Ru1722

518-234-9XXX numbers

19 posts in this topic

Hello,

 

I am in the process of scanning 518-234-9XXX. I though I would share some interesting recordings I found. Here they are

518-234-9994 - Milliwatt test 

518-234-9960  - High end loop line

518-234-9811 - Cannot be completed, 003T (Might not work anymore)

518-234-9642 - Interesting disconnected recording

518-234-9624 - Brief 2223 Hz burst, then hangs up

-------------------------------------------------------------------------------------------

That's all I found so far, I'll post other numbers if I find anymore.

 

-Ru1722

1

Share this post


Link to post
Share on other sites

I tried giving 518-234-9624 a 300 baud modem handshake on one call and DTMF on another, but it didn't seem to really care for either.

 

As for 9960, keep in mind DMS-10s have an implementation of loops in software (one of the few I've seen, actually. The vast majority of loops I've found are on them) that gives you reorder on the high end by default when nobody is on. In this case, the reorder distinguishes itself by actually being played by the DMS-10; usually when you hear a reorder, the switch you're calling from is generating it based on an SS7 cause code the one you're calling pushes back. The reorder thing is pretty common, but I've also seen one send back a busy cause code in that case. There's a loop on the scan I put below if you want to get a hands on experience with one.

 

Finally, 9811 is sending a cause code back. AT&T's 4ESS tandems have a habit of playing back their own recording instead of passing the message on, so that was probably the one you were getting. If you're homing directly on a 4E for toll calls on their network, you'll probably get the same recording every time you call it. If not though, you'll get a bunch of different tandems during the day. To figure out how your calls are routing, give 800-466-3728 a call. If you get a message from a 4E (usually xxxT, or occasionally just a reorder when the recording stops working), well, that's what's you're homing on.

 

Anyway, nice! One thing you've got to keep in mind though, are the Bell Atlantic DMS-10s are sort of a mixed bunch. On some, most things sit around in 99xx. Though for some reason, there's others (like this one) where they stick things elsewhere. For all I know, they've lumped everything together with all the other super secret CO stuff elsewhere.

 

Here's one of the more successful 99xx DMS-10 ranges:

 

716-257

9999 - Ringout
9997 - Ringout
9992 - Ringout
9991 - Switchroom phone? # not accepting calls w/privacy bits
9990 - Ringout
9984 - Ringout
9983 - Ringout
9982 - Ringout
9981 - Ringout
9980 - No supe, faint noise
9972 - Reorder via distant end
9970 - Busy signal via distand end
9967 - Coin deposit rec
9966 - Ringout
9965 - Busy via SS7
9960 - Pat Fleet CBCAD rec
9959 - Weird noises. Broken trunk?
9958 - Cornbreath CBCAD rec
9957 - Cornbreath dial 1 first rec
9956 - 100-type test
9955 - Ringout. Picks up when 9954 is offhook?
9954 - Thingie, picks up silently
9953 - Permanent signal rec
9952 - Weird noises. Broken trunk?
9951 - Switch tech CBCAD rec
9949 - Ringout
9948 - Ringout
9947 - Ringout
9946 - Ringout
9945 - Ringout
9944 - Ringout
9943 - Ringout
9942 - Ringout
9941 - Ringout
9939 - Forward to 5ESS? 5E ring + 15A CAC required rec
9936 - Line with nasty hum, 300 baud modem?
9935 - Ringout
9934 - Ringout
9933 - Ringout
9932 - Ringout
9931 - Ringout
9930 - Ringout
9921 - Ringout
9920 - Ringout
9917 - Broken trunk?
9916 - Reorder via distant end
9915 - CBCAD via SS7
9914 - Broken trunk?
9912 - Reorder via distant end\
9911 - 102-type test                / Loop! Mutes conversation after ~1 minute, though
9910 - 102-type test
9902 - Reorder via distant end
9901 - Reorder via distant end

1

Share this post


Link to post
Share on other sites

ThoughtPhreaker, thank you for that response! I'm somewhat new to a lot of this, so I am still learning. And thank you for all the information! I've written down all of the numbers I have dialed so far, and I haven't been able to use any of the 99xx numbers and they all are written down as "Not in service" which is the recording I got back.

