=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-==-=-=-=-=-=-=-=-=-=-=-= Section C -- Telephony =-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

C-01. What is a Red Box?

When a coin is inserted into a payphone, the payphone emits a set of
tones to ACTS (Automated Coin Toll System).  Red boxes work by fooling
ACTS into believing you have actually put money into the phone.  The
red box simply plays the ACTS tones into the telephone microphone.
ACTS hears those tones, and allows you to place your call.  The actual
tones are:

Nickel:
35-160ms 1700hz & 2200hz tone burst, followed by 240ms of silence.

Dime:
Two 35-160ms 1700hz & 2200hz bursts, with a spacing of 20-110ms between
the bursts, followed by 165 ms of silence.

Quarter:
Five 1700hz & 2200hz bursts, with the first and last being 20-100ms in
length, and the second through fourth being 20-60ms in length.  The
spacing between the first and second bursts is 20-110ms, while the
spacing between the following bursts is 20-60ms. The tones are followed
by 60ms of silence.

Canada uses a variant of ACTSD called N-ACTS.  N-ACTS uses different
tones than ACTS.  In Canada, the tones to use are:

Nickel Signal      2200hz       0.060s on
Dime Signal        2200hz       0.060s on, 0.060s off, twice repeating
Quarter Signal     2200hz       33ms on, 33ms off, 5 times repeating


------------------------------------------------------------------------
---

C-02. How do I build a Red Box?

Red boxes are commonly manufactured from Radio Shack tone dialers,
Hallmark greeting cards, or made from scratch from readily available
electronic components.

To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open
the dialer and replace the crystal with a new one. The purpose of the
new crystal is to cause the * button on your tone dialer to create a
1700hz and 2200hz tone instead of the original 941hz and 1209hz
tones.  The exact value of the replacement crystal should be 6.466806 to
create a perfect 1700hz tone and 6.513698 to create a perfect 2200hz
tone.  A crystal close to those values will create a tone that easily
falls within the loose tolerances of ACTS. The most popular choice is
the 6.5536Mhz crystal, because it is the easiest to procure.  The old
crystal is the large shiny metal component labeled "3.579545Mhz."  When
you are finished replacing the crystal, program the P1 button with five
*'s.  That will simulate a quarter tone each time you press P1.

You can record the ACTS tones and play them back into the telephone.
This is what is done with the Hallmark greeting card.  Alternatively,
you can build your own circuit using any voice recording chip, such as
Radio Shack catalog number 276-1325.


------------------------------------------------------------------------
---

C-03. Where can I get a 6.5536Mhz crystal?

Your best bet is a local electronics store.  Radio Shack sells them, but
they are overpriced and the store must order them in.  This takes
approximately two weeks.  In addition, many Radio Shack employees do not
know that this can be done.

Or, you could order the crystal mail order.  This introduces Shipping
and Handling charges, which are usually much greater than the price of
the crystal.  It's best to get several people together to share the S&H
cost.  Or, buy five or six yourself and sell them later.  Some of the
places you can order crystals are:

Digi-Key
701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
(800)344-4539
Part Number:X415-ND    /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND

JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
(800)538-5000
Part Number: 6.5536MHZ

Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
(800)241-8742
Part Number: 10068625

Alltronics
2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057

Mouser
(800)346-6873
Part Number: 332-1066

Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b

Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: 1-800-824-3432
Part Number: CR6.5


------------------------------------------------------------------------
---

C-04. Which payphones will a Red Box work on?

Red Boxes will work on telco owned payphones, but not on COCOT's
(Customer Owned Coin Operated Telephones).

Red boxes work by fooling ACTS (Automated Coin Toll System) into
believing you have put money into the pay phone.  ACTS is the
telephone company software responsible for saying "Please deposit XX
cents" and listening for the coins being deposited.

COCOT's do not use ACTS.  On a COCOT, the pay phone itself is
responsible for determining what coins have been inserted.


------------------------------------------------------------------------
---

C-05. How do I make local calls with a Red Box?

Payphones do not use ACTS for local calls.  To use your red box for
local calls, you have to fool ACTS into getting involved in the call.

One way to do this, in some areas, is by dialing an Equal Access Code
before the number you are dialing.  For example, to use 10288 (an Equal
Access Code belonging to AT&T), dial 10288-xxx-xxxx.  This makes your
call a long distance call, and brings ACTS into the picture.  There are
quite a large number of Equal Access Codes available in most geographic
regions.

[Note from Dan Mellem: The access codes are now 1010xxx, so AT&T is
1010288+. H.]

In other areas, you can call Directory Assistance and ask for the
number of the person you are trying to reach.  The operator will give
you the number and then you will hear a message similar to "Your call
can be completed automatically for an additional 35 cents."  When this
happens, you can then use ACTS tones.

Another operator scam involves calling (800) long distance operators,
asking them to connect you, and then playing the ACTS tones.  This
will get ACTS involved, even on COCOT's!

I have heard that in some areas you can dial local calls as if they were
long distance.  For example, to dial 345-4587 to would dial
303-345-4587.  This does not work on payphones in my area.


------------------------------------------------------------------------
---

C-06. What is a Blue Box?

Blue boxes use a 2600hz tone to size control of telephone switches
that use in-band signalling.  The caller may then access special
switch functions, with the usual purpose of making free long distance
phone calls, using the tones provided by the Blue Box.


------------------------------------------------------------------------
---

C-07. Do Blue Boxes still work?

This FAQ answer is excerpted from a message posted to Usenet by
Marauder of the Legion of Doom:

 Somewhere along the line I have seen reference to something
 similar to "Because of ESS Blue boxing is impossible".  This is
 incorrect.  When I lived in Connecticut I was able to blue box
 under Step by Step, #1AESS, and DMS-100.  The reason is simple,
 even though I was initiating my call to an 800 number from a
 different exchange (Class 5 office, aka Central Office) in each
 case, when the 800 call was routed to the toll network it would
 route through the New Haven #5 Crossbar toll Tandem office.  It
 just so happens that the trunks between the class 5 (CO's) and
 the class 4 (toll office, in this case New Haven #5 Xbar),
 utilized in-band (MF) signalling, so regardless of what I
 dialed, as long as it was an Inter-Lata call, my call would
 route through this particular set of trunks, and I could Blue
 box until I was blue in the face.  The originating Central
 Offices switch (SXS/ESS/Etc..) had little effect on my ability
 to box at all.  While the advent of ESS (and other electronic
 switches) has made the blue boxers task a bit more difficult,
 ESS is not the reason most of you are unable to blue box.  The
 main culprit is the "forward audio mute" feature of CCIS (out of
 band signalling).  Unfortunately for the boxer 99% of the Toll
 Completion centers communicate using CCIS links, This spells
 disaster for the blue boxer since most of you must dial out of
 your local area to find trunks that utilize MF signalling, you
 inevitably cross a portion of the network that is CCIS equipped,
 you find an exchange that you blow 2600hz at, you are rewarded
 with a nice "winkstart", and no matter what MF tones you send at
 it, you meet with a re-order.  This is because as soon as you
 seized the trunk (your application of 2600hz), your Originating
 Toll Office sees this as a loss of supervision at the
 destination, and Mutes any further audio from being passed to
 the destination (ie: your waiting trunk!).  You meet with a
 reorder because the waiting trunk never "hears" any of the MF
 tones you are sending, and it times out.  So for the clever
 amongst you, you must somehow get yourself to the 1000's of
 trunks out there that still utilize MF signalling but
 bypass/disable the CCIS audio mute problem.  (Hint: Take a close
 look at WATS extenders).


------------------------------------------------------------------------
---

C-08. What is a Black Box?

A Black Box is a resistor (and often capacitor in parallel) placed in
series across your phone line to cause the phone company equipment to be
unable to detect that you have answered your telephone.  People who call
you will then not be billed for the telephone call.  Black boxes do not
work under ESS.


------------------------------------------------------------------------
---

C-09. What do all the colored boxes do?

Acrylic      Steal Three-Way-Calling, Call Waiting and programmable
      Call Forwarding on old 4-wire phone systems
Aqua         Drain the voltage of the FBI lock-in-trace/trap-trace
Beige        Lineman's hand set
Black        Allows the calling party to not be billed for the call
      placed
Blast        Phone microphone amplifier
Blotto       Supposedly shorts every phone out in the immediate area
Blue         Emulate a true operator by seizing a trunk with a 2600hz
      tone
Brown        Create a party line from 2 phone lines
Bud          Tap into your neighbors phone line
Chartreuse   Use the electricity from your phone line
Cheese       Connect two phones to create a diverter
Chrome       Manipulate Traffic Signals by Remote Control
Clear        A telephone pickup coil and a small amp used to make free
      calls on Fortress Phones
Color        Line activated telephone recorder
Copper       Cause crosstalk interference on an extender
Crimson      Hold button
Dark         Re-route outgoing or incoming calls to another phone
Dayglo       Connect to your neighbors phone line
Diverter     Re-route outgoing or incoming calls to another phone
DLOC         Create a party line from 2 phone lines
Gold         Dialout router
Green        Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity     Remotely activated phone tap
Jack         Touch-Tone key pad
Light        In-use light
Lunch        AM transmitter
Magenta      Connect a remote phone line to another remote phone line
Mauve        Phone tap without cutting into a line
Neon         External microphone
Noise        Create line noise
Olive        External ringer
Party        Create a party line from 2 phone lines
Pearl        Tone generator
Pink         Create a party line from 2 phone lines
Purple       Telephone hold button
Rainbow      Kill a trace by putting 120v into the phone line (joke)
Razz         Tap into your neighbors phone
Red          Make free phone calls from pay phones by generating
      quarter tones
Rock         Add music to your phone line
Scarlet      Cause a neighbors phone line to have poor reception
Silver       Create the DTMF tones for A, B, C and D
Static       Keep the voltage on a phone line high
Switch       Add hold, indicator lights, conferencing, etc..
Tan          Line activated telephone recorder
Tron         Reverse the phase of power to your house, causing your
      electric meter to run slower
TV Cable     "See" sound waves on your TV
Urine        Create a capacitative disturbance between the ring and
      tip wires in another's telephone headset
Violet       Keep a payphone from hanging up
White        Portable DTMF keypad
Yellow       Add an extension phone

Box schematics may be retrieved from these FTP sites:

ftp.netcom.com          /pub/br/bradleym
ftp.netcom.com          /pub/va/vandal
ftp.winternet.com       /users/nitehwk


------------------------------------------------------------------------
---

C-10. What is an ANAC number?

An ANAC (Automatic Number Announcement Circuit) number is a telephone
number that plays back the number of the telephone that called it.
ANAC numbers are convenient if you want to know the telephone number
of a pair of wires.


------------------------------------------------------------------------
---

C-11. What is the ANAC number for my area?

How to find your ANAC number:

Look up your NPA (Area Code) and try the number listed for it. If that
fails, try 1 plus the number listed for it.  If that fails, try the
common numbers like 311, 958 and 200-222-2222.  If you find the ANAC
number for your area, please let us know.

Note that many times the ANAC number will vary for different switches
in the same city.  The geographic naming on the list is NOT intended
to be an accurate reference for coverage patterns, it is for
convenience only.

Many companies operate 800 number services which will read back to you
the number from which you are calling.  Many of these require navigating
a series of menus to get the phone number you are looking for.  Please
use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC
numbers.

