US West Lab Switches

[ThoughtPhreaker 174]

So after some consideration, I thought here would be a good place to post some info on some US West integration lab switches. There's no real potential for fraud given the circumstances, and plenty for good fun. These are, as the name would suggest, isolated almost entirely from the PSTN. 303-707-9122 and 9123 are the access numbers. 9122 is a DMS-100, the latter a 5ESS.

 

So, well, where to start with these things? As you probably expect, the dialplan is sort of make it up as you go along. There's some common ground between the two, but the differences are quite easy to rack up. So, well, listing this stuff seems like as good a way as any to present it. By the way, the 5ESS has a more digit-by-digit translation style, so it can be easier to find stuff through, but it's harder to tell where a call is going. The DMS-100 makes a soft tick on inter-office calls and sounds louder on intra-office stuff.

 

DMS-100 things:

1-800-555-1212 goes to a cryptic IVR asking you for a destination number

Some CACs go to a Sonus stock recording (no doubt a lab Sonus), others just go to reorder

720-993 (lab DMS-10; -1000 is remote call forward dialtone) is available

Some CLASS features like *67, *82 available.

*69 works occasionally. The first time I tried it, it told me 720-995-3037 called, the second it just turned it's nose up.

303-444-4444 gets wrbly live rep of some kind

 

5ESS things:

Some CLASS features like *60, *63, etc available.

011-anything rings out to a Qwest UM VMB

Generic, blanket numbers that ring out to the Qwest UM VMB do it via some other switch; the DMS-100 does it on it's own

Generic, blanket numbers going to the Qwest UM VMB do not allow you to enter another account number, unlike the DMS

303-444-4444 gets ACB recording

602-379-9999 rings out via 5ESS to some other UM VMB, allows entering in whatever account you want. You'll notice quite quickly that it doesn't have any UM VMBs in public service.

406-958-xxxx goes to Sonus

 

Other stuff:

303-994-00xx go to Qwest update center (*78) IVR with weird context

720 and 303-99x, 98x seem to be where the most interesting stuff is.

 

720-995:

0399 - NIS via lab 5ESS

1000 - lab DMS-100 ringout? Via lab 5ESS, gets NIS

1001 - NIS via lab 5ESS

2999 - lab DMS-100 ringout

3000 - Qwest busy line doohickey

3001 - Ringout to Reorder

3002 - Same as 3001

3003 - Same as 3001

3004-3006 - Reorder

3007 - Same as 3001

3008 - Reorder

3009 - Ringout

3010 - Ringout

3011 - Busy signal via ?

3012 - NIS via lab 5ESS

3013 - NIS via lab 5ESS

3014 - NIS via lab 5ESS

3015 - NIS via lab 5ESS

3016 - NIS via lab 5ESS

3017 - Ringout

3018 - Ringout

3019 - Ringout

3020 - Ringout to Embarq Meatwitch VMB

3021 - Ringout

3022 - Ringout

3023 - Ringout

3024 - Ringout

3025 - Ringout

3026 - Ringout

3027 - Ringout

3028 - Ringout

3029 - Ringout

3030 - NIS via lab 5ESS

3031 - NIS via lab 5ESS

3032 - NIS via lab 5ESS

3033 - Ringout

3034 - Ringout to UM VMB

3035 - Ringout to Meatwitch VMB

3036 - Ringout to Meatwitch VMB

3037 - Ringout to Meatwitch VMB w/greeting

3038 - Ringout to Meatwitch VMS, cannot send message

3039 - Ringout to UM VMB

3040 - Ringout to Meatwitch VMB, lab VMB for 720-995-3040, 303-396-9346

3041 - Ringout to 5ESS NIS rec

3042 - Ringout to Meatwitch VMS

3043 - NIS via lab 5ESS

3044 - NIS via lab 5ESS

3045 - NIS via lab 5ESS

3046 - Ringout to NIS via lab 5ESS

3047 - Ringout to NIS via lab 5ESS

3048 - Ringout to NIS via lab 5ESS

3049 - Reorder via DMS

3050 - Ringout

3051 - Ringout

3052 - Ringout

3053-3099 - NIS via lab 5ESS

3100 - NIS via lab 5ESS

3999 - NIS via lab 5ESS

4000 - Busy via ?

4100 - Ringout to Meatwitch VMS

5000 - NIS via lab 5ESS

 

Other 5ESS fake toll prefixes:

206-358-?

