is 500} CFTN 9 7 {Copy feature(s) from TN 9 7} DES ROOM26 {It outputs the designation of TN 9 7} TN 9 9 {Terminal number where the new extension is to be located at} DN 2506 {DN of new extension} NEW 500 TN 009 0 00 09 DN 2506 {It outputs a confirmation of wot You've just added} REQ END {Quit} Example 2: ---------- In this example TN 9 10 with a DN of 2507, and TN 9 14 with a DN of 2508, will be added by copying the features from existing TN 9 7. >LD 10 REQ CPY 2 TYPE 500 CFTN 9 7 DES ROOM26 SFMT TNDN {TNDN tells the system that each TN and DN will be specified by the sysadmin for the new extensions. AUTO may be typed instead, which requests the system to automatically select the next free TNs and DNs in the sequence starting with the specified TN and DN.} TN 9 10 {Type TN and DN for DN 2507 1st new extension} NEW 500 TN 009 0 00 10 DN 2507 TN 9 14 {Type TN and DN for DN 2508 2nd new extension} NEW 500 TN 009 0 00 14 DN 2508 REQ END {Quit} Changing the DN of an Extension =============================== Analogue Sets: To change the DN of an analogue set load Overlay program 10. In the example below the TN has already been established as TN 9 3. The DN for TN 9 3 is to be changed to 2207. >LD 10 REQ CHG TYPE 500 TN 9 3 ECHG YES {Type YES to use the Easy Change method} ITEM DN 2207 ITEM {Return through the next ITEM prompt} REQ END {Quit} Digital Sets: Every digital extension will have at least one DN assigned. This DN is termed the "Prime DN" and is assigned to key 0. M2008 and M2216 sets can be assigned additional DNs. These are assigned to keys in the same way as the Prime DN, the only difference being the key number that is assigned [ More on "Multiple DNs" will be covered in part two of this article - Snk ]. To change the DN of a digital set load Overlay program 11 as shown below. The DN for TN 8 3 is to be Single Call Ringing (SCR) DN 2277. >LD 11 REQ CHG TYPE 2008 TN 8 3 ECHG YES ITEM KEY 0 SCR 2277 {Specifying a SCR DN of 2277 on Key 0} ITEM {Return} REQ END {Quit} Moving Extensions ================= As mentioned earlier in the product description analogue and digital extensions connect to different types of circuit card. Hence analogue and digital sets cannot be interchanged by unplugging one type of set from the socket and replacing it with the other type. A wiring change needs to be performed by an engineer. Like extensions (analogue or digital) however can be moved around the system by programming. There are two commands that can be used to move extensions (CHG and MOV) with Overlay programs 10 (analogue) or 11 (digital). The two methods are demonstrated below. Example using CHG ----------------- In this example extension 2206 and 2404 want to swap locations but keep their existing DN and features. A listing of the two extensions will be taken first and then the CHG command will be used to swap the extensions. >LD 20 REQ PRT {Print Request} TYPE DNB {Obtain the TNs for both DNs} CUST 0 DN 2404 {Hitting SPACE after this allows you to enter more than one DN} DN 2206 DATE { PAGE {Return through these to except the defaults} DES { DN 2404 TYPE 500 TN 009 0 00 010 DES ROOM21 14 JAN 1992 DN 2206 TYPE 500 TN 009 0 00 02 DES ROOM78 14 JAN 1992 NACT {Next Action - just return through it} REQ PRT {Print out the two TNs to compare differences} TYPE TNB TN 9 10 TN 9 2 DATE PAGE DES DES ROOM21 {The system then outputs the two extension configs} TN 009 0 00 10 TYPE 500 CDEN 4D CUST 0 DN 2404 AST NO IAPG O HUNT 2403 TGAR 1 LDN NO NCOS 3 SGRP 0 RNPG 0 LNRS 16 XLST SCI 0 SCPW CLS TLD DTN FBD XFA WTA FNA HTA ONP LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD CFTD SFD MRD C6A CNID ICDD EHTD MCTD GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD MCRD PLEV 02 FTR SSU 0010 FTR FDN 2502 FTR PHD FTR RDL 12 DATE 14 JAN 1992 DES ROOM78 TN 009 0 00 02 TYPE 500 CDEN 4D CUST 0 DN 2206 AST NO IAPG O HUNT 2501 TGAR 1 LDN NO NCOS 3 SGRP 0 RNPG 0 LNRS 16 XLST SCI 0 SCPW CLS TLD DTN FBD XFA WTA FND HTA ONP LPR XRA CWD SWD MWA LPD XHD CCSD LNA TVD CFTD SFD MRD C6A CNID ICDD EHTD MCTD GPUD DPUA CFXD ARHA OVDA AGTD CPFA CPTA UDI HBTD DDGA NAMA MIND NRWD NRCD NROD CRD PRSD MCRD PLEV 02 FTR CFW 4 FTR SSU 0010 FTR PHD FTR RDL 12 DATE 14 JAN 1992 NACT {Return} REQ END {Quit} So, from those two printouts you can see that following changes need to be made: Changes to TN 9 10: ------------------- Existing Change to ------------------------------ DN 2404 DN 2206 HUNT 2403 HUNT 2501 CLS FNA CLS FND FTR FDN 2502 needs to be deleted and FTR CFW 4 needs to be added Changes to TN 9 2: ------------------ Existing Change to ------------------------------ DN 2206 DN 2404 HUNT 2501 HUNT 2403 CLS FND CLS FNA FTR CFW 4 needs deleting and FTR FDN 2502 needs to be added The following solution shows how to do this: >LD 10 REQ CHG TYPE 500 TN 9 10 ECHG NO {We