 

Also, I dialed 800-466-7328 and I'm getting "6129L" back. I don't think I am going through a 4ESS tandem, am I correct?

 

And I might've mistaken 9960 as a milliwatt test signal that loops. I though it was a high end loop line because I heard an audio recording of one that sounds identical, am I right to say it is a high end loop line? It does generate 1004 Hz like a milliwatt, but I'm not quite sure what to make of it now.

 

I apologize if I am sounding stupid right now, I'm new to a lot of this! Again, thank you for all the information! It's really helping me out, and I appreciate it!

1

Share this post


Link to post
Share on other sites

Forgot to post this work in progress

800 NXX 1337 9/7/16
203 - Skytel number (requires pin)
204 - Skytel number (requires pin)
205 - Skytel number (requires pin)
206 - Skytel number (requires pin)
207 - Skytel number (requires pin)
208 - Interesting non working number - “You have reached a non working number. Announcement 14 Switch 22-11”
226 - Quiet whistley noise and a beep
230 - Doctor’s answering service
236 - Non working Verizon Wireless number
240 - Fax?
245 - Fax?

1

Share this post


Link to post
Share on other sites

Thanks for the numbers scobbydooble, I'll save those numbers! I'll help scan if you want me to, just let me know.

0

Share this post


Link to post
Share on other sites
On 9/28/2016 at 5:31 PM, Ru1722 said:

 

Also, I dialed 800-466-7328 and I'm getting "6129L" back. I don't think I am going through a 4ESS tandem, am I correct

 

Those must be one of those 5ESS tandems that AT&T's been using for a while now. Dialing that number, I get "713-9L" back.

0

Share this post


Link to post
Share on other sites
Just now, ramsaso said:

Those must be one of those 5ESS tandems that AT&T's been using for a while now. Dialing that number, I get "713-9L" back.

Thank you, I'll have to look into it more!

0

Share this post


Link to post
Share on other sites

Those must be one of those 5ESS tandems that AT&T's been using for a while now.

 

Yup. There's some DMS-250s in there as well, but that particular one is a 5ESS. 800-877-0230 should give you one of the 4Es that 5E sends traffic to. If you do it during business hours on the weekday, your chances of getting more than one tandem are much higher.

 

And I might've mistaken 9960 as a milliwatt test signal that loops. I though it was a high end loop line because I heard an audio recording of one that sounds identical, am I right to say it is a high end loop line? It does generate 1004 Hz like a milliwatt, but I'm not quite sure what to make of it now.

 

What you get is different from one switch to the next, but loops do tend to answer with milliwatts. On a DMS-10, getting a distant reorder next to a milliwatt is the only good indication that I know of. On Redcom switches, you don't tend to have that sort of luck; 907-293-1108/1109. It takes a little trial and error to figure out which switches do what.

 

I apologize if I am sounding stupid right now, I'm new to a lot of this! Again, thank you for all the information! It's really helping me out, and I appreciate it!

 

All good, man! Glad to help - a lot of people don't even anticipate the possibility of a loop being in a range.

0

Share this post


Link to post
Share on other sites

Thank you for the help ThoughtPhreaker! I'm learning a lot from what you are saying! Also, can a DMS-10 switch also support 5ESS, or does it support 4ESS only?

0

Share this post


Link to post
Share on other sites

That depends on what you're referring to; if you're referring to the ISDN signaling flavors, I assume it'll work with both. The 4ESS and 5ESS are both phone switches though, and probably support pretty much the same interoffice trunk interfaces (analog 2-wire, 4-wire, DS1, DS3, ethernet) as the DMS-10. Though the 5ESS was made to work mostly in larger markets and the 4ESS was exclusively made to work as a tandem, so they might not support the same interoffice signaling types. For example, the 5ESS (and probably the 4E) can support an obscure signaling method called revertive pulsing. The only place this ever was used was in Crossbar 1 and Panel; electromechanical switches used almost exclusively in big cities. The DMS-10 being mostly a rural switch, it probably never got support for this.