  (800)425-6256   VRS Billing Systems/Integretel (800)4BLOCKME
N (800)487-9240   Another line blocking service

A non-800 ANAC that works nationwide is 404-988-9664.  The one catch
with this number is that it must be dialed with the AT&T Carrier Access
Code 10732.  Use of this number does not appear to be billed.

Note: These geographic areas are for reference purposes only.  ANAC
numbers may vary from switch to switch within the same city.

  NPA  ANAC number      Approximate Geographic area
  ---  ---------------  ---------------------------------------------
  201  958              Hackensack/Jersey City/Newark/Paterson, NJ
  202  811              District of Columbia
  203  970              CT
  205  300-222-2222     Birmingham, AL
  205  300-555-5555     Many small towns in AL
  205  300-648-1111     Dora, AL
  205  300-765-4321     Bessemer, AL
  205  300-798-1111     Forestdale, AL
  205  300-833-3333     Birmingham
  205  557-2311         Birmingham, AL
  205  811              Pell City/Cropwell/Lincoln, AL
  205  841-1111         Tarrant, AL
  205  908-222-2222     Birmingham, AL
  206  411              WA (Not US West)
  207  200-222-2222     ME
  207  958              ME
  209  830-2121         Stockton, CA
  209  211-9779         Stockton, CA
  210  830              Brownsville/Laredo/San Antonio, TX
  210  951              Brownsville/Laredo/San Antonio, TX (GTE)
  212  958              Manhattan, NY
U 213  114              Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5
witches)
U 213  1223             Los Angeles, CA (GTE 1AESS and 5ESS switches)
  213  211-2345         Los Angeles, CA (English response)
  213  211-2346         Los Angeles, CA (DTMF response)
  213  760-2???         Los Angeles, CA (DMS switches)
  213  61056            Los Angeles, CA
  214  570              Dallas, TX
  214  790              Dallas, TX (GTE)
N 214  970              Dallas, TX (GTE)
U 214  970-222-2222     Dallas, TX (Southwestern Bell)
  214  970-x11-1111     Dallas, TX (Southwestern Bell)
  215  410-xxxx         Philadelphia, PA
  215  511              Philadelphia, PA
  215  958              Philadelphia, PA
  216  200-XXXX         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  216  331              Akron/Canton/Cleveland/Lorain/Youngstown, OH
  216  959-9892         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  217  200-xxx-xxxx     Champaign-Urbana/Springfield, IL
  219  550              Gary/Hammond/Michigan City/Southbend, IN
  219  559              Gary/Hammond/Michigan City/Southbend, IN
  301  2002006969       Hagerstown/Rockville, MD
  301  958-9968         Hagerstown/Rockville, MD
  303  958              Aspen/Boulder/Denver/Durango/Grand Junction
   /Steamboat Springs, CO
  305  200-555-1212     Ft. Lauderdale/Key West/Miami, FL
  305  200200200200200  Ft. Lauderdale/Key West/Miami, FL
  305  780-2411         Ft. Lauderdale/Key West/Miami, FL
  310  114              Long Beach, CA (On many GTE switches)
  310  1223             Long Beach, CA (Some 1AESS switches)
  310  211-2345         Long Beach, CA (English response)
  310  211-2346         Long Beach, CA (DTMF response)

[Note from Brian Jones: The new GTE ANAC for the Los Angeles area (310,
etc) is 958-1114 H.]

  312  200              Chicago, IL
  312  290              Chicago, IL
  312  1-200-8825       Chicago, IL (Last four change rapidly)
  312  1-200-555-1212   Chicago, IL
  313  200-200-2002     Ann Arbor/Dearborn/Detroit, MI
  313  200-222-2222     Ann Arbor/Dearborn/Detroit, MI
  313  200-xxx-xxxx     Ann Arbor/Dearborn/Detroit, MI
  313  200200200200200  Ann Arbor/Dearborn/Detroit, MI
N 313  311              Ann Arbor/Dearborn/Detroit, MI
N 313  958-1111         Ann Arbor/Dearborn/Detroit, MI (GTE)
  314  410-xxxx#        Columbia/Jefferson City/St.Louis, MO
  315  953              Syracuse/Utica, NY
  315  958              Syracuse/Utica, NY
  315  998              Syracuse/Utica, NY
  317  310-222-2222     Indianapolis/Kokomo, IN
  317  559-222-2222     Indianapolis/Kokomo, IN
  317  743-1218         Indianapolis/Kokomo, IN
  334  5572411          Montgomery, AL
  334 5572311           Montgomery, AL
  401  200-200-4444     RI
  401  222-2222         RI
  401  2002006969       RI
[401 possibly 118 according to forrest swope. H.]
  402  311              Lincoln, NE
  404  311              Atlanta, GA
  404  780-2311         Atlanta, GA
  404  940-xxx-xxxx     Atlanta, GA
  404  990              Atlanta, GA
  405  890-7777777      Enid/Oklahoma City, OK
  405  897              Enid/Oklahoma City, OK
  407  200-222-2222     Orlando/West Palm Beach, FL (Bell South)
  407  520-3111         Orlando/West Palm Beach, FL (United)
  408  300-xxx-xxxx     San Jose, CA
  408  760              San Jose, CA
  408  940              San Jose, CA
  409  951              Beaumont/Galveston, TX
  409  970-xxxx         Beaumont/Galveston, TX
  410  200-6969         Annapolis/Baltimore, MD
  410  200-200-6969     Annapolis/Baltimore, MD
  410  200-555-1212     Annapolis/Baltimore, MD
  410  811              Annapolis/Baltimore, MD
[410 possibly 118 according to forrest swope. H.]
  412  711-6633         Pittsburgh, PA
  412  711-4411         Pittsburgh, PA
  412  999-xxxx         Pittsburgh, PA
  413  958              Pittsfield/Springfield, MA
  413  200-555-5555     Pittsfield/Springfield, MA
  414  330-2234         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  415  200-555-1212     San Francisco, CA
  415  211-2111         San Francisco, CA
  415  2222             San Francisco, CA
  415  640              San Francisco, CA
  415  760-2878         San Francisco, CA
  415  7600-2222        San Francisco, CA
  419  311              Toledo, OH
  423  200-200-200      Chatanooga, Johnson City, Knoxville, TN
  501  511              AR
U 501  721-xxx-xxxx     AR
  502  2002222222       Frankfort/Louisville/Paducah/Shelbyville, KY
  502  997-555-1212     Frankfort/Louisville/Paducah/Shelbyville, KY
  503  611              Portland, OR
  503  999              Portland, OR (GTE)
  504  99882233         Baton Rouge/New Orleans, LA
  504  201-269-1111     Baton Rouge/New Orleans, LA
  504  998              Baton Rouge/New Orleans, LA
  504  99851-0000000000 Baton Rouge/New Orleans, LA
  508  958              Fall River/New Bedford/Worchester, MA
  508  200-222-1234     Fall River/New Bedford/Worchester, MA
  508  200-222-2222     Fall River/New Bedford/Worchester, MA
  508  26011            Fall River/New Bedford/Worchester, MA
  509  560              Spokane/Walla Walla/Yakima, WA
  510  760-1111         Oakland, CA
  512  830              Austin/Corpus Christi, TX
  512  970-xxxx         Austin/Corpus Christi, TX
  513  380-55555555     Cincinnati/Dayton, OH
  515  5463             Des Moines, IA
  515  811              Des Moines, IA
  516  958              Hempstead/Long Island, NY
  516  968              Hempstead/Long Island, NY
  517  200-222-2222     Bay City/Jackson/Lansing, MI
  517  200200200200200  Bay City/Jackson/Lansing, MI
N 517  958-1111         Bay City/Jackson/Lansing, MI (GTE)
  518  511              Albany/Schenectady/Troy, NY
  518  997              Albany/Schenectady/Troy, NY
  518  998              Albany/Schenectady/Troy, NY
  540  211              Roanoke, VA (GTE)
  540  311              Roanoke, VA (GTE)
  541  200              Bend, OR
N 573  511
N 602  958-3474         Phoenix, AZ
N 601  200-222-2222     MS
N 603  200-2222         NH
  603  200-222-2222     NH
  606  997-555-1212     Ashland/Winchester, KY
  606  711              Ashland/Winchester, KY
  607  993              Binghamton/Elmira, NY
  609  958              Atlantic City/Camden/Trenton/Vineland, NJ
  610  958              Allentown/Reading, PA
  610  958-4100         Allentown/Reading, PA
  612  511              Minneapolis/St.Paul, MN
  614  200              Columbus/Steubenville, OH
  614  571              Columbus/Steubenville, OH
  615  200200200200200  Chatanooga/Knoxville/Nashville, TN
  615  2002222222       Chatanooga/Knoxville/Nashville, TN
  615  830              Nashville, TN
  616  200-222-2222     Battle Creek/Grand Rapids/Kalamazoo, MI
N 616  958-1111         Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
  617  200-222-1234     Boston, MA
  617  200-222-2222     Boston, MA
  617  200-444-4444     Boston, MA (Woburn, MA)
  617  220-2622         Boston, MA
  617  958              Boston, MA
  618  200-xxx-xxxx     Alton/Cairo/Mt.Vernon, IL
  618  930              Alton/Cairo/Mt.Vernon, IL
  619  211-2001         San Diego, CA
  619  211-2121         San Diego, CA
  659  220-2622         Newmarket, NH
  703  211              VA
  703  511-3636         Culpeper/Orange/Fredericksburg, VA
  703  811              Alexandria/Arlington/Roanoke, VA
  704  311              Asheville/Charlotte, NC
  706  940-xxxx         Augusta, GA
  707  211-2222         Eureka, CA
  707  611              Crescent City, CA
  708  1-200-555-1212   Chicago/Elgin, IL
  708  1-200-8825       Chicago/Elgin, IL (Last four change rapidly)
  708  200-6153         Chicago/Elgin, IL
  708  724-9951         Chicago/Elgin, IL
  713  380              Houston, TX
  713  970-xxxx         Houston, TX
  713  811              Humble, TX
  713  380-5555-5555    Houston, TX
  714  114              Anaheim, CA (GTE)
  714  211-2121         Anaheim, CA (PacBell)
  714  211-2222         Anaheim, CA (Pacbell)
  714  211-7777         Anaheim, CA (Pacbell)
  716  511           Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
  716  990           Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
  717  958              Harrisburg/Scranton/Wilkes-Barre, PA
  718  958              Bronx/Brooklyn/Queens/Staten Island, NY
  770  780-2311         Marietta/Norcross, GA
  770  940-xxx-xxxx     Marietta/Norcross, GA
  802  2-222-222-2222   Vermont
  802  200-222-2222     Vermont
  802  1-700-222-2222   Vermont
  802  111-2222         Vermont
  804  211              Richmond, VA
  804  990              Virginia Beach, VA
[804 118 according to forrest swope. H.]
  805  114              Bakersfield/Santa Barbara, CA
  805  211-1101         Bakersfield/Santa Barbara, CA
  805  211-2345         Bakersfield/Santa Barbara, CA
  805  211-2346         Bakersfield/Santa Barbara, CA (Returns DTMF)
  805  830              Bakersfield/Santa Barbara, CA
  806  970-xxxx         Amarillo/Lubbock, TX
  810  200200200200200  Flint/Pontiac/Southfield/Troy, MI
  810  311              Pontiac/Southfield/Troy, MI
N 810  958-1111         Pontiac/Southfield/Troy, MI (GTE)
  812  410-555-1212     Evansville, IN
  813  311              Ft. Meyers/St. Petersburg/Tampa, FL
  815  200-3374         Crystal Lake, IL
  815  270-3374         Crystal Lake, IL
  815  770-3374         Crystal Lake, IL
  815  200-xxx-xxxx     La Salle/Rockford, IL
  815  290              La Salle/Rockford, IL
  817  211              Ft. Worth/Waco, TX
  817  970-611-1111     Ft. Worth/Waco, TX  (Southwestern Bell)
  817  973-222-11111    Ft. Worth/Waco, TX
  818  114              Pasadena, CA (GTE)
  818  1223             Pasadena, CA (Some 1AESS switches) (Pac Bell)
  818  211-2345         Pasadena, CA (English response) (Pac Bell)
  818  211-2346         Pasadena, CA (DTMF response) (Pac Bell)
  860  970              CT
  901  899-?555         Memphis, TN
  903  970-611-1111     Tyler, TX
  904  200-222-222      Jackonsville/Pensacola/Tallahasee, FL
  904  311              Jackonsville/Pensacola/Tallahasee, FL
  904  780-2311         Jackonsville/Pensacola/Tallahasee, FL
  906  1-200-222-2222   Marquette/Sault Ste. Marie, MI
N 906  958-1111         Marquette/Sault Ste. Marie, MI (GTE)
U 907  811              Anchorage, AK
  908  958              New Brunswick, NJ
  909  111              Riverside/San Bernardino, CA (GTE)
  909  114              Riverside/San Bernardino, CA
  910  200             Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  910  311             Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  910  988             Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
  912  711              Albany/Savannah, GA
  912  780-2311         Albany/Savannah, GA
  914  990-1111         Peekskill/Poughkeepsie/White Plains/Yonkers, NY
  915  970-xxxx         Abilene/El Paso, TX
  916  211-0007         Sacramento, CA (Pac Bell)
  916  461              Sacramento, CA (Roseville Telephone)
  919  200              Durham, NC
  919  711              Durham, NC
  919  780-2411         Durham, NC
  954  200-555-1212     Ft. Lauderdale, FL
  954  200200200200200  Ft. Lauderdale, FL
  954  780-2411         Ft. Lauderdale, FL

