ThoughtPhreaker

Members
  • Content count

    1,585
  • Joined

  • Last visited

Community Reputation

92 Knowledgable

1 Follower

About ThoughtPhreaker

  • Rank
    Dangerous free thinker
  • Birthday 11/02/1991

Profile Information

  • Gender
    Male

Contact Methods

  • Website URL
    http://
  • ICQ
    0

Recent Profile Visitors

28,359 profile views
  1. That actually makes me wonder; would it be worth looking into using operator trunks for something like this? There's not particularly a lot available about how they work, but since they can all still hold you up when you call it, ostensibly there's a switch that won't account for that on incoming traffic, and might think you're gone when you're not. I actually tried this locally, and while it didn't work, I did hear bitrob after the distant end hung up. If that's an indication that the trunks to the TOPS tandem aren't SS7, that's a pretty encouraging sign because: A. There's only so many things a switch can do to hold up a subscriber, let alone communicate with another one without a signaling channel B. If the conditions to confuse a switch are just right someplace, it'll almost undoubtedly be listening for MF if/when it goes off-hook again.
  2. Most carriers round up to the nearest minute. As for supe, usually you can flash to figure out. If you get a stutter dialtone, it's suped. If it stays there, it hasn't. Yup. Well, where they work anyway. It's sort of hit and miss. EDIT: Oh, right. So I promised a recording of a crossbar switch. So, here's a good number from that Crossbar thread I made a while back; +380-542-33-6600. http://thoughtphreaker.omghax.ca/audio/ukraine_xbarbusy.wav At first glance, it sounds a little plain. But if you turn up the volume and filter out the tone, you get this... http://thoughtphreaker.omghax.ca/audio/ukraine_xbar_mfflutter.wav The ex-Soviet countries have this weird inband system that lets them send not in service messages via MFs, which winds up translating into an SS7 cause code by the time you get it. So even finding a busy number like this takes a good while.
  3. Basically, they're like feature group D access codes, but designed as sort of a workaround; they're specifically seven digits so they could work from step offices and such back when equal access first became a thing. You're playing with fire there. Racking up toll charges on things that aren't yours is a good way to piss off whomever owns it. Especially if you're casual dialing traffic on a CAC they're not necessarily subscribed to. That being said, I got to stack up calls between local trunks on a couple different switches before. If you can get around the loop detection algorithm (usually just a pause of a few seconds works. In Qwest territory, there's an IVR that makes you press 1 to tell it you're not a telemarketer. This works probably a lot better for this than they intended), you should be able to stack effectively as much as you'd like. But it's really hard to get a lot of degradation on good trunks. Yeah, it simplifies the recording hardware too, since you can just send the PCM stream from whatever is receiving it to a hard drive or something, and be assured you're getting an exact copy of what's coming over the network. The problem is some LECs charge non-sane prices for BRIs (like, $400 or something in AT&T territory; you can get a whole PRI for cheaper in some cases). The reason they can get away with this is it's a niche service that broadcasters and voiceover types love; a good chunk of sports broadcasts/commercial voiceovers/occasionally radio interviews/etc, since there's boxes (like the Zephyr I talked about earlier) that'll haul MP3/AAC/etc over the B channels. With no ISDN though, you can still compromise and just three-way stuff into a voicemail box that lets you download messages if they don't muck it up with any sort of processing; http://thoughtphreaker.omghax.ca/audio/33-9693-67000.wav . Finding one that's just right can be tough, though - that particular one was from K7 back when it was still a thing. I'm still trying to find something like it. Ooh, nasty >.< . Yeah, some providers really nail you for calls without a subscription. Usually if it's just a one minute call, you can just act all confused and they'll tell you to tear up the bill. This usually winds up with you getting blocked (you can still dial 101-0288-0) though.
  4. Bleah, I hope everything goes well with that >.< . I don't have to tell you telcos and billing aren't a happy combination. https://www.nationalnanpa.com/enas/formCICDMasterReport.do And here's some 950s if you're into them: https://www.nationalnanpa.com/enas/formCICBMasterReport.do I've got something like this lying around. It's got a few years on it, but I'll see what I can do to get it exported. I think eastern Europe is your best bet for that, but there's some weird, clicky switch that usually comes into play on AT&T calls to places like Germany (if you don't want to pay for a call to Germany, UIFNs are a perfectly valid option here). I never bothered to look into that, but in retrospect, probably should. My money is on it being a PRX-A or something. I'll update this post in a bit hopefully with a number that can terminate through that, and a recording of an electromechanical switch to boot. I've been avoiding this method recently since the cheap 2500 clone I've taken to using has a noisy amplifier in it (most phones not so much), but the cheapest and easiest way to get good sound is to cut an old handset