1

Share this post


Link to post
Share on other sites

For example, the 5ESS (and probably the 4E) can support an obscure signaling method called revertive pulsing. The only place this ever was used was in Crossbar 1 and Panel



For sake of completeness, I think Doorbell also once briefly analyzed a step with registers that sent RP into a panel (or maybe 1-bar?) tandem. Don't remember what tape it was on but I think it's one of the newer ones. Maybe it was that "GTE owned... senderized... step... tandem?" (No, it wasn't but it sounds like something GTE or some hole in the wall independent [*cough* United *cough*] would have done.)

A really good question is do any ESS or DMS type machines still support (send/receive) PCI? I don't know how that ancient signaling system would even be used in the network today except maybe to communicate with some really really really old dinosaur PBX somewhere.

0

Share this post


Link to post
Share on other sites
10 hours ago, ThoughtPhreaker said:

That depends on what you're referring to; if you're referring to the ISDN signaling flavors, I assume it'll work with both. The 4ESS and 5ESS are both phone switches though, and probably support pretty much the same interoffice trunk interfaces (analog 2-wire, 4-wire, DS1, DS3, ethernet) as the DMS-10. Though the 5ESS was made to work mostly in larger markets and the 4ESS was exclusively made to work as a tandem, so they might not support the same interoffice signaling types. For example, the 5ESS (and probably the 4E) can support an obscure signaling method called revertive pulsing. The only place this ever was used was in Crossbar 1 and Panel; electromechanical switches used almost exclusively in big cities. The DMS-10 being mostly a rural switch, it probably never got support for this.

That makes sense now, thank you!

0

Share this post


Link to post
Share on other sites
On 10/2/2016 at 2:19 PM, scratchytcarrier said:

A really good question is do any ESS or DMS type machines still support (send/receive) PCI? I don't know how that ancient signaling system would even be used in the network today except maybe to communicate with some really really really old dinosaur PBX somewhere.

I'd be happy to poke around on this... If I can figure out how to send PCI (and RP for that matter) down my line...

0

Share this post


Link to post
Share on other sites

A really good question is do any ESS or DMS type machines still support (send/receive) PCI? I don't know how that ancient signaling system would even be used in the network today except maybe to communicate with some really really really old dinosaur PBX somewhere.

 

I don't think so, but you might be able to find a European switch that does something close enough that it'd work with PCI; the French apparently had this crazy signaling system called SOCOTEL that involved pushing DC voltage down the line.

1

Share this post


Link to post
Share on other sites

The entire French mechanical telephone network was pretty bizarre from what I understand.

Dootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdoot...

1

Share this post


Link to post
Share on other sites
22 hours ago, scratchytcarrier said:

The entire French mechanical telephone network was pretty bizarre from what I understand.

Dootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdootdoot...

 

Please tell me it still does this in some obscure part of the system...

0

Share this post


Link to post
Share on other sites

'd be happy to poke around on this... If I can figure out how to send PCI (and RP for that matter) down my line...



I've thought about this a bit. I don't think you can any more... you'd have to get a DC path into a trunk, which means being serviced via analog trunks. Maybe if your area is on copper T-carrier (not fiber) and has empty physical channels but I doubt it. You'd probably have to get physical access to the DMS.

I did come across a Doorbell tape where he manipulated an RP sender by sending various length bursts of vocal "baaaaaaap" down the line, activating the tone-pulse sender. But again sending RP now would mean DC trunk paths which probably don't exist in the greater PSTN any more, or are extremely rare.

The chances are probably higher of observing an ancient step or xbar PBX that still uses one system or the other internally.

There's another question. Did DMS ever support PCI or RP in the past? Betcha the software probably still supports dial outpulsing in some manner or other.

0

Share this post


Link to post
Share on other sites
3 hours ago, scratchytcarrier said:

There's another question. Did DMS ever support PCI or RP in the past? Betcha the software probably still supports dial outpulsing in some manner or other.

 

I want to say I saw that DMSes supported RP in some way, shape, or form. I'm trying to remember where, and if I can find it again, I'll post it.

0

Share this post


Link to post
Share on other sites

Me too! I think it was some post in a mailing list If I remember right, like the 5ESS, it needs revertive pulse trunk cards to do it. I guess if you had one that supported DC pulses, you could send the pulses over T-carrier. Never know - there's some channel banks that let you do coin collect/return.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now