  Canada:
  204  644-4444         Manitoba
  306  115              Saskatchewan
  403  311              Alberta, Yukon and N.W. Territory
  403  908-222-2222     Alberta, Yukon and N.W. Territory
  403  999              Alberta, Yukon and N.W. Territory
  416  997-xxxx         Toronto, Ontario
N 416  997-1699         Down Town, Toronto, Ontario
N 416  997-1699         Riverdale, Toronto, Ontario
N 416  997-8123         Scarborough, Toronto, Ontario
  506  1-555-1313       New Brunswick
  514  320-xxxx         Montreal, Quebec
  514  320-1232         Montreal, Quebec
  514  320-1223         Montreal, Quebec
  514  320-1233         Montreal, Quebec
  519  320-xxxx         London, Ontario
  604  1116             British Columbia
  604  1211             British Columbia
  604  211              British Columbia
  613  320-2232         Ottawa, Ontario
N 613  320-5123         Kingston/Belleville/Southeastern Ontario
N 613  320-5124         Kingston/Belleville/Southeastern Ontario
N 613  320-9123         Kingston/Belleville/Southeastern Ontario
  705  320-4567         North Bay/Saulte Ste. Marie, Ontario
  819  320-1112         Quebec
[Note from Mike: I found the new ANAC for the 604 calling area in
Vancouver, BC, Canada it is (604)958-6111. Also any prefix followed with
2011, so xxx-2011 is the high end of a loop. However, I can't find the
low end..
xxx-2012 gives a constantly busy and xxx-2010 rings forever.
Any help with finding the other end would be greatly appreciated. H.]

N Argentina:
  5702

  Australia:
  +61  03-552-4111      Victoria 03 area
  +612 19123            All major capital cities
  +612 11544

  United Kingdom:
U 175 or 17071

  Israel:
  110


------------------------------------------------------------------------
---

C-12. What is a ringback number?

A ringback number is a number that you call that will immediately
ring the telephone from which it was called.

In most instances you must call the ringback number, quickly hang up
the phone for just a short moment and then let up on the switch, you
will then go back off hook and hear a different tone.  You may then
hang up.  You will be called back seconds later.  On some systems,
you will have to press a button of flash hook again before the final
hang up.


------------------------------------------------------------------------
---

C-13. What is the ringback number for my area?

An 'x' means insert those numbers from the phone number from which you
are calling.  A '?' means that the number varies from switch to switch
in the area, or changes from time to time.  Try all possible
combinations.

If the ringback for your NPA is not listed, try common ones such as 114,
951-xxx-xxxx, 954, 957 and 958.  Also, try using the numbers listed for
other NPA's served by your telephone company.

Note: These geographic areas are for reference purposes only.  Ringback
numbers may vary from switch to switch within the same city.

  NPA  Ringback number  Approximate Geographic area
  ---  ---------------  ---------------------------------------------
  201  55?-xxxx         Hackensack/Jersey City/Newark/Paterson, NJ
  202  958-xxxx         District of Columbia
  203  99?-xxxx         CT
  206  571-xxxx         WA
  207  981-xxxx         ME
  208  59X-xxxx         ID
  208  99xxx-xxxx       ID
  210  211-8849-xxxx    Brownsville/Laredo/San Antonio, TX (GTE)
N 213  xxx-xxxx    Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 witches)
N 213  117-xxxx         Los Angeles, CA (GTE 5ESS switches)
U 213  195-xxxx         Los Angeles, CA (GTE 1AESS switches)
  214  971-xxxx         Dallas, TX
  215  811-xxxx         Philadelphia, PA
  216  551-xxxx         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  219  571-xxx-xxxx     Gary/Hammond/Michigan City/Southbend, IN
  219  777-xxx-xxxx     Gary/Hammond/Michigan City/Southbend, IN
  301  579-xxxx         Hagerstown/Rockville, MD
  301  958-xxxx         Hagerstown/Rockville, MD
  303  99x-xxxx         Grand Junction, CO
  304  998-xxxx         WV
  305  999-xxxx         Ft. Lauderdale/Key West/Miami, FL
  312  511-xxxx         Chicago, IL
  312  511-xxx-xxxx     Chicago, IL
  312  57?-xxxx         Chicago, IL
N 313  116-xxx-xxxx     Ann Arbor/Dearborn/Detroit, MI (GTE)
N 313  951-xxxx         Ann Arbor/Dearborn/Detroit, MI
  315  98x-xxxx         Syracuse/Utica, NY
  317  777-xxxx         Indianapolis/Kokomo, IN
  317  xxx-xxxx    Indianapolis/Kokomo, IN (y=3rd digit of phone number)
  319  79x-xxxx         Davenport/Dubuque, Iowa
  334  901-xxxx         Montgomery, AL
  401  98?-xxxx         RI
  404  450-xxxx         Atlanta, GA
  407  988-xxxx         Orlando/West Palm Beach, FL
  408  470-xxxx         San Jose, CA
  408  580-xxxx         San Jose, CA
  412  985-xxxx         Pittsburgh, PA
N 413  1983-xxxx        Pittsfield/Springfield, MA
  414  977-xxxx         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  414  978-xxxx         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  415  350-xxxx         San Francisco, CA
  417  551-xxxx         Joplin/Springfield, MO
N 501  221-xxxx         Ft. Smith, AR (646 prefix)
  501  221-xxx-xxxx     AR
N 501  780-xxxx         Ft. Smith, AR (452 prefix)
  502  988              Frankfort/Louisville/Paducah/Shelbyville, KY
  503  541-XXXX         OR
  504  99x-xxxx         Baton Rouge/New Orleans, LA
  504  9988776655       Baton Rouge/New Orleans, LA
  505  59?-xxxx         New Mexico
  512  95X-xxxx         Austin, TX
  513  951-xxxx         Cincinnati/Dayton, OH
  513  955-xxxx         Cincinnati/Dayton, OH
  513  99?-xxxx         Cincinnati/Dayton, OH (X=0, 1, 2, 3, 4, 8 or 9)
  515  559-XXXX         Des Moines, IA
N 516  660-xxxx         Hempstead/Long Island, NY
  516  660-xxx-xxxx     Hempstead/Long Island, NY
N 517  116-xxx-xxxx     Bay City/Jackson/Lansing, MI (GTE)
N 520  594-xxxx         AZ
  601  777-xxxx         MS
  603  981-xxxx         NH
  609  55?-xxxx         Atlantic City/Camden/Trenton/Vineland, NJ
  610  811-xxxx         Allentown/Reading, PA
  612  511              Minneapolis/St.Paul, MN
  612  999-xxx-xxxx     Minneapolis/St.Paul, MN
  614  998-xxxx         Columbus/Steubenville, OH
  615  920-XXXX         Chatanooga/Knoxville/Nashville, TN
  615  930-xxxx         Chatanooga/Knoxville/Nashville, TN
N 616  116-xxx-xxxx     Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
  616  946-xxxx         Battle Creek/Grand Rapids/Kalamazoo, MI
  619  331-xxxx         San Diego, CA
  619  332-xxxx         San Diego, CA
  659  981-XXXX         Newmarket, NH
  703  511-xxx-xxxx     VA
  703  958-xxxx         Alexandria/Arlington/Roanoke, VA
  708  511-xxxx         Chicago/Elgin, IL
  713  231-xxxx         Los Angeles, CA
  714  330?             Anaheim, CA (GTE)
  714  33?-xxxx         Anaheim, CA (PacBell)
  716  981-xxxx         Rochester, NY (Rochester Tel)
  718  660-xxxx         Bronx/Brooklyn/Queens/Staten Island, NY
  719  99x-xxxx         Colorado Springs/Leadville/Pueblo, CO
  801  938-xxxx         Utah
  801  939-xxxx         Utah
  802  987-xxxx         Vermont
  804  260             Charlottesville/Newport News/Norfolk/Richmond, VA
  805  114              Bakersfield/Santa Barbara, CA
  805  980-xxxx         Bakersfield/Santa Barbara, CA
N 810  116-xxx-xxxx     Pontiac/Southfield/Troy, MI (GTE)
  810  951-xxx-xxxx     Pontiac/Southfield/Troy, MI
  813  711              Ft. Meyers/St. Petersburg/Tampa, FL
  817  971              Ft. Worth/Waco, TX (Flashhook, then 2#)
  818  915?-xxxx        Pasadena, CA
  864  999-xxx-xxxx     Greenville/Spartanburg, SC
N 906  116-xxx-xxxx     Marquette/Sault Ste. Marie, MI (GTE)
  906  951-xxx-xxxx     Marquette/Sault Ste. Marie, MI
  908  55?-xxxx         New Brunswick, NJ
  908  953              New Brunswick, NJ
  913  951-xxxx         Lawrence/Salina/Topeka, KS
  914  660-xxxx-xxxx    Peekskill/Poughkeepsie/White Plains/Yonkers, NY

  Canada:
  204  590-xxx-xxxx     Manitoba
N 403  999-xxx-xxxx     Alberta, Yukon, and N.W. Territories
  416  57x-xxxx         Toronto, Ontario
  416  99x-xxxx         Toronto, Ontario
  416  999-xxx-xxxx     Toronto, Ontario
  506  572+xxx-xxxx     New Brunswick
  514  320-xxx-xxxx     Montreal, Quebec
  519  999-xxx-xxxx     London, Ontario
  604  311-xxx-xxxx     British Columbia
N 604  871-xxx-xxxx     British Columbia
  613  999-xxx-xxxx     Ottawa, Ontario
  705  999-xxx-xxxx     North Bay/Saulte Ste. Marie, Ontario
  819  320-xxx-xxxx     Quebec
N 902  575-xxx-xxxx     Halifax, Nova Scotia
  905  999-xxx-xxxx     Hamilton/Mississauga/Niagra Falls, Ontario

N Argentina             115
  Australia:            +61 199
U Brazil:               109
  France:               3644
  Holland:              99-xxxxxx
  Malaysia              196
  New Zealand:          137
  Sweden:               0058
U United Kingdom:       174 or 1744 or 175 or 0500-89-0011 or 17070 + 1
  Amsterdam             0196
  Hilversum             0123456789
  Breukelen             0123456789
  Groningen             951


------------------------------------------------------------------------
---

C-14. What is a loop?