won't use Easy Change here, just so you can see the differences} DES ROOM21 DES DN 2206 MIX {MIX is just the system telling you that this DN is assigned to more than one TN} AST {Return through the items you don't want to change} IAPG HUNT 2501 {Change the HUNT number} TGAR LDN NCOS RNPG SCPW SGRP CLS FND {Change the class of service to Forward No Answer Denied} LNRS SCI PLEV FTR CFW 4 {Add the feature Call Forward All Calls} FTR XFDN {'X' before the mnemonic deletes the feature} FTR MIX {Just another warning, ignore} REQ CHG TYPE 500 TN 9 2 ECHG YES {We'll use Easy Change this time} ITEM DN 2404 ITEM HUNT 2403 {Basically, all that's different is that you type the item's mnemonic that needs to be changed, along with the value(s)} ITEM CLS FNA ITEM FTR FDN 2502 FTR XCFW FTR ITEM REQ END A More Easy Way (using MOV) =========================== In this example extension 2206 and 2404 want to swap locations but keep their existing DN and features. The MOV command will be used three times to do this. But first you need to use LD 20 to get the TNs of the extensions and a spare TN. We'll be using TN 9 9 as the spare here (2206's TN is TN 9 2 and 2404's is TN 9 10). >LD 10 REQ MOV TYPE 500 TN 9 10 TOTN 9 9 REQ MOV TYPE 500 TN 9 2 TOTN 9 10 REQ MOV TYPE 500 TN 9 9 TOTN 9 2 REQ END [ That's pretty much self-explanatory so I won't bother with any comments - Snk ] Deleting an Extension ===================== This process will delete the extension number (DN) and all the features currently assigned to a TN, making the TN spare. Respond to the REQ prompt by typing OUT to delete an extension (shown below): >LD 10 REQ OUT TYPE 500 TN 9 2 {TN of the DN to delete} REQ END Misc. Operations ================ Setting the Time and Date ------------------------- To set the time and date you use overlay program 2. Once LD 2 is loaded, you will receive a "." Prompt instead of a ">". This is because LD 2 used to be a maintenance program. At the . prompt test the current date and time by typing: .TTAD {No carriage return is needed} To set the time and date type: .STAD The clock is set when you hit return. To exit from LD 2, just type **** (no return needed). Backing Up the System Data -------------------------- Meridian 1 automatically backs up data changes during the midnight routine. However, after extensive changes have been made, it's advisable that a manual back up is performed as follows: >LD 43 .EDD {Execute a data dump} Wait for the system to display "DATABASE BACKUP COMPLETE" then type **** to exit. Re-enabling Digital TNs ----------------------- If a digital phone is unplugged from its socket, the TN may be disabled during a background routine [ ie. da fone won't work :) - Snk ]. To re- enable it, do the following: >LD 11 REQ CHG TYPE 2008 {Digital phone} TN 8 5 {TN that needs re-enabling} ECHG YES ITEM {Just return on the first ITEM prompt and the system will re-enable the TN but not make any changes to it} REQ END --- Ok, that's all i'm gonna type for this article, can't be arsed to type anymore. Hope you found some of that useful. I'm off to do some tracking.....see you in the next one.. Sneeka sneeka1@hotmail.com --EOF C E L L U L A R T R A C K 1 N G =============================================================================== |---> Methods Used To Track Cellular Phones <--- || -------------------------------------- ||-=By=- \\--------> -=Tradeser=- \\ \\---------> tollphree.com As cellular telephony has advanced with wireless locating, many emergency calls have moved to wireless media. Cellular emergency calls cannot be traced back automatically, nor can cell-phone users be located when in transit. In March 1996, the FCC required that all wireless carriers be equipped with a locating feature by the year 2001. The wireless industry has been scrambling for a solution ever since. Yet, I think that is a load if BS. The FCC and NSA most likely have had away to track and listen to all cellular phones in the US sense cellular phone were invented. Almost every wireless location technology was as originally conceived for defense purposes and National security purpsoes. The idea being to track enemy spies or criminals within US boarders radio communications back to him or her. These strategies used to track them was fall into a few different tracking methods I have reasearded. These techniques are GPS, Triangulation, Radio Cameras and Time Difference of Arrival tracking. Wireless communication in wartime was based on tactical communications and signal processing, For this purpose, portable communications devices were developed that would become the ancestors of the modern cellular handset. There is a solution to the caller location problem that is dependent on the Global Positioning System (GPS). GPS is a satellite-based technology that is used to locate