cord in half, and wire the earpiece output into a 1/8" jack for a recorder. Optionally, you might want to consider putting an isolation transformer in the circuit if you're planning on recording with anything that gets AC power, and put a varistor equivalent (the ITT clone I have just uses some generic current limiting diode) across the two leads to even out the big spikes from battery drops and stuff. It's not essential, but it makes recording a lot less annoying. One more thing; don't plug it into a Trimline, or anything like it with a keypad in the handset. Those push out line voltages to drive the DTMF IC. Anyway, the quality you get from a circuit like that depends on the quality of your line card's output and the network in your phone. WECo phones most notably, while they tend to be pretty good, do add a significant bump EQ-wise around 1 KHz, and eliminate the very low frequencies. If you're lucky enough to be served out of a really nice channel bank like the one scratchytcarrier is on, they will transmit that sort of thing, but most tend not to. Here's what a WECo phone sounds like on one of those compared to an ISDN circuit. http://thoughtphreaker.omghax.ca/audio/410844_420.flac http://thoughtphreaker.omghax.ca/audio/410844_isdn.flac The line card actually has less noise than the weird chain of stuff I recorded the ISDN output from (Telos Zephyr -> Axia Livewire node -> headphone out on some Fostex monitor doohickey). This is partly because the output from the one I was on was unnaturally loud; if you called, say, 800-CALL-ATT from that line, the audio logo almost makes you want to move your ear away from the phone.
  5. I don't think so, but you might be able to find a European switch that does something close enough that it'd work with PCI; the French apparently had this crazy signaling system called SOCOTEL that involved pushing DC voltage down the line.
  6. 574-267-0001 - DMS-100 DISA 928-757-0200 - Another DMS-100 DISA 707-595-4223 - A little something at a Nordstrom. Try pressing nothing at the prompt. As per the recording on 0102, that's a Meatwitch VP3510 or something like it. I couldn't get anything that didn't kick back a not in service message over SS7 on the other exchanges, but I assume more of the same. Either that, or someone retrofitted some NX-2s with SS7 gear.
  7. All the discontinuance notices specifically mention residential accounts. I'm guessing they have some large corporate customers who like this sort of thing for overseas travel and such. Most of the prepaid calling card market are bottom of the barrel providers like IDT, but there could be some good ones out there. I might make a post about this at some point if I can find something that's across the board good.
  8. It took me a while to figure out those things were just, well, faxes, and not anything cool, but they're just fax machines. Why they can't answer with the normal handshake is anyone's guess, but they'll change their tune right away if you send the fax presence tone (1400 hertz, I think?).
  9. Actually, does either work? There's a good chance either could.
  10. So you've got me all curious here now; that DISA on your switch - since the DMS is pulling up a digit receiver and stuff, can you still flash while you're sitting at that dialtone? It definitely supes, so there should theoretically not be any excuse for it not to.
  11. 'fraid it's not Telex anymore. The area code's most well known use is the GETS (Government Emergency Telephone Service) access number; 710-NCS-GETS. Basically, that number is for priority routing over the phone network in the case of an emergency. Because redundancy is the sort of thing you should have with a service like this, calls to it can be terminated over three networks; AT&T, MCI, and Sprint. Also, everything is free to the person originating the call. Popular legend will tell you the NCS-GETS number is the only one in that whole area code. In reality, it's a little different than that, but everything else comes and goes almost seasonally. So keep an eye on it. Due to some *cough* network upgrades a number of years ago (which can be routed around; just not here, sadly), 710 calls via the AT&T network sound hilariously bad at times. For that reason, it's recommended you prefix 710 calls with 101-0222 or 101-0333. If you do use MCI, do yourself a favor and try pressing # before the call goes offhook. Handy stuff! Even moreso if your MCI tandem happens to be a DEX. This would also be a good time to remind everyone that while the 5ESS and DMSes using these VMSes will disguise your CPN, the GTD-5s will not.
  12. So not too long ago, I stayed at a hotel with a Mitel PBX. While my batteries gave out in the middle of recording, I managed to get the most interesting things recorded. Here's the recording, and an explanation of what call is what. http://thoughtphreaker.omghax.ca/audio/mitel_hotel.flac First call: dialed 83, got second dialtone, then dialed 12. Got stutter dialtone. Then slowly dialed 8326 (no stutter dialtone after 83 this time, but the result is effectively the same) and got a 2025(ish) hertz tone. Second call: I dial 306 and get a long stutter dialtone. I start to dial 83+something else, but get a reorder with just 83. Though they're not recorded, I know from other calls that you can call normal things just fine with this. Third call: I dial 8310, and wait. The PBX does nothing. Fourth call: I dial 8326 again, this time straight from the dialtone, and dial two when the 2025 hertz tone