This FAQ answer is excerpted from: ToneLoc v0.99 User Manual
       by Minor Threat & Mucho Maas

Loops are a pair of phone numbers, usually consecutive, like 836-9998
and 836-9999.  They are used by the phone company for testing.  What
good do loops do us?  Well, they are cool in a few ways.  Here is a
simple use of loops.  Each loop has two ends, a 'high' end, and a
'low' end.  One end gives a (usually) constant, loud tone when it is
called. The other end is silent.  Loops don't usually ring either.
When BOTH ends are called, the people that called each end can talk
through the loop.  Some loops are voice filtered and won't pass
anything but a constant tone; these aren't much use to you.  Here's
what you can use working loops for:  billing phone calls!  First, call
the end that gives the loud tone.  Then if the operator or someone
calls the other end, the tone will go quiet.  Act like the phone just
rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or
what the fuck ever.  The operator thinks that she just called you, and
that's it!  Now the phone bill will go to the loop, and your local
RBOC will get the bill!  Use this technique in moderation, or the loop
may go down.  Loops are probably most useful when you want to talk to
someone to whom you don't want to give your phone number.


------------------------------------------------------------------------
---

C-15. What is a loop in my area?

Many (if not most) of these loops are no longer functional.  If you are
local to any of these loops, please try them out an e-mail me the
results of your research.

  NPA    High      Low
  ---  --------  --------
  201  666-9929  666-9930
  208  862-9996  862-9997
  213  365-1118  365-1119
  308  357-0004  357-0005
  310  455-0002  455-????
  310  546-0002  546-????
  312  262-9902  262-9903 (Editors note: Very odd sound)
  313  224-9996  224-9997
  313  225-9996  225-9997
  313  234-9996  234-9997
  313  237-9996  237-9997
  313  256-9996  256-9997
  313  272-9996  272-9997
  313  273-9996  273-9997
  313  277-9996  277-9997
  313  281-9996  281-9997
  313  292-9996  292-9997
  313  299-9996  299-9997
  313  321-9996  321-9997
  313  326-9996  326-9997
  313  356-9996  356-9997
  313  362-9996  362-9997
  313  369-9996  369-9997
  313  388-9996  388-9997
  313  397-9996  397-9997
  313  399-9996  399-9997
  313  445-9996  445-9997
  313  465-9996  465-9997
  313  471-9996  471-9997
  313  474-9996  474-9997
  313  477-9996  477-9997
  313  478-9996  478-9997
  313  483-9996  483-9997
  313  497-9996  497-9997
  313  526-9996  526-9997
  313  552-9996  552-9997
  313  556-9996  556-9997
  313  561-9996  561-9997
  313  569-9996  569-9996
  313  575-9996  575-9997
  313  577-9996  577-9997
  313  585-9996  585-9997
  313  591-9996  591-9997
  313  621-9996  621-9997
  313  626-9996  626-9997
  313  644-9996  644-9997
  313  646-9996  646-9997
  313  647-9996  647-9997
  313  649-9996  649-9997
  313  663-9996  663-9997
  313  665-9996  665-9997
  313  683-9996  683-9997
  313  721-9996  721-9997
  313  722-9996  722-9997
  313  728-9996  728-9997
  313  731-9996  731-9997
  313  751-9996  751-9997
  313  776-9996  776-9997
  313  781-9996  781-9997
  313  787-9996  787-9997
  313  822-9996  822-9997
  313  833-9996  833-9997
  313  851-9996  851-9997
  313  871-9996  871-9997
  313  875-9996  875-9997
  313  886-9996  886-9997
  313  888-9996  888-9997
  313  898-9996  898-9997
  313  934-9996  934-9997
  313  942-9996  942-9997
  313  963-9996  963-9997
  313  977-9996  977-9997
  315  673-9995  673-9996
  315  695-9995  695-9996
  406  225-9902  225-9903
  408  238-0044  238-0045
  408  773-0044  773-0045
N 501  753-4291  753-4297
  517  422-9996  422-9997
  517  423-9996  423-9997
  517  563-9996  563-9997
  517  663-9996  663-????
  517  851-9996  851-9997
  613  966-1111
N 703  591-9994
  713  342-1499  342-1799
  713  351-1499  351-1799
  713  354-1499  354-1799
  713  356-1499  356-1799
  713  442-1499  442-1799
  713  447-1499  447-1799
  713  455-1499  455-1799
  713  458-1499  458-1799
  713  462-1499  462-1799
  713  466-1499  466-1799
  713  468-1499  468-1799
  713  469-1499  469-1799
  713  471-1499  471-1799
  713  481-1499  481-1799
  713  482-1499  482-1799
  713  484-1499  484-1799
  713  487-1499  487-1799
  713  489-1499  489-1799
  713  492-1499  492-1799
  713  493-1499  493-1799
  713  524-1499  524-1799
  713  526-1499  526-1799
  713  555-1499  555-1799
  713  661-1499  661-1799
  713  664-1499  664-1799
  713  665-1499  665-1799
  713  666-1499  666-1799
  713  667-1499  667-1799
  713  682-1499  976-1799
  713  771-1499  771-1799
  713  780-1499  780-1799
  713  781-1499  997-1799
  713  960-1499  960-1799
  713  977-1499  977-1799
  713  988-1499  988-1799
  719  598-0009  598-0010
  805  528-0044  528-0045
  805  544-0044  544-0045
  805  773-0044  773-0045
  808  235-9907  235-9908
  808  239-9907  239-9908
  808  245-9907  245-9908
  808  247-9907  247-9908
  808  261-9907  261-9908
  808  322-9907  322-9908
  808  328-9907  328-9908
  808  329-9907  329-9908
  808  332-9907  332-9908
  808  335-9907  335-9908
  808  572-9907  572-9908
  808  623-9907  623-9908
  808  624-9907  624-9908
  808  668-9907  668-9908
  808  742-9907  742-9908
  808  879-9907  879-9908
  808  882-9907  882-9908
  808  885-9907  885-9908
  808  959-9907  959-9908
  808  961-9907  961-9908
  810  362-9996  362-9997
  813  385-9971  385-xxxx
  847  724-9951  724-????
  908  254-9929  254-9930
  908  558-9929  558-9930
  908  560-9929  560-9930
  908  776-9930  776-9930
N 916  221-0044  221-0045       // Voice filtered
N 916  222-0044  222-0045       // Voice filtered


------------------------------------------------------------------------
---

C-16. What is a CNA number?

CNA stands for Customer Name and Address.  The CNA number is a phone
number for telephone company personnel to call and get the name and
address for a phone number.  If a telephone lineman finds a phone line
he does not recognize, he can use the ANI number to find its phone
number and then call the CNA operator to see who owns it and where
they live.

Normal CNA numbers are available only to telephone company personnel.
Private citizens may legally get CNA information from private
companies.  Two such companies are:

Cross-Reference Directories             (900)288-3020
AT&T National Directory Assistance      (900)555-1212
Telename                                (900)884-1212
Unidirectory                            (900)933-3330

Note that these are 900 numbers, and will cost you approximately one
dollar per minute.

If you are in 312, 708, or parts of 815, AmeriTech has a pay-for-play
CNA service available to the general public.  The number is 796-9600.
The cost is $.35/call and can look up two numbers per call.

If you are in 415, Pacific Bell offers a public access CNL service at
(415)705-9299.

If you are in Bell Atlantic territory you can call (201)555-5454 or
(908)555-5454 for automated CNA information.  The cost is $.50/call.

The legal telephone company CNA for Ontario is 555-1313.

You can fool (800)967-5356 into giving you a free CNA by requesting a
free disk and then entering the number you want the adress for at the
prompt.

You can often social engineer CNA information out of telephone company
employees or out of employees of other companies with CNA access.

Here is a sample script that works if your target has ever ordered
pizza from Domino's or Pizza Hut:

 Them: Hi, thanks for call, may I take your order please?
 You:  Yes, I'd like 4 large pepperoni pizzas.
 Them: May I have your phone number please?
 You:  <State your targets phone number here>
 Them: Is this 238 Ward Road?
 You:  Yes ma'am.


------------------------------------------------------------------------
---

C-17. What is the telephone company CNA number for my area?

  203    (203)771-8080         CT
N 214    (214)744-9500         Southwestern Bell
N 214    (214)745-7505         Southwestern Bell
N 217    (217)789-8290         Ameritech (Illinois)
  312    (312)796-9600         Chicago, IL
  506    (506)555-1313         New Brunswick
  513    (513)397-9110         Cincinnati/Dayton, OH
  516    (516)321-5700         Hempstead/Long Island, NY
  614    (614)464-0123         Columbus/Steubenville, OH
  813    (813)270-8711         Ft. Meyers/St. Petersburg/Tampa, FL
N 912    (912)752-2000 #1367   Albany/Savannah, GA
  NYNEX  (518)471-8111         New York, Connecticut, Vermont, Rhode
          Island, New Hampshire, and Massachusetts


------------------------------------------------------------------------
---

C-18. What are some numbers that always ring busy?

In the following listings, "xxx" means that the same number is used as a
constantly busy number in many different prefixes.  In most of these,
there are some exchanges that ring busy and some exchanges that are in
normal use.  *ALWAYS* test these numbers at least three times during
normal business hours before using as a constantly busy number.

  800  999-1803              WATS
  201  635-9970              Hackensack/Jersey City/Newark/Paterson, NJ
  212  724-9970              Manhattan, NY
  213  xxx-1117              Los Angeles, CA
  213  xxx-1118              Los Angeles, CA
  213  xxx-1119              Los Angeles, CA
  213  xxx-9198              Los Angeles, CA
  216  xxx-9887             Akron/Canton/Cleveland/Lorain/Youngstown, OH
  303  431-0000              Denver, CO
  303  866-8660              Denver, CO
  310  xxx-1117              Long Beach, CA
  310  xxx-1118              Long Beach, CA
  310  xxx-1119              Long Beach, CA
  310  xxx-9198              Long Beach, CA
  316  952-7265              Dodge City/Wichita, KS
  501  377-99xx              AR
N 518  571-xxxx              Albany, NY
  719  472-3772              Colorado Springs/Leadville/Pueblo, CO
  805  255-0699              Bakersfield/Santa Barbara, CA
  714  xxx-1117              Anaheim, CA
  714  xxx-1118              Anaheim, CA
  714  xxx-1119              Anaheim, CA
  714  xxx-9198              Anaheim, CA
  717  292-0009              Harrisburg/Scranton/Wilkes-Barre, PA
N 717  980-xxxx              Harrisburg/Scranton/Wilkes Barre, PA
  818  xxx-1117              Pasadena, CA
  818  xxx-1118              Pasadena, CA
  818  xxx-1119              Pasadena, CA
  818  xxx-9198              Pasadena, CA
  818  885-0699              Pasadena, CA  (???-0699 is a pattern)
  860  525-7078              Hartford, CT
  906  632-9999              Marquette/Sault Ste. Marie, MI
  906  635-9999              Marquette/Sault Ste. Marie, MI


------------------------------------------------------------------------
---

C-19. What are some numbers that temporarily disconnect phone service?

