Mr. Spock

What can I do (phreaking-wise) on a 1AESS Switch?

32 posts in this topic

PS: if anyone has a recording of a fully digital switch I would like to compare recordings

This is recorded off my 5ESS line in Clark County WA (ORCHWA01DS0). Recording location is about 3-4 miles north of the CO. The first call goes to the local miliwatt on VANCWA01DS0 (360 6961000) which I hang up on after a period. The next call goes to the Pearson Airfield ASOS on that same CO (360 6961280), I then let the trunk reset and my CO eventually dumps me to Pat Fleet IYLMC then the squawker. The final call is to the AT&T miliwatt on 095T (1010288 1 206 959 1000), which, like 6961000, stays on the line indefinitely until you hang up. The background "hiss" when on hook is spillover from Centurycrap's fantastic new VDSL2 system that I've had more problems with than the previous ADSL, because the data signal is wide enough that some of it falls outside the line filter's effective range and gets passed through the line.

I apologize for using Vorbis, it was the only codec I have that could keep the file at a manageable size and still sound okay. If mistman is lurking on this thread I hope he geta around to paying his META-ARPA access bill on SDF soon, then I can upload the bigger FLAC version and not have to worry as much about disk usage and throughput quotas.

http://mistman.pdp10.org/pub/users/streethawk/5ess.zip

0

Share this post


Link to post
Share on other sites

I couldn't hear any crosstalk in that recording.  In the case of the 1AESS, the crosstalk we're looking for is coming from somewhere in the switching matrix, not your neighborhood cable.  Thus, even though your line is in a residential area, that shouldn't effect your chances of hearing crosstalk.  However, I don't think all 1A machines had this characteristic.  It may even be certain lines on a given 1A have this while others don't.  I'm not sure if it was because of the CDPR or something else.  You might be able to hear crosstalk on your neighborhood cable, but only when the line is idle, and that's something that applies to all analog lines served by digital switches.

 

Another thing I seem to recall is that some 1A machines put multiple people on ringback tones, right?  If you know a number in your 1A that rings for a long time, you could dial it up, preferably during a busy hour, and see if you hear someone come on.  Keep in mind that if this happens on your switch, you may only be able to hear people calling from your switch.  That's because many carriers block audio before the call answers.  As such, since the call has not answered while the line is ringing, you wouldn't be able to hear me calling from another state over AT&T Long Distance because they don't let ME transmit audio until the line answers.  Calling from inside the 1AESS, there is no such restriction AFAIK.  It's certainly possible that intra-LATA calls may pass audio before supervision.  So, somebody calling from a nearby switch is being routed over a local tandem, and I'd say it's not uncommon for local tandems to pass audio before supervision.

 

About hearing some digital switches, I can post some stuff up soon.  You could listen to some recordings here in the meantime: https://web.archive.org/web/20071019235219/http://www.stromcarlson.com/audio/

 

You may also want to look for some test codes on your switch.  Try 958-1114, 958-1122, 959-1114, 959-1122 to get started.  Those might give you the number ringback.  You could also look for the ringback code.  That lets you test the touch tones to see if the frequencies are on or off pitch, and it also lets you ring your phone back.  Some part of the code for ringback is part of your telephone number.  You could try 959-your last 4 digits.  Test codes also tend to appear in the 11X range.  For example, in my area, most switches have ringback on 113-last 4 digits.  The old ANAC list on Wikipedia says 970-1234 is the ANAC for 817.  Although that list is quite old, it's worth a shot.

 

I'd wager that the number readback machine in your office is quite old and may sound interesting.  If you find it, I'd love to hear what it sounds like.  Just make sure you clip out some digits of your number, but try to leave the sounds right before and right afterthe machine comes on and disconnects intact.