comes on. It breaks immediately, so I try pressing more digits. The PBX wasn't very receptive to this treatment, so I eventually get tired of waiting and hang up. Fifth call: I dial 8311, and get a solid dialtone (no stutters) back. From there, I dial 8325 (notice again that I don't get dialtone back after 83), and get yet another dialtone back! This one has two bursts of 440 hertz in it. From this one, I try dialing 5000 (a extension that goes straight to voicemail), and the PBX just hangs. Sixth call: I dial 8324, and get a 440 hertz tone back. My first thought is this might be some sort of announcement recording device or something like it, so I try dialing #. Like most of the stuff in this confusing hundred block, it does nothing, so I hang up. Seventh call: I dial 8332, and get silence. After dialing a few extra digits, this time I wait a really long time before the PBX just dumps me to a new dialtone. From previous calls, I suspect this is a normal one, so I try dialing 8310 from it, and get the exact same thing.
  13. If you home on a 5ESS for AT&T toll traffic then it should be, but that isn't always necessarily true; I don't think 206-9L cooperates with this sort of activity for some reason. In any case, 503-9L and 253-9L are DMS-250s, the latter of which is mostly just available from GTE areas. In any case, I couldn't get either of them to work. If you'd like to hear what it's like though, that dialtone JCSwishman found will let you call it there. 400 hertz - not 480, but yeah. That goes to a Worldcom DMS-250 using something similar to get you it; notice if you press *, you still get dialtone back. In order to do anything interesting though, you'll need an authorization code. I think he means this lady specifically: 702-310-0042.
  14. So this sorta falls into the category of "stupid phone trick", but it has the potential to be so much more. See, Frontier/Verizon have this voicemail system they inherited from their GTE purchases made by a company called Glenayre. It has the Verizon voice on it, and has a very frequently provisioned option called personal receptionist. I've probably covered this in another thread, but if I haven't, basically, personal receptionist allows you to press 0 at someone's voicemail greeting, and be forwarded to whatever number they programmed in. As you can imagine, the phone lines the voicemail system sits on are really good at toll restricting. In fact, they lean on the switch to do this entirely; the number can be almost anything you want, so long as the first digit doesn't start with a zero or a one. Anyway, there's a lot of unique circumstances you'll get on different switch types (just DMS-100/GTD-5/5ESS; for some reason, I don't think they bothered putting these on any DMS-10s or DCOs), but it's absolutely great for nerding out, since it lets you originate calls directly from whatever switch you're calling, and if you have an account, it's good on any voicemail system in the entire region. The VMSes are configured to run on POTS lines on DMS-100s (other switches use DS1s with inband signaling), so the bug where you can prevent someone else from flashing applies to this exact situation. That's a story for another time, though. So enter California, where we have a dialing plan that's quite frankly, really stupid. If you're in a seven digit area, toll calls in your area code are still seven digits. But if you're in a ten digit dialing area, you dial 1 plus your area code for local calls. So yes, that means if you're sitting on an area code border, your switch could have seven digit toll calling, and eleven digit local calls. Makes total sense, right? This opens up a unique opportunity: the voicemail system by default will put a 1 in front of your phone number when you go to transfer. So if you dial 710-anything, it connects! With the possible exception of Illinois, none of the other ex-GTE states do this. For some reason, this _only_ works on GTD-5s too. Believe me, I'd love to know why, but I have absolutely no idea. Personal receptionist via the GTD-5 does let a lot of other strange things through though, like ANAC. Maybe the way they set it up, it's not capable of being as restrictive as the other switches.
  15. Sure! Here's the most obvious thing you can do; http://thoughtphreaker.omghax.ca/audio/anac_holdup.wav . If you know the number for ANAC, you can flash right as it's about to hang up, and if you come back at just the right time, it'll just ignore the trunk when it tries to go on-hook. If you want to try your hand at other things, or just don't know the number for ANAC (no worries, Windstream is fairly good at hiding stuff), it doesn't stop there. Sadly though, it doesn't - at least not to the best of my knowledge, apply to things with common channel signaling, like q.931 or SS7. But yeah, let's start with something simple and common: POTS. It's a little simpler here; if you flash over, the other person can't! I wrote in a big post about this a few years ago; http://www.binrev.com/forums/index.php?