  If your NPA is not listed, or the listing does not cover your LATA,
  try common numbers such as 119 (GTD5 switches) or 511.

N 209  999        Stockton/Fresno/Lodi, CA                 (100 seconds)
N 313  xxx-9994   Ann Arbor/Dearborn/Detroit, MI (Ameritech) (1 minute)
  314  511        Columbia/Jefferson City/St.Louis, MO       (1 minute)
  404  420        Atlanta, GA                                (5 minutes)
  405  953        Enid/Oklahoma City, OK                     (1 minute)
  407  511        Orlando, FL (United Telephone)             (1 minute)
  414 958-0013    Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute)
  512  200        Austin/Corpus Christi, TX                  (1 minute)
  516  480        Hempstead/Long Island, NY                  (1 minute)
N 517  xxx-9994   Bay City/Jackson/Lansing, MI (Ameritech)   (1 minute)
N 518  958        Albany, NY                                 (1 minute)
  603  980        NH
  614  xxx-9894   Columbus/Steubenville, OH
N 616  xxx-9994   Battle Creek/Grand Rapids/Kalamazoo, MI (Ameritech)
       (1 minute)
  805  119        Bakersfield/Santa Barbara, CA              (3 minutes)
  807  211        Thunder Bay, Ontario                       (3 minutes)
N 810  xxx-9994   Pontiac/Southfield/Troy, MI (Ameritech)    (1 minute)
N 906  xxx-9994   Marquette/Sault Ste. Marie, MI (Ameritech) (1 minute)
  919  211 or 511 Durham, NC                           (10 min - 1 hour)


------------------------------------------------------------------------
---

C-20. What is a Proctor Test Set?

A Proctor Test Set is a tool used by telco personnel to diagnose
problems with phone lines.  You call the Proctor Test Set number and
press buttons on a touch tone phone to active the tests you select.


------------------------------------------------------------------------
---

C-21. What is a Proctor Test Set in my area?

If your NPA is not listed try common numbers such as 111 or 117.

  805  111        Bakersfield/Santa Barbara, CA
  909  117        Tyler, TX
  913  611-1111   Lawrence/Salina/Topeka, KS


------------------------------------------------------------------------
---

C-22. What is scanning?

Scanning is dialing a large number of telephone numbers in the hope of
finding anything interesting.  Interesting items often include test
tones, computers, Voice Message Boxes (VMB's), Private Branch Exchanges
(PBX's), and government offices.

Scanning can be done by hand, although dialing several thousand
telephone numbers by hand is extremely boring and takes a long time.

Much better is to use a scanning program, sometimes called a war
dialer or a demon dialer.  Currently, the best war dialer available to
PC-DOS users is ToneLoc from Minor Threat and Mucho Maas.  ToneLoc can
be ftp'd from ftp.paranoia.com /pub/toneloc/.  For the Macintosh, try
Assault Dialer.

A war dialer will dial a range of numbers and log what it finds at
each number.  You can then only dial up the numbers that the war
dialer marked as carriers or tones.


------------------------------------------------------------------------
---

C-23. Is scanning illegal?

Excerpt from: 2600, Spring 1990, Page 27:

-BQ-
In some places, scanning has been made illegal.  It would be hard,
though, for someone to file a complaint against you for scanning since
the whole purpose is to call every number once and only once.  It's
not likely to be thought of as harassment by anyone who gets a single
phone call from a scanning computer.  Some central offices have been
known to react strangely when people start scanning.  Sometimes you're
unable to get a dialtone for hours after you start scanning.  But
there is no uniform policy.  The best thing to do is to first find out
if you've got some crazy law saying you can't do it.  If, as is
likely, there is no such law, the only way to find out what happens is
to give it a try.
-EQ-

It should be noted that a law making scanning illegal was recently
passed in Colorado Springs, CO.  It is now illegal to place a call
in Colorado Springs without the intent to communicate.


------------------------------------------------------------------------
---

C-24. How can I make a lineman's handset?

This FAQ answer was written by Phucked Agent 04:

This is the "right hand" of both the professional and the amatuer
lineman. Basically, it is a customized portable telephone which is
designed to be hooked onto raw cable terminals in the field and used to
monitor the line, talk, or dial out.  The monitor function is usually
the main difference between the "butt-in" test set and the normal phone.
If you don't have a real test set already, the following circuit can
convert a normal $4 made-in-taiwan phone into a working test set.  The
"all-in-one" handset units without bases are the best (I tend to like
QUIK's and GTE Flip Phone II's). Anyway-

OFFICIAL Agent 04 Generic Test Set Modification (tm)

  Ring >---------------------------------> to "test set" phone
   Tip >------!  SPST Switch    !-------->
       !-----/ ----------!
>from         !-------/!/!/!/!--!    C = 0.22 uF  200 WVDC Mylar
cable pair    !   C       R     !    R = 10 kOhm 1/2 W
(alligators)  !--! (------------! SPST = Talk / Monitor


When SPST is closed, you are in talk mode; when you lift the switch-
hook on the "test set" phone, you will get a dial tone as if you were a
standard extension of the line you are on.  You will be able to dial out
and receive calls.  When the SPST is opened, the resistor and capacitor
are no longer shunted, and they become part of the telephone circuit.
When you lift the switchhook on the test set, you will not receive dial
tone, due to the fact that the cap blocks DC, and the resistor passes
less than 4 mA nominally (far below the amount necessary to saturate the
supervisory ferrod on ESS or close the line relay on any other switch).
However, you will be able to silently monitor all audio on the line. The
cap reactance + the phone's impedance insure that you won't cut the
signal too much on the phone line, which might cause a noticeable change
(..expedite the shock force, SOMEONE'S ON MY LINE!!). It's also good to
have a VOM handy when working outside to rapidly check for active lines
or supervision states.


------------------------------------------------------------------------
---

C-25. Where can I purchase a lineman's handset?

Contact East
335 Willow Street
North Andover, MA 01845-5995
(508)682-2000

Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399
(800)426-1194

Specialized Products
3131 Premier Drive
Irving, TX 75063
(800)866-5353

Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064
(619)679-0303


------------------------------------------------------------------------
---

C-26. What are the DTMF frequencies?

DTMF stands for Dual Tone Multi Frequency.  These are the tones you get
when you press a key on your telephone touch pad.  The tone of the
button is the sum of the column and row tones.  The ABCD keys do not
exist on standard telephones.

      1209hz 1336hz 1477hz 1633hz

     697hz      1      2      3      A

     770hz      4      5      6      B

     852hz      7      8      9      C

     941hz      *      0      #      D



------------------------------------------------------------------------
---

C-27. What are the frequencies of the telephone tones?

Many of these tones are no longer used and are mentioned here only for
historical accuracy.

Low Tone
~~~~~~~~
This is a generic tone used with various interruption patterns for
specific tones listed below and described under their own titles:

 Line Busy Tone
 Reorder
 RevertingTone
 No Circuit Tone
 No Such Number
 Vacant Code
 Group Busy Tone
 Deposit Coin Tone
 Vacant Position Tone
 Dial Off-Normal Tone
 Trouble Tone
 Dial Jack Tone
 Dial Test Signal
 Class of Service

Low Tone 480 Hz and 620 Hz at -24 dBm0/frequency.  On some systems
manufactured before 1974, Low Tone was 600 Hz modulated at 120, 133, 140
or 160 Hz at 61 - 71 dBrnC.



High Tone
~~~~~~~~~
This is a generic tone used with various interruption patterns for the
specific tones listed below and described under their own titles:

 Partial Dial Tone
 Permanent Signal
 Coin Return (Test) Tone
 Coin Return Tone
 Number Checking Tone
 Intercepting Loopback Tone
 Warning Tone
 Order Tone
 Station Ringer Test
 Class of Service

High Tone 480 Hz at -17 dBm0.  On some systems manufactured before 1974,
High Tone was 400 Hz or 500 Hz at 61 - 71 dBrnC.


Dial Tone
~~~~~~~~~
This tone is sent to a customer or operator to indicate that the
receiving end is ready to receive dial pulses or DTMF signals. It is
used in all types of dial offices when dial pulses are produced by the
customer's or operator's dials.  Normally dial tone means that the
entire wanted number may be dialed; however, there are some cases where
the calling party must await a second dial tone or where an operator,
after dialing an initial group of digits, must wait for a second dial
tone before the rest of the number can be dialed. Some dialing
switchboards are arranged to permit listening for dial tone between
certain digits.

Dial Tone is 350 Hz and 440 Hz held steady at -13 dBm0/frequency.


Audible Ring Tone
~~~~~~~~~~~~~~~~~
This is a ringing indication which is intercepted by the calling party
to mean that the called line has been reached and that the ringing has
started.  It is also used on calls to operators (special service, long
distance, intercepting, etc) during the "awaiting-operator-answer"
interval.

Audible Ring Tone is 440 Hz and 480 Hz for 2 seconds on and 4 seconds
off at -13 dBm0/frequency.


Line Busy Tone
~~~~~~~~~~~~~~
The Line Busy Tine indicates that the called customer's line has been
reached but that it is busy or being rung or on permanent signal.  When
a line busy signal is applied by an operator, it is sometimes calls a
busy-back tone.

Line Busy Tone is Low Tone on and off every .5 seconds.


Reorder
~~~~~~~
Reorder indicates that the local or toll switching or transmission paths
to the office or equipment serving the called customer is busy.  This
signal may indicate a condition such as a timed-out sender or unassigned
code dialed.  It is interpreted by either a customer or an operator as a
reorder signal.

Reorder on a local call is Low Tone for .3 seconds on and .2 seconds
off. Reorder on a toll call is Low Tone for .2 seconds on and .3 seconds
off.  In No. 5 crossbar, No. 1/1A ESS, No. 2/2B ESS switching equipment
and No. 1 step-by-step offices using the Precise Tone Plan, the temporal
pattern is 0.25 second of low tone and 0.25 second off.


Alerting Tone
~~~~~~~~~~~~~
Indicates that an operator has connected to the line (emergency
interrupt on a busy line during a verification call).

Alerting Tone is 440 Hz on for 2 seconds and then on again for .5
seconds every ten seconds.


Recorder Warning Tone
~~~~~~~~~~~~~~~~~~~~~
When recording equipment is used, this tone is connected to the line to
inform the distant party that the conversation is bveing recorded.  The
tone source is located within the recording equipment and cannot be
controlled by the party applying the recording equipment to the line.
This tone is required by law and is recorded along with the speech.

Recorder Warning Tone is a .5 second burst at 1400 Hz every 15 seconds.


Recorder Connected Tone
~~~~~~~~~~~~~~~~~~~~~~~
This tone is used to inform the customer that his/her call is connected
to a recording machine and that he/she should proceed to leave a
message, dictate, etc.  It is to be distinguished from the recorder
warning tone, which warns the customer that his/her 2-way conversation
is being recorded.

Recorder Warning Tone is a .5 second burst at 440 Hz every 5 seconds.


Reverting Tone
~~~~~~~~~~~~~~
The same type of signal as line busy tone is used for reverting tone in
all systems.  In No. 5 crossbar systems, a second dial tone is sometimes
also used when a calling party identification digit is required.  The
reverting signal informs the calling subscriber that the called party is
on the same line and that he/she should hang up while the line is being
rung.