 

I know locally to me many test numbers / recordings are within the nxx-99xx range

0

Share this post


Link to post
Share on other sites

 

PS: if anyone has a recording of a fully digital switch I would like to compare recordings

This is recorded off my 5ESS line in Clark County WA (ORCHWA01DS0). Recording location is about 3-4 miles north of the CO. The first call goes to the local miliwatt on VANCWA01DS0 (360 6961000) which I hang up on after a period. The next call goes to the Pearson Airfield ASOS on that same CO (360 6961280), I then let the trunk reset and my CO eventually dumps me to Pat Fleet IYLMC then the squawker. The final call is to the AT&T miliwatt on 095T (1010288 1 206 959 1000), which, like 6961000, stays on the line indefinitely until you hang up. The background "hiss" when on hook is spillover from Centurycrap's fantastic new VDSL2 system that I've had more problems with than the previous ADSL, because the data signal is wide enough that some of it falls outside the line filter's effective range and gets passed through the line.

I apologize for using Vorbis, it was the only codec I have that could keep the file at a manageable size and still sound okay. If mistman is lurking on this thread I hope he geta around to paying his META-ARPA access bill on SDF soon, then I can upload the bigger FLAC version and not have to worry as much about disk usage and throughput quotas.

http://mistman.pdp10.org/pub/users/streethawk/5ess.zip

 

 

You could probably reduce the bitrate pretty sharply by using a lower sample rate. I know that sometimes the DACs in line cards can make interesting artifacts above the usual 4 khz of audio bandwidth you get in a phone call (especially when you record something loud like http://thoughtphreaker.omghax.ca/audio/845-359-9927.flac ), and on top of that, the annoying DSL hiss doesn't always roll off well, but even a sample rate of something like 32 khz will help. I did this with some pretty crappy headphones, so it might be genuinely horrible, but lemme know how this sounds;

 

http://thoughtphreaker.omghax.ca/5ess_16k.ogg

 

Do you happen to have one of those Raychem DSL filters that sits in your TNI? Occasionally, the Qwest techs will install them, and they're easily some of the best DSL filters out there, quality-wise.

 

In any case, it sounds like you're on one of those weird, newer line cards they occasionally use - I think for FTTC. Nice! Under the right conditions they sound really, really good. http://thoughtphreaker.omghax.ca/audio/410844_420.flac

 

PS: if anyone has a recording of a fully digital switch I would like to compare recordings

 

It's not quite the same, but if you want to hear a digital switch completing a call up close, that 0725 trick should work.

 

As such, since the call has not answered while the line is ringing, you wouldn't be able to hear me calling from another state over AT&T Long Distance because they don't let ME transmit audio until the line answers.

 

AT&T is weird. If you're calling an area where the last switch before it hits the access tandem is a DMS-250 or 5ESS, you should be able to pass audio before supervision, and stay on as long as you want. My guess is the terminating 4ESS is supposed to impose both, but if they're only connecting to trunks to other toll tandems, they won't bother. For example, 360-225-0005 should forward to 101-0288-0 and not supe. Since this is OSPS though, just keep in mind if you're casual dialing that it'll supe if you get an operator or call something that goes off hook.

0

Share this post


Link to post
Share on other sites

Do you happen to have one of those Raychem DSL filters that sits in your TNI? Occasionally, the Qwest techs will install them, and they're easily some of the best DSL filters out there, quality-wise.

My TNI is a little knot of wires under a little vinyl boot stamped "BELL SYSTEM" (the old style). Some of my neighbors have the newer style modular TNI (the big gray box) but I don't. I do have some 2WIRE in-line filters and that's really all that sits between my line and the junction box in the backyard, in the crawl space is some screw terminals that go between the demarc and the extensions.

I actually took the liberty of replacing the original terminal block with a 12-position barrier terminal blocks (6 for tip the other 6 for ring), It is, though, a lot nicer than the pile-up of spade connectors that were connected to the house's demarc block.

Telephone -> DSL filter -> terminal block -> demarc -> vinyl Bell System thingy -> junction box -> cable to CO -> PSTN

In any case, it sounds like you're on one of those weird, newer line cards they occasionally use - I think for FTTC. Nice! Under the right conditions they sound really, really good.

They did put me on a new line card last November just before they sent me the new VDSL2 box, but as far as I know I'm not on FTC yet, since this area is still close enough to the CO to not need one. This may change once they put gigabit (yeah, right) DSL in some day. If you recall mistman's old recording of the crossbar ring, the on-hook line noise before and after was how my line also sounded-- if I shut off the VDSL box, this card is very quiet when on hook and local cable noise is more audible.