/topic/46235-getting-to-the-bottom-of-a-dms-bug/ The most obvious question is if the switch still stops you from flashing when the other person hangs up, can you transfer to something that keeps you restricted like that? Better yet, without even heading down there, is there anything I can call that'll still keep that flashing restriction on? I think this is the result of some sort of resource restriction. The switch was probably designed with the idea that you'd never need to put more than one DTMF receiver on a call. If flashing was implemented in some way that never completely disconnects you from your original phone call, it could be impossible to get a DTMF receiver allocated to the person on the other end, so since it can't do that, it just ignores you. With that in mind, though... A. For whatever it's worth, things that need a digit receiver to work, like the integrated selective call forwarding IVR, won't let you flash, let alone let you use it on three-way. Though since on-hook calls won't let you flash either, that could be for other reasons. B. That still doesn't explain why call waiting doesn't work. C. If that's true, not letting the other person flash after you hang up was probably a stupid decision. So obviously, the most effective use of this is to trip up something that needs to flash, like a centrex auto-attendant if you happen to have something like that on the same switch. The voicemail systems on a lot of ex-GTE switches also flash for transfers. But if you happen to live near any sort of power plant or anything, a lot of those places like to use ancient E&M trunks that, like the ANAC, use inband signaling and are probably wink-start if they exist. Someday I really want to figure out if they can be screwed with in a similar way. Anyway, sorry for the tangent. That bug always gets me asking nature-of-the-universe-y sort of questions. So - next thing! This is something I've actually been exploring a little more recently, because it happens in my neck of the woods a lot. There's some DMSes that'll reset you back to dialtone in pretty much any circumstance. There's only two I know that do that; the switch that serves the Houston/Bush Intercontinental Airport, and the one that serves Washington/Dulles International if I remember right; the last time I took a flight out of there was 2008. But anyway, there's certain SS7 cause codes that do that on a TON of DMSes. The most reliable numbers I've found that push that sort of thing back are 866-202-9985, or 800-WRI-GLEY (call it and choose any option that'll disconnect you; 5 will do this whenever the call center closes). The success rate for this depends on the switch. On some, it happens almost every time. Some, it's more like half or a third of the time. And others, well, never. But whenever it does, it can be your best friend against some piece of line restricting equipment - there's no battery drop or anything to signal that this is happening, other than a sudden increase in sidetone for a second. Some day, I want to find/make something that lets you end a call with any SS7 cause code you feel like to expose these sort of quirks. Did you try putting a CAC in front of it? Being able to dial 0xx traffic without one in front of it is a leprechaun level of rare. Sounds normal to me. Were you trying to call it on three-way by any chance? That'll change up the ring, among other things, quite significantly; http://thoughtphreaker.omghax.ca/audio/dms_different_tones.flac There's probably some regional bugs too. One thing I figured out by accident is on any Pacific - and possibly Nevada Bell DMS-100, if you dial * as the last three digits of a phone number (excluding a CAC; it has to be a destination) will make it suddenly stop in the middle of a partial dial recording and go to reorder. Or sometimes, it won't even get that far; if it stops in the middle of the SIT generation, you'll just hit dead silence. This isn't necessarily a DMS-100 thing - actually, it's much more of a EWSD thing, but some DMS-100s will route you to the local operator when you dial 101-0110-0. I think local traffic can be originated on that CAC too. In the way of features, there's a couple very nice ones to be on the lookout for; the first one is pretty self explanitory - when you scan DMS-100s, you'll semi-frequently find dialtones that just come out of nowhere. These are generally being done directly in the switch via software. It looks like you've found one already, actually. The dialplans on these are anything but usual, so if they don't work, be sure to try prefix digits and whatnot. For example, try pressing nine. If it doesn't give you dialtone, press *, and at the new dialtone, try 8, 7, etcetera. The next one is a little less obvious, but it's what we use to conf every night; the ringout bridge. I think it's a Centrex-specific feature, but sometimes you find it in non-centrex areas, like test ranges. Basically, it rings with normal DMS-100 ring; there's no way to distinguish it from any other DMS number that doesn't pick up. Then, when another person comes on, it'll go offhook, bridge you together, and use another ringback tone (from a different source, oddly enough) to let you know someone has joined. The limit on these is in software, but I think you can have up to 32 people in there. Another quirk you'll occasionally find is the EDRAM announcements on the switch will occasionally play really briefly, stop, ring, and then play from the beginning. I dunno why, but they just do. This post is sorta blowing out of control in size, but I'll edit it if I can think of anything else. In the meantime, one thing you might want to try is a CAC + #; so like, 101-0555# to get a dialtone from a toll switch. If you know your own CAC, that's probably the best use of it, since most carriers are reluctant to give you one unless you're subscribed to them. It looks like you might have the right circumstances to get a dialtone from 0288#. Try dialing some toll-free numbers on it.