Reverting Tone is is Low Tone on and off every .5 seconds at -24
dBm0/frequency.


Deposit Coin Tone
~~~~~~~~~~~~~~~~~
This tone, sent from a Community Dial Office to a post-pay coin
telephone, informs the calling party that the called party has answered
and that the coin should be deposited.

Deposit Coin Tone is a steady Low Tone.


Receiver Off-Hook Tone
~~~~~~~~~~~~~~~~~~~~~~
This tone is used to cause off-hook customers to replace the receiver
on-hook on a permanent signal call and to signal a non-PBX off-hook line
when ringing key is operated by a switchboard operator.


Receiver Off-Hook Tone is 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at 0
dBm0/frequency on and off every .1 second.  On some older space division
switching systems Receiver Off-Hook was 1400 Hz, 2060 Hz, 2450 Hz and
2600 Hz at +5 VU on and off every .1 second.  On a No. 5 ESS this
continues for 30 seconds.  On a No. 2/2B ESS this continues for 40
seconds.  On some other AT&T switches there are two iterations of 50
seconds each.


Howler
~~~~~~
This tone is used in older offices to inform a customer that their
receiver is off-hook.  It has been superseded by the receiver off-hook
tone.

Howler was a 480 Hz tone incremented in volume every second for ten
seconds until it reaches +40 VU.


Partial Dial Tone
~~~~~~~~~~~~~~~~~
High-tone is used to notify the calling party that he/she has not
commenced dialing within a preallotted time, measured after receipt of
dial tone (permanent signal condition), or that he/she has not dialed
enough digits (partial dial condition).  This is a signal to hang up and
dial again.

Partial Dial Tone is a steady High Tone.


No Such Number a.k.a. "Cry Baby"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This signal tells the calling party to hang up, check the called number,
and dial again.  In modern systems, calls to unassigned or discontinued
numbers will also be routed to a machine announcement system, such as 6A
or 7A, which verbally supplies the require message.  In some older
offices, you could be routed to an intercepting operator.  In some
offices, reorder tone is returned in this condition.

No Such Number is 200 to 400 Hz modulated at 1 Hz, interrupted every 6
seconds for .5 seconds.


Vacant Code
~~~~~~~~~~~
This tone is used in crossbar systems to indicate that the dialed office
code is unassigned. In step-by-step areas, this signal is called vacant
level tone.  For operator-originated calls, the verbal announcement is
preceeded by two flashes.  In modern systems, recorded verbal
announcements are used for this service.

Vacant Code is Low Tone for .5 seconds on, .5 seconds off, .5 seconds of
and 1.5 seconds off.


Busy Verification Tone (Centrex)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Busy verification is a Centrex feature that allows the attendant to call
and be connected to a busy Centrex station within the attendant's
customer group.  The busy verification tone is applied to both parties
of the connection to inform them of the intrusion by the attendant.  No
tone is applied if the station called for busy verification is idle.

Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds
and then again for .3 seconds every 7.5 to 10 seconds. On a No. 1/1A
ESS, Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5
seconds and then again for .3 seconds every 6 seconds.

There is also a TSPS Busy Verification tone, which is 440 Hz at -13 dBm0
for 2 seconds and then on again for .5 seconds every 10 seconds.


Call Waiting Tone
~~~~~~~~~~~~~~~~~
Call Waiting is a special service that allows a busy line to answer an
incoming call by flashing the switchhook.  Audible ring (instead of line
busy) is applied to the calling line, and the Call Waiting tone is
applied to the called line.  (So that only the called party hears the
tone, the connection is momentarily broken, and the other party to that
connection experiences a moment of silence.)  Flashing the switchhook
places the existing connection on hold and connects the customer to the
waiting call.

Call Waiting Tone is two bursts of 440 Hz at -13 dBm0/frequency for .3
seconds plus or minus ten percent every ten seconds.


Confirmation Tone
~~~~~~~~~~~~~~~~~
This tone is used to acknowledge receipt by automatic equipment of
information necessary for special services.  It is currently used for:

 (1) Speed Calling   - dialed number has been recorded
 (2) Call Forwarding - dialed number has been recorded and
         service is activated
 (3) Call Forwarding - service is deactivated

Confirmation Tone is 350 Hz and 440 Hz at -13 dBm0/frequency on for .1
second, off for .1 second and then on for .3 seconds.


Indication of Camp-On
~~~~~~~~~~~~~~~~~~~~~
Attendant camp-on service allows an electronic switching system Centrex
attendant to hold incoming calls to busy lines.  Each time the attendant
releases his/her talking connection from the loop involved in the
camped-on call, the indication of camp-on tone is heard by the called
customer if the customer has subscribed to the indication of camp-on
option.  The customer may get this tone several times as the attendant
reconnects and releases from the loop in response to timed reminders
from the console.

Indication of Camp On is 440 Hz at -13 dBm0 for one second every time
the attendant releases from the loop.


Special Dial Tone
~~~~~~~~~~~~~~~~~
This tone is used with Three-Way Calling, Centrex station dial transfer,
and Centrex conference (station or attendant) services.  The user on an
existing connection flashes the switchhook, receives special dial tone,
and dials number of the third party to be added to the connection.

Special Dial Tone is 350 Hz and 440 Hz at -13 dBm0/frequency for .1
second on, .1 second off, .1 second on, .1 second off, .1 second on, .1
second off, and then on steady.


Priority Audible Ring (AUTOVON)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This tone replaces normal audible ring for priority calls within the
AUTOVON network.

Priority Audible Ring is 440 Hz and 480 Hz at -16 dBm0/frequency on for
1.65 seconds and off for .35 seconds.


Preemption Tone (AUTOVON)
~~~~~~~~~~~~~~~~~~~~~~~~~
This tone is provided to both parties of a connection that is preempted
by a priority call from the AUTOVON network.

Preemption Tone is 440 Hz and 620 Hz at -18 dBm0/frequency steady for
anywhere from three to fifteen seconds.


Data Set Answer Back Tone
~~~~~~~~~~~~~~~~~~~~~~~~~
This set is heard when manually initiating a data call.  It normally
occurs shortly after the start of audible ringing and means that the
remote data set has answered.  The data set at the calling end should
then be put into the data mode.

Data Set Answer Back Tone is 2025 Hz steady at -13 dBm.



Calling Card Service Prompt Tone
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This tone is used to inform the customer that his/her credit card
information must be keyed in.  The first 60 milliseconds of this
composite tone is 941 Hz abd 1477 Hz which is the DTMF '#'.  This tone
will release and DTMF to dial pulse converter in the conneciton.

Calling Card Service Prompt Tone is 941 Hz and 1477 Hz at -10
dBm0/frequency at -3 Transmission Level Point for 60 milliseconds and
then 440 Hz and 350 Hz at -7 dBm0 for .940 seconds exponentially decayed
from -10 dBm per frequency at -3 Transmission Level Point at time
constant of .2 seconds.


Class of Service
~~~~~~~~~~~~~~~~
These signals are used at a toll board operating as an 'A" board to
identify the class or service of the calling customer.  The indication
may be high, low, or no tone.

Class of Service is a single burst of either High Tone or Low Tone for
.05 to 1 seconds.


Dial-Normal Transmission Signal
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is a second dial tone returned to an operator between digits
indicating that he/she may dial the remainder of the number.  For
example, when an operator reaches a link-type Community Dial Office via
a step-by-step office after dialing a routing code, he/she must pause
until an idle link at the Community Dial Office returns dial tone.  This
From: Harlequin <harlequin@fnord.org.uk>
Subject: alt.2600 FAQ Revision .014 (3/4)
Date: 27 August 1999 07:34

method of operation is not recommended or considered standard.

Dial-Normal Transmission Signal is a steady Low Tone.


Dial Jack Tone
~~~~~~~~~~~~~~
Low tone is used as a start-dial signal to tell a DSA operator that the
connection reached through a dial jack is ready to receive dialing.

Dial Jack Tone is a steady Low Tone.


Order Tone
~~~~~~~~~~
High tones sent over interposition, local interoffice, or toll trunks
indicate:

 (1) the the originating operator that the order should be passed
 (2) to the receiving operator that an order is about to be
 passed

For Call Announcement and Autometic Display Call Indicator, the tone
serves function two only.

 (a) Single-order tone - This is a relatively long (0.5 second)
     signal which means that the originating operator should pass
     the office name and number.

 (b) Double-order tone - This signal is two short spurts in quick
     succession and means that the operator should pass only the
     desired number.

 (c) Triple-order tone - This signal is three short spurts in
     quick succession and means that the operator should pass the
     office name only and wait for another order tone.

 (d) Quadruple-order tone - This signal is four short spurts in
     quick succession and means that the operator should pass the
     city name only and wait for another challenge.  It is used
     in manual toll tandem (also called zip tones or trunk
     assignment tones).

Single-order tone is one .5 spurt of High Tone.
Double-order tone is two short spurts of High Tone.
Triple-order tone is three short spurts of High Tone.
Quadruple-order tone is four short spurts of High Tone.


Intercepting Loopback Tone
~~~~~~~~~~~~~~~~~~~~~~~~~~
High tone sent from an intercept operator to the 'A' board operator in
manual offices indicates that an intercept operator has completed the
call and that the 'A' should disconnect from the circuit.  The
completion of intercepted calls in this manner is no longer recommended.

Intercepting Loopback Tone is a steady High Tone.


Number Checking Tone
~~~~~~~~~~~~~~~~~~~~
High tone is sometimes used at DSA switchboards in No. 1 crossbar and
some step-by-step areas to verify the verbal identification of the
calling line.

Number Checking Tone is a steady High Tone.  On some older systems,
Number Checking Tone was a steady 135 Hz tone.


Coin Denomination Tones
~~~~~~~~~~~~~~~~~~~~~~~
These tones enable the operator to determine the amount deposited in
coin telephones.

Coin Denomination Tones for the old 3 slot payphones were:

 Nickel  - One tap of 1050 Hz and 1100 Hz (bell)
 Dime    - Two taps of 1050 Hz and 1100 Hz (bell)
 Quarter - One tap at 800 Hz (gong)


Coin Collect Tone
~~~~~~~~~~~~~~~~~
Low tone over a coin recording-completing trunk informs the originating
toll operator that the local operator or coin control circuit has
collected the charge.

Coin Collect Tone is a steady Low Tone.


Coin Return Tone
~~~~~~~~~~~~~~~~
High tone over a coin recording-completing trunk informs the originating
toll operator that the local operator or coin control circuit has
returned the change when the connection is not completed (also called
coin refund tone).

Coin Return Tone is a single .5 to 1 second burst of High Tone.


Coin Return (Test) Tone
~~~~~~~~~~~~~~~~~~~~~~~
High tone is used to tell an operator in a dial central office that a
tester has completed a call to his/her position over a coin trunk.

Coin Return (Test) Tone is a single .5 to 1 second burst of High Tone.


Group Busy Tone
~~~~~~~~~~~~~~~
This audible signal is indicated by low tone on the sleeve of trunk
jacks at cord switchboards.  Absense of the tone tells the operator that
there is at least one idle trunk in a group.

Group Busy Tone is a steady Low Tone.


Vacant Position Tone
~~~~~~~~~~~~~~~~~~~~
Low tone is applied to all straightforward trunks terminating in a
vacated position in manual offices.