you on the suface if the earth with those GPS hand held devices and to help boats and airplanes navigate. Right now there are so many manufacturers of handsets across the globe, That I don't care anymore about which cell manufacturers claim are the best. Give me a Nokia and I'm set. Now that units are shrinking in size dramatically, and the biggest problems involved in installing a GPS into ever-smaller handsets will make someones job a nightmare. Moreover, the idea of developing GPS-based locating technology may be doubtful in itself. While GPS works fine if one is guiding a missile or helping a jumbo jet navigate its way across the ocean, using it on the ground would prove a few major problems because the signal would be blocked by thousands of natural and man-made obstructions such as my aluminum hat I wear to block the CIA from reading my mind. Well any way... Traditional network solutions work on the principle of triangulation. There are two approaches to triangulation. The first is based on angle of arrival, the second on time of arrival. In a typical scenario, a communications network consists of two to five base stations. Finding the caller is a matter of calculating the call’s line of bearing. Theoretically, the caller will be found at the intersection of the two lines of the angle of arrival, which could be up to a 125 meters square. Time of arrival is used with at least three base stations. Callers are found by measuring the time required for the messages to be transacted. When time is translated to distance it becomes possible to trace our line up the call to its source. Triangulation is a step up from GPS, but here again a clear line of sight is imperative for the process to be effective. The trouble is that most of today's cellular traffic is generated in big cities with massive permanent structures all around. U.S. Wireless has created a solution that overcomes the line-of-sight problems associated with GPS and triangulation. "Radio Cameras" a PC-sized locator that is deployed downtown and in rural places where a small number of stations are available. The boxes are installed at base stations throughout their operational area. There they go through a "learning" process, by which calls are identified and "fingerprinted" based on their location. Every call received by the base station gets a location-fingerprint which the camera recognizes down the road. This solution overcomes the line of sight problems that you get with GPS-dependent locating technology and triangulation. Because a Radio Camera is not triangulating but fingerprinting, it does not require the cooperation of two or three bases. The Radio Camera technology also exceeds the limit for accuracy stated by the FCC ruling. To meet the FCC's requirement, location must be accurate up to 125 meters. Radio cameras are accurate to 20 to 40 meters, which is four or five times more accurate that the rule requires. This is not a bonus but a necessity. If you're chasing down criminal or some PLA kid with a stolen cell, you need to get as close to the mark as possible to make an arrest. Time Difference of Arrival (TDOA) measures the time required for a signal to travel from a handset to a base station. When this process is duplicated three or four times, it provides the data needed to perform a mathematical process known as hyperbolic trilateralization. Similar to triangulation, trilateralization works with very high-speed measurements. Because it works in nanoseconds, the process provides extremely accurate location information that can be used to track vehicles in motion, or someone making a call in a sky scraper. Welp, that all I can write about methods of cellular tracking right now. But, I have been reading about this tracking method called MicroBurst. All I know right now is that a trucking company in the US uses it to for position tracking of their trucks. 8 0 9 P H 3 3 R F 4 C T 0 R D I G I T 4 L C 5 =============================================================================== /-------------------------------------------------------\ 8-0-9 809 INTERNATIONAL COMMUNICATIONS PRESENTS.... \-------------------------------------------------------/ greetz to: PTT Gabon, Chennai Telephones (heh), Sovintel, Mongolise Telecom, Swaziland Posts and Telegraphs, France Telecom, Telephone Services of Trinidad and Tobago (TSTT), Myanmar Posts, Telegraphs and Telephones (Run by Brigadier General Win Tin...LOL) more greetz to: _dave, Psyclone, Polymorph, hybrid, Shadow, b00ger, cf Saman, Darkcyde, gamma_, c0, pyke, hopye, Keltic Phr0st Jasun, backa, Mister-X, zomba, ptek, xio, Dr.Fonk, xohs michella, substance, dr_phace, Rockman, Guru Josh (heh), defiant, ganjaman, deginge, everyone at LoK... groups: Darkcyde, Ground Phloor Industries, MeD, GBH, and OlderGeneration (OG) --------------------------------------------------------- AN OVERVIEW OF DIGITAL CCITT SYSTEM 5 AND ITS USES --------------------------------------------------------- UK NZ USA TRINIDAD --------------------------------------------------------- dynamics, NynexPhreak, RedBlade, Lucky225, pyke --------------------------------------------------------- "sHinInG hApPy pHrEaKeRs sHaRiNg k0Dez" A fairly recent development in signalling has been the digitisation of CCITT 5, allowing faster connections and a cost effective switching solution with the robust nature of System 5 and the advantages of a digital switching system. It's not surprising therefore that so many countries now use digital c5 to switch their international traffic. Digital c5 is in essence, CCITT 5, but with the tones encoded into digital format. Addition proceedures for this system have to be set-up meaning that each trunk is alloted a timeslice for signalling. Similar to SS7, a signalling link is operational, and digital c5 is common channel signalled. All system 5 signalls are present in this system, and the signalling cycle is the same for the most part. For those of you who are unfamiliar with system 5, a typical simplified signalling cycle would look like this: OUTGOING INT GATEWAY----------------------------INCOMING INT GATEWAY [ DMS / xESS ] | | [DMS / xESS ] | seizure f1 | |--------------------------->| | proceed-to-send f2 | |<---------------------------| | address info | |--------------------------->|-TRANSLATED AND ROUTED | answer f1 | |<---------------------------| | acknowledgement f1 | |--------------------------->| | | | S P E E C H | | | | clear back f2 | |<---------------------------| | acknowledgement f1 | |--------------------------->| | clear forward f1/f2 | |--------------------------->| | release guard f1/f2 | |<---------------------------| | | f1 = 2400 Hz f2 = 2600 Hz The cycle above is based on the analogue inband version, but the digital cycle is identical, only the tones are data packets and are transmitted on a seperate signalling link. ADVANTAGES AND DISADVANTAGES ============================ "tEll mE wHaT's sO gOoD aBoUt tHis..." The system has many advantages, post-dialling delay is shorter using digital system 5 as compared to the analogue-inband version. Digital multiplexing can be used, and the system is far less susceptable to tone-imitation fraud [blueboxing to me and you ;) ]. Links can be monitored with great ease, and digital switches are used with the system, allowing all the advantages of these switches to telephone companies. In addition to the many advantages, it's much cheaper to install that SS7. A typical digital c5 system would require a digital switch, DCME equipment and E1 trunks for the encoded links. SS7 requires more equipment such as line cards, and the ITU/CCITT reccomendations for SS7 are very flexible meaning that compatibility issues can be a problem. The system 5 specs are much more rigid, meaning greater compatibility between networks. One downside of system 5 digital is that it cannot carry ANI/CLI at present. This is due to the absence of this reccomendation from the System 5 spec to date. I'm sure at a later stage, this could be included, allowing ANI/CLI to be passed via digital-c5 links. This would be extremely advantageous, because one of the main international ANI/CLI passing "hurdles" with SS7 is compatibility of the various "flavours" of SS7, whereas digital c5 is a far more tightly spec'd system, allowing ANI/CLI to be passed easily if it were specified in the system. TYPICAL STRUCTURE OF A SMALL NETWORK USING DIGITAL SYSTEM 5 FOR =============================================================== INTERNATIONAL CONNECTIONS ========================= "dIgItaL c5? iT's kIndA lIkE mIcRoSofT uNix (bUt wItHouT tHe bUgs)" One disadvantage of digital-c5 is that interworking the system using a single stage of conversion is difficult. As a result, the interworking process between the international gateway and the national network is generally done in 2 stages. Typically, stage 1 converts the digital c5 signals into an MF based regional system such as R2 or R1 (North American/Bell System MF), R1 is favoured generally because it is comparatively basic and very compatible with most national systems. The second stage converts the R1 routing into the national system, this being SS7, SS6, R2 etc. - Conversion Diagram C5 converted to R1 R1 converted to SS7 /---------------\ /---------------\ |INTERNATIONAL | |NATIONAL | On to the ===DIGITAL C5==>|GATEWAY SWITCH |--R1-->|GATEWAY SWITCH |-----SS7----> |(Digital) | |(Digital) | national net \---------------/ \---------------/ In theory, it could be left as North American MF-R1 or the intermediate system used in stage 1 of the conversion for countries whose national networks are analogue based on that system. This would generally be unusual, as SS7 holds many advantages for national networks and these are generally modernised first. There are a lot of examples of this method of interworking. For example, Cable&Wireless St Kitts and Nevis (Skantel)... ST KITTS /-----------------------\ | |Eastern Caribbean Microwave System | /------\....