541-245-?

928-xxx-xxxx?

612-374-?

575-606-?

 

As for calling these things, there's a few things that you should probably know. If you want to make multiple calls on the same call, press ##. The phone patch will beep twice. Press ** in reasonably rapid succession and it'll get you a new dialtone. Sometimes when you press * normally, it'll do this annoying thing where it doesn't pass the DTMF to the switch, but briefly increases the volume level. If you want to pass a * when it does this, wait for the volume level to return to normal before pressing * again. On regular calls, *# can be used to flash. Much like any other, the 5ESS will consider a flash on any sort of local intercept or reorder a request for new dialtone.

 

Have fun! Post if you find anything cool . Or for that matter, if you have any questions. Most of these notes were made without a big audience in mind, so some of the terms (UM, for example is Unified Messaging. The Centurylink platform in ex-US West areas is an AT&T Labs Unified Messaging thingie if I understand correctly) aren't especially obvious.

Edited August 10, 2017 by ThoughtPhreaker

[dmine45 21]

That's a cool find. Thanks for sharing. I'll have to explore these soon.

 

 

[gewt 4]

Oh that's fun

 

Dial 1-800-555-1212 from the 5E and you get the "Integration test lab" voicemail box

[Ru1722 5]

On the DMS-100, I dialed 1800-444-4444 and it gave me a dialtone. I tried dialing an outbound number and it gave me reorder. I tried an inbound number to the 5ESS and it connected me to the NIS 5ESS message. I also tried dialing 1-800-437-7950 and it gave me the same results. It seems like those two numbers are some form of portal into the 5ESS. I tried the same thing from the 5ESS and it didn't work. 

[ThoughtPhreaker 174]

On the DMS-100, I dialed 1800-444-4444 and it gave me a dialtone.

 

From the sound of it, I'm pretty sure that 800 number is sending an SS7 cause code that resets the DMS-100 line back to dialtone. There's a real number (866-202-9985) that'll do this to a lot of the DMS-100s in my area. I like the idea of looking for 800 numbers like that, though. For whatever it's worth, 1-800-333-3333 is a local ringout of some kind.

 

 

[ThoughtPhreaker 174]

So, couple things:

 

Much like the US West switches in public service, 611 seems to wait for more digits. I have no idea what it does in or out of a lab environment, but on the lab DMS, it'll wait for three more digits (excluding 1/0; those go straight to reorder). On the 5ESS, it waits for seven.

 

Also, on the DMS, 1-720 seems to go to different places than just 720; 720-993 for example terminates to the Sonus with a 1 first for some reason. Also, on exchanges in that area code that won't complete for some reason, it'll wait for four digits as well instead of the usual three.

 

Hopefully, this'll wind up being a good way to teach translation logic on these two switches. There's a lot I want to figure out about how they anticipate digits.

Edited August 18, 2017 by ThoughtPhreaker

[Ru1722 5]

On 8/18/2017 at 5:49 AM, ThoughtPhreaker said:

 

 

 

From the sound of it, I'm pretty sure that 800 number is sending an SS7 cause code that resets the DMS-100 line back to dialtone. There's a real number (866-202-9985) that'll do this to a lot of the DMS-100s in my area. I like the idea of looking for 800 numbers like that, though. For whatever it's worth, 1-800-333-3333 is a local ringout of some kind.

 

 

That makes sense, for this switch do you think it could be due to an unsuccessful database query?

[ThoughtPhreaker 174]

Maybe. But so many numbers in there route without an SMS-800 database query. I think as far as 800 numbers are concerned, they just gave it some hacked up local translations. Notice how so many numbers only work on one of the two switches.

[Ru1722 5]

3 hours ago, ThoughtPhreaker said:

Maybe. But so many numbers in there route without an SMS-800 database query. I think as far as 800 numbers are concerned, they just gave it some hacked up local translations. Notice how so many numbers only work on one of the two switches.

Makes sense, it's a lab switch, it wasn't meant to be too accessible...

[Ru1722 5]

So I know it's been a couple of years since this was posted, but they're still up. I was messing around on the 5ESS today and I found a valid area code and prefix. I started scanning (602)379 and so far this is what I got:

9999 = Ringout

9998 to 9970 is the NIS message.

 

So far that's all I scanned. I'll be sure to post more of what I find once I get some more scanning done!