Vacant Position Tone is a steady Low Tone.


Dial Off-Normal Tone
~~~~~~~~~~~~~~~~~~~~
Low tone is returned to an operator after he/she has completed a call
into a step-by-step office and after the calling party has answered to
remind him/her to restore the dial key.

Dial Off-Normal Tone is a steady Low Tone.


Permanent Signal
~~~~~~~~~~~~~~~~
A customer line, not in use, which exhibits a steady off-hook condition
is routed to a permanent signal trunk.  High tone, superimposed on
battery, is supplied through a resistance lamp to the ring of the trunk.
The tone is used to inform an operator or other employee making a
verification test that the line is temporarily out of service.  An
intermittent ground may also be applied to the ring of the telephone
systems left in the hold condition.  Typical reasons for the line
condition are:

 (a) No dialing within the allowed waiting interval.
 (b) A handset is off-hook.
 (c) Low insulation resistance or other line trouble.

In some offices, if three or more digits are dialed but not a complete
telephone number or code, the call is released and dial tone is
returned.

Permanent Signal is a steady High Tone.


Warning Tone
~~~~~~~~~~~~
High tone warns an operator that the circuit he/she is connected to is
not in condition for normal operation.  Examples:

 (1) An operator at an Automatic Display Call Indicator position
     plugs in the wrong jack.
 (2) An operator at a sender monitor position plugs into a
     sender supervisory jack while the sender is under test.

Warning Tone is a steady High Tone.


Trouble Tone
~~~~~~~~~~~~
Low tone applied by an operator or test person at a B position in a
manual office to the jack sleeve of a line or trunk in a calling
multiple tells other operators the line or trunk is in trouble (also
called plugging up codr tone).

Trouble Tone is a steady Low Tone.


Service Observing Tone
~~~~~~~~~~~~~~~~~~~~~~
This tone indicated that the trunk to which it is applied is being
service-observed.

Service Observing Tone is a steady 135 Hz.


Proceed to Send Tone (International Direct Distance Dialing)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This tone informs the operator that an overseas sender has been siezed
and the address information (KP-CC-CC-ST) should be transmitted.

Proceed to Send Tone is a steady 480 Hz at -22 dBm0.


Centralized Intercept Bureau Order Tone
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This tone tells the centralized intercept bureau operator that a call
has reached the position.

Centralized Intercept Bureau Order Tone is a .5 second burst of 1850 Hz
at -17 dBm0.


ONI Order Tone
~~~~~~~~~~~~~~
This tone tells the ONI operator that a call has reached the position.

ONI Order Tone is 700 Hz and 1100 Hz at -25 dBm for .095 to .25 seconds.


------------------------------------------------------------------------
---

C-28. What is the voltage used to ring a telephone?

According to AT&T, the ringing signal is an 88v 20Hz A.C. signal
superimposed on 48v nominal D.C. supervisory voltage.  However, the
actual rining signal used can and does vary greatly from one location to
another.  The frequency of the AC signal is normally between 15 and
70Hz. The interval between ringing signals is normally four seconds.


------------------------------------------------------------------------
---

C-29. What are all of the * (LASS) codes?

Local Area Signalling Services (LASS) and Custom Calling Feature
Control Codes:

Service                     Tone    Pulse/rotary   Notes
------------------------------------------------------------------------
--
Assistance/Police           *12         n/a        [1]
Cancel forwarding           *30         n/a        [C1]
Automatic Forwarding        *31         n/a        [C1]
Notify                      *32         n/a        [C1] [2]
Intercom Ring 1 (..)        *51         1151       [3]
Intercom Ring 2 (.._)       *52         1152       [3]
Intercom Ring 3 (._.)       *53         1153       [3]
Extension Hold              *54         1154       [3]
Customer Originated Trace   *57         1157
Selective Call Rejection    *60         1160       (or Call Screen)
Selective Distinct Alert    *61         1161
Selective Call Acceptance   *62         1162
Selective Call Forwarding   *63         1163
ICLID Activation            *65         1165
Call Return (outgoing)      *66         1166
Number Display Blocking     *67         1167       [4]
Computer Access Restriction *68         1168
Call Return (incoming)      *69         1169
Call Waiting disable        *70         1170       [4]
No Answer Call Transfer     *71         1171
Usage Sensitive 3 way call  *71         1171
Call Forwarding: start      *72 or 72#  1172
Call Forwarding: cancel     *73 or 73#  1173
Speed Calling (8 numbers)   *74 or 74#  1174
Speed Calling (30 numbers)  *75 or 75#  1175
Anonymous Call Rejection    *77         1177       [5] [M: *58]
Call Screen Disable         *80         1180   (or Call Screen) [M: *50]
Selective Distinct Disable  *81         1181       [M: *51]
Select. Acceptance Disable  *82         1182       [4] [7]
Select. Forwarding Disable  *83         1183       [M: *53]
ICLID Disable               *85         1185
Call Return (cancel out)    *86         1186       [6] [M: *56]
Anon. Call Reject (cancel)  *87         1187       [5] [M: *68]
Call Return (cancel in)     *89         1189       [6] [M: *59]

Notes:

[C1]     - Means code used for Cellular One service
[1]      - for cellular in Pittsburgh, PA A/C 412 in some areas
[2]      - indicates that you are not local and maybe how to reach you
[3]      - found in Pac Bell territory; Intercom ring causes a
    distinctive ring to be generated on the current line; Hold
    keeps a call connected until another extension is picked up
[4]      - applied once before each call
[5]      - A.C.R. blocks calls from those who blocked Caller ID
    (used in C&P territory, for instance)
[6]      - cancels further return attempts
[7]      - *82 (1182) has been mandated to be the nationwide code for
    "Send CLID info regardless of the default setting on this
    phone line."
[M: *xx] - alternate code used for MLVP (multi-line variety package)
    by Bellcore. It goes by different names in different RBOCs.
    In Bellsouth it is called Prestige. It is an arrangement of
    ESSEX like features for single or small multiple line groups.

    The reason for different codes for some features in MLVP is
    that call-pickup is *8 in MLVP so all *8x codes are
    reassigned *5x

These appear to be standard, but may be changed locally

Under GTE, some LASS/CLASS tones may be changed from *NN to NN#.  Under
pulse, GTD5 allows either NN<pause> or 11NN, but with 11NN it may
conflict with a test number.

At one time these were called CLASS Codes, for Custom Local Area
Signalling Services.


------------------------------------------------------------------------
---

C-30. What frequencies do cordless phones operate on?

Here are the frequencies for the first generation 46/49mhz phones.

Channel    Handset Transmit    Base Transmit
-------    ----------------    -------------
   1          49.670mhz          46.610mhz
   2          49.845             46.630
   3          49.860             46.670
   4          49.770             46.710
   5          49.875             46.730
   6          49.830             46.770
   7          49.890             46.830
   8          49.930             46.870
   9          49.990             46.930
  10          49.970             46.970


The new "900mhz" cordless phones have been allocated the frequencies
between 902-228MHz, with channel spacing between 30-100KHz.

Following are some examples of the frequencies used by phones
currently on the market.

----------------------------------------------------------------
Panasonic KX-T9000 (60 Channels)
base     902.100 - 903.870 Base frequencies (30Khz spacing)
handset  926.100 - 927.870 Handset frequencies
CH   BASE    HANDSET    CH   BASE    HANDSET    CH   BASE   HANDSET
--  -------  -------    --  -------  -------    --  ------- -------
01  902.100  926.100    11  902.400  926.400    21  902.700 926.700
02  902.130  926.130    12  902.430  926.430    22  902.730 926.730
03  902.160  926.160    13  902.460  926.460    23  902.760 926.760
04  902.190  926.190    14  902.490  926.490    24  902.790 926.790
05  902.220  926.220    15  902.520  926.520    25  902.820 926.820
06  902.250  926.250    16  902.550  926.550    26  902.850 926.850
07  902.280  926.280    17  902.580  926.580    27  902.880 926.880
08  902.310  926.310    18  902.610  926.610    28  902.910 926.910
09  902.340  926.340    19  902.640  926.640    29  902.940 926.940
10  902.370  926.370    20  902.670  926.670    30  902.970 926.970

31  903.000  927.000    41  903.300  927.300    51  903.600 927.600
32  903.030  927.030    42  903.330  927.330    52  903.630 927.630
33  903.060  927.060    43  903.360  927.360    53  903.660 927.660
34  903.090  927.090    44  903.390  927.390    54  903.690 927.690
35  903.120  927.120    45  903.420  927.420    55  903.720 927.720
36  903.150  927.150    46  903.450  927.450    56  903.750 927.750
37  903.180  927.180    47  903.480  927.480    57  903.780 927.780
38  903.210  927.210    48  903.510  927.510    58  903.810 927.810
39  903.240  927.240    49  903.540  927.540    59  903.840 927.840
40  903.270  927.270    50  903.570  927.570    60  903.870 927.870

------------------------------------------------------------

V-TECH TROPEZ DX900 (20 CHANNELS)
905.6 - 907.5   TRANSPONDER (BASE) FREQUENCIES (100 KHZ SPACING)
925.5 - 927.4   HANDSET FREQUENCIES

CH   BASE    HANDSET    CH   BASE    HANDSET    CH   BASE   HANDSET
--  -------  -------    --  -------  -------    --  ------- -------
01  905.600  925.500    08  906.300  926.200    15  907.000 926.900
02  905.700  925.600    09  906.400  926.300    16  907.100 927.000
03  905.800  925.700    10  906.500  926.400    17  907.200 927.100
04  905.900  925.800    11  906.600  926.500    18  907.300 927.200
05  906.000  925.900    12  906.700  926.600    19  907.400 927.300
06  906.100  926.000    13  906.800  926.700    20  907.500 927.400
07  906.200  926.100    14  906.900  926.800

------------------------------------------------------------
Other 900mhz cordless phones
AT&T #9120  - - - - - 902.0 - 905.0 & 925.0 - 928.0 MHZ
OTRON CORP. #CP-1000  902.1 - 903.9 & 926.1 - 927.9 MHZ
SAMSUNG #SP-R912- - - 903.0         &         927.0 MHZ

------------------------------------------------------------


------------------------------------------------------------------------
---

C-31. What is Caller-ID?

This FAQ answer is stolen from Rockwell:

Calling Number Delivery (CND), better known as Caller ID, is a
telephone service intended for residential and small business
customers.  It allows the called Customer Premises Equipment (CPE) to
receive a calling party's directory number and the date and time of
the call during the first 4 second silent interval in the ringing
cycle.

Parameters
~~~~~~~~~~
The data signalling interface has the following characteristics:

 Link Type:                              2-wire, simplex
 Transmission Scheme:            Analog, phase-coherent FSK
 Logical 1 (mark)                        1200 +/- 12 Hz
 Logical 0 (space)                       2200 +/- 22 Hz
 Transmission Rate:                      1200 bps
 Transmission Level:               13.5 +/- dBm into 900 ohm load


Protocol
~~~~~~~~
The protocol uses 8-bit data words (bytes), each bounded by a start
bit and a stop bit.  The CND message uses the Single Data Message
format shown below.

| Channel  |  Carrier  |  Message  |  Message  |  Data       | Checksum
|
| Seizure  |  Signal   |  Type     |  Length   |  Word(s)    | Word
|
| Signal   |           |  Word     |  Word     |             |
|

Channel Seizure Signal
~~~~~~~~~~~~~~~~~~~~~~
The channel seizure is 30 continuous bytes of 55h (01010101) providing
a detectable alternating function to the CPE (i.e. the modem data
pump).

Carrier Signal
~~~~~~~~~~~~~~
The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to
condition the receiver for data.