For some weird reason if I am using an extension when recording, the DSL noise is audible on the inter box when the extension is off hook. The audio I posted was recorded with the 2500 that's connected to the inter box.

0

Share this post


Link to post
Share on other sites
AT&T is weird. If you're calling an area where the last switch before it hits the access tandem is a DMS-250 or 5ESS, you should be able to pass audio before supervision, and stay on as long as you want. My guess is the terminating 4ESS is supposed to impose both, but if they're only connecting to trunks to other toll tandems, they won't bother. For example, 360-225-0005 should forward to 101-0288-0 and not supe. Since this is OSPS though, just keep in mind if you're casual dialing that it'll supe if you get an operator or call something that goes off hook.

360-225-0005 was an interesting number since I cant get to any 10 10 codes, thanks!

 

360-225-0005 Will not forward to any non AT&T 800 numbers I've tried, but it did forward to 1800callatt and another AT&T customer service number I was allowed to get through to which reads back your number (unfortunately forgot which one exactly..) read back 360-225-0005 as my number..

I think that any AT&T numbers you actually can forward to from 360-225 end up seeing you as being 360-225, but any time you end up connecting with any number outside of AT&T it's an ANI failure.

 

 

When I managed to get audio from the ANAC at 570-585-0086, which apparently doesn't reject collect calls (one of a few wierd cases Ive found that don't reject collect calls), I got a "number identification error". (included audio)

 

Since 800callatt one of the few sparse numbers I was able to reach from 360-225, I got an 800callatt collect operator to put me through to 800-444-4444 where it read back "904" as my number. (included audio)

 

What a trip! great number! first time Ive gotten to play with a 1010 code in any capacity.

 

 

 

P.S: not really sure if going through 360-225 helped in the case of callatt ani failing 800444444 outside of concealing my original phone number a layer better.. I could be wrong though, since an ANI failure or at least a change of CPN in between couldn't hurt...

ANI_Fails_360_225_0005.zip

Edited by phonetrovert
0

Share this post


Link to post
Share on other sites

Glad you like it :) . You can also originate UIFN traffic from there too. Like, 011-800-2327-4269 will get you a PBX in Malaysia. Also, if you say Español, it'll route you to the Dallas OSPS. Nothing special, it's still just a collect call IVR, but anything you call from it will be originated with an ANI fail.

0

Share this post


Link to post
Share on other sites

Glad you like it :) . You can also originate UIFN traffic from there too. Like, 011-800-2327-4269 will get you a PBX in Malaysia. Also, if you say Español, it'll route you to the Dallas OSPS. Nothing special, it's still just a collect call IVR, but anything you call from it will be originated with an ANI fail.

 

That's awesome! Love the NES hold music! Couldnt seem to find any other UIFN that I could get to work (I think the number you posted was the only one I saw which allows origination from US/Canada). Are there any others out there? The reason I havent found too many is alot of companies which offer UIFN to europe, asia and the middle east seem to just have regular toll free numbers for US/Canada.

 

[Edit]

 

I found 800 4445 8667 which is a voicemail box from someone sounding north american. So far the only other one I've found that seems to work. press * to "enter your mailbox number" or # to leave a message.

 

I just found 800 8246 8866 which is "sigma"(?) healthcare international. I spoke to a very nice woman in Malaysia who thanked me for my useless call. Always fun to hear that ring tone instead of an error on an AT&T long distance tandem. Also for the record, she verified that no phone number was being passed.

 

 

 

8000SINDONE(80007463663) seems to be an error message of some sort in Italian!

 

80008189818 is a Phillipino credit card company (Tnb, or "t and b"(sp?))

 

800 9999 1581 is some company in Thailand.

 

 

+800-7722-4342* Pan Pacific Hotels and Resorts, supposedly in japan, plays some hold music and goes to reorder

+800-2255-7795* is another number listed under Pan Pacific, with the same greeting, but different hold music, not disconnecting.. I got in touch with someone, this goes to a call center in the Phillipines.

 

8004WIFILAN is another phillipine (from the sounds of it) call center for aruba networks...

 

http://www.itu.int/online/uifn/number_search.shseems like a nice place to find these numbers.

Edited by phonetrovert
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now