|.................................... | |5-ESS |D-C5|Eastern Caribbean Fibre System [D-C5] | \------/----|------------------------------------ | | | | R1 | NEVIS | /------\ | /---------------\ | |DMS100| | SS7 | /------\ | | \------/...|.......|..|DMS100| | | ST KITTS SWITCH | | \------/ | | | | NEVIS SWITCH | \-----------------------/ | | | | | | | | | | \---------------/ As you can see, the digital c5 link is first converted to R1, then converting the R1 routing to SS7. A 5ESS forms the international gateway, with the St Kitts switch being the national network gateway as well as serving St Kitts. On calls to this island, clear background dialling is audible (a tell tale sign of R1), but call set-up times are top-speed and quality of calls is excellent due to the digital nature of the systems used. An acknowledging "pleep" is heard from the R1 portion on answer, and the call path set-up. This pattern is similar in Belize too, where Belize telecom use digital c5 for links to the US, and then have an R1 link between their international 5ESS switch gateway and their national gateway. In both examples, the national network is SS7 signalled. Belize telecom use system R2 for PBX links. --------- |COROZAL| |DMS 100| --------- | |SS7 | ------------- |ORANGE WALK| | DMS 100 | ------------- \ \SS7 \ \ ------------- |BELIZE CITY| | DMS 100 | ------------- / / / / /SS7 Digitally Encoded C5 / AT&T MCI TELMEX } E1s ------------- | | | } | NAT GATEWY| -------------------- OPERATORS--| BELMOPAN |...........|5ESS [Dig Enc C5] | | DMS100 | R1 |INT GATEWAY SWITCH| /------------\ -------------------- |SS7 \ ------------- \ |SAN IGNACIO| \ SS7 | DMS 100 | \ ------------- \ \ \__------------- | DANGRIGA | | DMS 100 | ------------- / / / / / / /SS7 / / / / / ------------- |PUNTA GORDA| | DMS 100 | ------------- The diagram above is very simplified, there are many more switches than those shown, but I think you get the idea that they are all DMS100s and the national network is SS7. All international calls go via the appropriate carriers on Digital C5 switched trunks, acknowledgment "cheeps" are sent on answer of incoming transit calls, these are from the R1 link between gateways. All calls are muted until an answer signal is recieved, as standard with the DMS100 switch. The reason that the International Gateway is a 5ESS is because no DMS250/300 was available at the time, as with the St Kitts example. Both countries are relatively small, and signalling times for digital-c5 connections are generally marginally longer, it would be interesting to see the performance of digital-c5 with busier routes in a larger switching environment. The c5 signalling cycle seems to be rather long, although when packetised as with digital-c5 it is of course a lot quicker. I think the main delaying portion of the journey is in the interworking stage when 2 stages are used in the process. In theory, digital-c5 could perform well even on the busiest routes and might be a viable solution for busier international switching environments that still have not digitised fully as of yet. In fact, while on the subject, system 5 is still the most popular world system in use. As I have mentioned before, due to its sheer versitility and different types, it can be found to some in extent in most countries. For instance, CCITT5bis, an early MF compelled system (i.e forward and backward dialling as with R2) was specified and Denmark ordered some 5bis equipment in the 80s. With the addition of the digital version, it makes CCITT5 one of the most widely adopted standards in the world today. CONCLUSION ========== "hE's gOiNg tO bLab aBoUt hOw aMazIng iT is" All in all, digital C5 forms an excellent system for switching transit calls. Despite some minor disadvantages, many of which could be resolved by "patching" the system with additions, it lives up to the robust and dependable reputation which System 5 enjoys, and combines the simplicity and dependability of time-proven switching methods with modern, digital methods. This results in an efficient and cost-effective switching system, and is finding application globally. (Wow, I do really love c5... Obsessed? Understatement.) - dynamics Darkcyde/809 "tHanK-yOu aNd gOodByE...." wtf?? no pleep?!?!? E N D =============================================================================== [c] D4RKCYDE. 1997,1998,1999,2000 http://f41th.com #darkcyde efnet. G L O B A L F E A R. ...click.