Message Type Word
~~~~~~~~~~~~~~~~~
The message type word indicates the service and capability associated
with the data message.  The message type word for CND is 04h
(00000100).

Message Length Word
~~~~~~~~~~~~~~~~~~~
The message length word specifies the total number of data words to
follow.

Data Words
~~~~~~~~~~
The data words are encoded in ASCII and represent the following
information:

o  The first two words represent the month
o  The next two words represent the day of the month
o  The next two words represent the hour in local military time
o  The next two words represent the minute after the hour
o  The calling party's directory number is represented by the
   remaining  words in the data word field

If the calling party's directory number is not available to the
terminating central office, the data word field contains an ASCII "O".
If the calling party invokes the privacy capability, the data word
field contains an ASCII "P".

Checksum Word
~~~~~~~~~~~~~
The Checksum Word contains the twos complement of the modulo 256 sum
of the other words in the data message (i.e., message type, message
length, and data words).  The receiving equipment may calculate the
modulo 256 sum of the received words and add this sum to the received
checksum word.  A result of zero generally indicates that the message
was correctly received.  Message retransmission is not supported.

Example CNS Single Data Message
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An example of a received CND message, beginning with the message type
word, follows:

04 12 30 39 33 30 31 32 32 34 36 30 39 35 35 35 31 32 31 32 51

04h=  Calling number delivery information code (message type word)
12h=  18 decimal; Number of data words (date,time, and directory
      number words)
ASCII 30,39= 09; September
ASCII 33,30= 30; 30th day
ASCII 31,32= 12; 12:00 PM
ASCII 32,34= 24; 24 minutes (i.e., 12:24 PM)
ASCII 36,30,39,35,35,35,31,32,31,32= (609) 555-1212; calling
      party's directory number
51h=  Checksum Word

Data Access Arrangement (DAA) Requirements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To receive CND information, the modem monitors the phone line between
the first and second ring bursts without causing the DAA to go off
hook in the conventional sense, which would inhibit the transmission
of CND by the local central office.  A simple modification to an
existing DAA circuit easily accomplishes the task.

Modem Requirements
~~~~~~~~~~~~~~~~~~
Although the data signalling interface parameters match those of a
Bell 202 modem, the receiving CPE need not be a Bell 202 modem.  A
V.23 1200 bps modem receiver may be used to demodulate the Bell 202
signal.  The ring indicate bit (RI) may be used on a modem to indicate
when to monitor the phone line for CND information.  After the RI bit
sets, indicating the first ring burst, the host waits for the RI bit
to reset.  The host then configures the modem to monitor the phone
line for CND information.

Signalling
~~~~~~~~~~
According to Bellcore specifications, CND signalling starts as early
as 300 mS after the first ring burst and ends at least 475 mS before
the second ring burst

Applications
~~~~~~~~~~~~
Once CND information is received the user may process the information
in a number of ways.

1.  The date, time, and calling party's directory number can be
    displayed.

2.  Using a look-up table, the calling party's directory number can be
    correlated with his or her name and the name displayed.

3.  CND information can also be used in additional ways such as for:

    a.  Bulletin board applications
    b.  Black-listing applications
    c.  Keeping logs of system user calls, or
    d.  Implementing a telemarketing data base

References
~~~~~~~~~~
For more information on Calling Number Delivery (CND), refer to
Bellcore publications TR-TSY-000030 and TR-TSY-000031.

To obtain Bellcore documents contact:

 Bellcore Customer Service
 60 New England Avenue, Room 1B252
 Piscataway, NJ   08834-4196
 (908) 699-5800


------------------------------------------------------------------------
---

C-32. How do I block Caller-ID?

Always test as much as possible before relying on any method of blocking
Caller-ID.  Some of these methods work in some areas, but not in others.

Dial *67 before you dial the number.  (141 in the United Kingdom)
Dial your local TelCo and have them add Caller-ID block to your line.
Dial the 0 Operator and have him or her place the call for you.
Dial the call using a pre-paid phone card.
Dial through Security Consultants at (900)PREVENT for U.S. calls
     ($1.99/minute) or (900)STONEWALL for international calls
($3.99/minute).
Dial from a pay phone.  :-)


------------------------------------------------------------------------
---

C-33. How do I defeat Caller-ID blocking?

Forward your phone line to a friend who lives in another LATA.  When
he receives the anonymous phone call, have him use *69 Call Return
to dial to offending party back.  As he is now placing a long
distance phone call, the telephone number of the anonymous caller
will show up on your friends phone bill at the end of the month.

A variation of this system is available in areas where the local
phone company offers per-call billing (as opposed to unlimited
flat rate local calling) and where the local phone company issues
itemized bills on those local phone calls.  In those areas, you
can switch your phone line to itemized local calling, *69 Call Return
the anonymous telephone call, and read the anonymous callers telephone
number at the end of the month.

If you are particularly anxious, you can often request your toll
records from your local telephone company without waiting for your
final bill.


------------------------------------------------------------------------
---

C-34. What is a PBX?

A PBX (Private Branch Exchange) is a small telephone switch owned by a
company or organization.  These organizations purchase PBX's to reduce
the total number of telephone lines they need to lease from the
telephone company.  Without a PBX, a company will need to lease one
telephone line for every employee with a telephone.

[Note from Dan Mellem: Technically, a phone switch is known as a PABX
(automatic) unless the inside people must call the operator to get an
outside line. H.]

With a PBX, every employees telephone line is wired to the PBX.  When an
employee takes the receiver off hook (i.e. picks up the telephone) and
dials the outside access code (usually 9), the PBX connect the employee
to an outside line (often, though somewhat incorrectly, referred to as a
trunk).  With a PBX, the company only needs to lease as many lines from
the telephone company as the maximum number of employees that will be
making outside calls at one time.  This is usually around 10% of the
number of extensions.

Two common PBX systems are AT&T's Definity series (also known as the
System 75 and Sytem 85) and Northern Telecom's Meridian series.  Other
manufacturers include ROLM, Siemens, NEC, and Mitel.


------------------------------------------------------------------------
---

C-35. What is a VMB?

A VMB (Voice Mail Box) is a computer that acts as an answering machine
for hundreds or thousands of users.  Each user will have their own Voice
Mail Box on the system.  Each mail box will have a box number and a pass
code.

Without a passcode, you will usually be able to leave messages to
users on the VMB system.  With a passcode, you can read messages and
administer a mailbox.  Often, mailboxes will exist that were created
by default or are no longer used.  These mailboxes may be taken over
by guessing their passcode.  Often the passcode will be the mailbox
number or a common number such as 1234.

Two common VMB systems are AT&T's Audix system and Northern Telecom's
Meridian Mail.


------------------------------------------------------------------------
---

C-36. What are the ABCD tones for?

The ABCD tones are simply additional DTFM tones that may be used in any
way the standard (0-9) tones are used.  The ABCD tones are used in the
U.S. military telephone network (AutoVon), in some Automatic Call
Distributor (ACD) systems, for control messages in some PBX systems, and
in some amateur radio auto-patches.

In the AutoVon network, special telephones are equipped with ABCD keys.
The ABCD keys are defined as such:

A - Flash
B - Flash override priority
C - Priority communication
D - Priority override

Using a built-in maintenance mode of the Automatic Call Distributor
(ACD) systems once used by Directory Assistance operators, you could
connect two callers together.

The purpose of the Silver Box is to create the ABCD tones.

See also "What are the DTMF Frequencies?"


------------------------------------------------------------------------
---

C-37. What are the International Direct Numbers?

The numbers are used so that you may connect to an operator from a
foreign telephone network, without incurring long distance charges.
These numbers may be useful in blue boxing, as many countries still have
older switching equipment in use.

  Australia         (800)682-2878
  Austria           (800)624-0043
  Belgium           (800)472-0032
  Belize            (800)235-1154
  Bermuda           (800)232-2067
  Brazil            (800)344-1055
  British VI        (800)278-6585
  Cayman            (800)852-3653
  Chile             (800)552-0056
  China (Shanghai)  (800)532-4462
  Costa Rica        (800)252-5114
  Denmark           (800)762-0045
  El Salvador       (800)422-2425
  Finland           (800)232-0358
  France            (800)537-2623
  Germany           (800)292-0049
  Greece            (800)443-5527
  Guam              (800)367-4826
  HK                (800)992-2323
  Hungary           (800)352-9469
  Indonesia         (800)242-4757
  Ireland           (800)562-6262
  Italy             (800)543-7662
  Japan             (800)543-0051
  Korea             (800)822-8256
  Macau             (800)622-2821
  Malaysia          (800)772-7369
  Netherlands       (800)432-0031
  Norway            (800)292-0047
  New Zealand       (800)248-0064
  Panama            (800)872-6106
  Portugal          (800)822-2776
  Philippines       (800)336-7445
  Singapore         (800)822-6588
  Spain             (800)247-7246
  Sweden            (800)345-0046
  Taiwan            (800)626-0979
  Thailand          (800)342-0066
  Turkey            (800)828-2646
  UK                (800)445-5667
  Uruguay           (800)245-8411
  Yugoslavia        (800)367-9842 (Belgrade)
    367-9841 (Zagreb)
  USA from outside  (800)874-4000  Ext. 107


------------------------------------------------------------------------
---

C-38. What are some telephone switches?

  SWITCH    VENDOR   TYPE     DESCRIPTION
  --------  -------  -------  -----------------------------------
  1AES      AT&T     Analog   No. 1A ESS
  1ES       AT&T     Analog   No. 1  ESS
  2BES      AT&T     Analog   No. 2B ESS
  2ES       AT&T     Analog   No. 2  ESS
  3ES       AT&T     Analog   No. 3  ESS
  3XB       AT&T     E/M      No. 3  Cross-Bar
  4ES       AT&T     Digital  No. 4  ESS
  5AXB      AT&T     E/M      No. 5A Cross-Bar
  5ES       AT&T     Digital  No. 5  ESS
  5ORM      AT&T     Digital  Optical Remote Module
  5RSM      AT&T     Digital  Remote Switching Module
  5XB       AT&T     E/M      No. 5 Cross-Bar
  AXE10     Ericsson Digital  Stand Alone or Host
  AXRSS     Ericsson Digital  Remote
  DGTL               Digital  Generic Digital Switch
  DMS1/200  NTI      Digital  DMS 100/200
  DMS10     NTI      Digital  DMS 10
  DMS100    NTI      Digital  DMS 100
  DMS200    NTI      Digital  DMS 200
  DPN       NTI      Packet   Packet Switch
  EDX       Siemens  Packet   Packet Switch
  NC23      NEC      E/M      NEC Cross-Bar
  NEAX61E   NEC      Digital  NEC switch
  RLCM      NTI      Digital  Remote Line Conc Module
  RLCM-10   NTI      Digital  Remote Line Conc Module
  RLM       NTI      Digital  Remote Line Module
  RSC       NTI      Digital  Remote Switching Center
  RSCI      NTI      Digital  ISDN RSC
  RSLE      NTI      Digital  Remote Subscr Line Equip
  RSM       AT&T     Digital  Remote Switching System
  RSS       AT&T     Analog   Remote Switching System
  RSU                Digital  Generic Remote Switching Unit
  SXS       AT&T     E/M      Step by Step







