| #hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony |
| Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous |
When a coin is inserted into a payphone, the payphone emits a set of tones to ACTS (Automated Coin Toll System). Red boxes work by fooling ACTS into believing you have actually put money into the phone. The red box simply plays the ACTS tones into the telephone microphone. ACTS hears those tones, and allows you to place your call. The actual tones are:
| Nickel: | 35-160ms 1700hz & 2200hz tone burst, followed by 240ms of silence. |
| Dime: | Two 35-160ms 1700hz & 2200hz bursts, with a spacing of 20-110ms between the bursts, followed by 165 ms of silence. |
| Quarter: | Five 1700hz & 2200hz bursts, with the first and last being 20-100ms in length, and the second through fourth being 20-60ms in length. The spacing between the first and second bursts is 20-110ms, while the spacing between the following bursts is 20-60ms. The tones are followed by 60ms of silence. |
Canada uses a variant of ACTSD called N-ACTS. N-ACTS uses different tones than ACTS. In Canada, the tones to use are:
| Nickel: | 2200hz | 0.060s on |
| Dime: | 2200hz | 0.060s on, 0.060s off, twice repeating |
| Quarter: | 2200hz | 33ms on, 33ms off, 5 times repeating |
Red boxes are commonly manufactured from Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components.
To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open the dialer and replace the crystal with a new one. The purpose of the new crystal is to cause the * button on your tone dialer to create a 1700hz and 2200hz tone instead of the original 941hz and 1209hz tones. The exact value of the replacement crystal should be 6.466806 to create a perfect 1700hz tone and 6.513698 to create a perfect 2200hz tone. A crystal close to those values will create a tone that easily falls within the loose tolerances of ACTS. The most popular choice is the 6.5536Mhz crystal, because it is the easiest to procure. The old crystal is the large shiny metal component labeled "3.579545Mhz." When you are finished replacing the crystal, program the P1 button with five *'s. That will simulate a quarter tone each time you press P1.
You can record the ACTS tones and play them back into the telephone. This is what is done with the Hallmark greeting card. Alternatively, you can build your own circuit using any voice recording chip, such as Radio Shack catalog number 276-1325.
Your best bet is a local electronics store. Radio Shack sells them, but they are overpriced and the store must order them in. This takes approximately two weeks. In addition, many Radio Shack employees do not know that this can be done.
Or, you could order the crystal mail order. This introduces Shipping and Handling charges, which are usually much greater than the price of the crystal. It's best to get several people together to share the S&H cost. Or, buy five or six yourself and sell them later. Some of the places you can order crystals are:
Digi-Key
701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
(800)344-4539
Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND
JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
(800)538-5000
Part Number: 6.5536MHZ
Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
(800)241-8742
Part Number: 10068625
Alltronics
2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057
Mouser
(800)346-6873
Part Number: 332-1066
Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b
Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: 1-800-824-3432
Part Number: CR6.5
Red Boxes will work on telco owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones).
Red boxes work by fooling ACTS (Automated Coin Toll System) into believing you have put money into the pay phone. ACTS is the telephone company software responsible for saying "Please deposit XX cents" and listening for the coins being deposited.
COCOT's do not use ACTS. On a COCOT, the pay phone itself is responsible for determining what coins have been inserted.
Payphones do not use ACTS for local calls. To use your red box for local calls, you have to fool ACTS into getting involved in the call.
One way to do this, in some areas, is by dialing an Equal Access Code before the number you are dialing. For example, to use 10288 (an Equal Access Code belonging to AT&T), dial 10288-xxx-xxxx. This makes your call a long distance call, and brings ACTS into the picture. There are quite a large number of Equal Access Codes available in most geographic regions.
In other areas, you can call Directory Assistance and ask for the number of the person you are trying to reach. The operator will give you the number and then you will hear a message similar to "Your call can be completed automatically for an additional 35 cents." When this happens, you can then use ACTS tones.
Another operator scam involves calling (800) long distance operators, asking them to connect you, and then playing the ACTS tones. This will get ACTS involved, even on COCOT's!
I have heard that in some areas you can dial local calls as if they were long distance. For example, to dial 345-4587 to would dial 303-345-4587. This does not work on payphones in my area.
Blue boxes use a 2600hz tone to size control of telephone switches that use in-band signalling. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the tones provided by the Blue Box.
This FAQ answer is excerpted from a message posted to Usenet by Marauder of the Legion of Doom:
Somewhere along the line I have seen reference to something similar to "Because of ESS Blue boxing is impossible". This is incorrect. When I lived in Connecticut I was able to blue box under Step by Step, #1AESS, and DMS-100. The reason is simple, even though I was initiating my call to an 800 number from a different exchange (Class 5 office, aka Central Office) in each case, when the 800 call was routed to the toll network it would route through the New Haven #5 Crossbar toll Tandem office. It just so happens that the trunks between the class 5 (CO's) and the class 4 (toll office, in this case New Haven #5 Xbar), utilized in-band (MF) signalling, so regardless of what I dialed, as long as it was an Inter-Lata call, my call would route through this particular set of trunks, and I could Blue box until I was blue in the face. The originating Central Offices switch (SXS/ESS/Etc..) had little effect on my ability to box at all. While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). Unfortunately for the boxer 99% of the Toll Completion centers communicate using CCIS links, This spells disaster for the blue boxer since most of you must dial out of your local area to find trunks that utilize MF signalling, you inevitably cross a portion of the network that is CCIS equipped, you find an exchange that you blow 2600hz at, you are rewarded with a nice "winkstart", and no matter what MF tones you send at it, you meet with a re-order. This is because as soon as you seized the trunk (your application of 2600hz), your Originating Toll Office sees this as a loss of supervision at the destination, and Mutes any further audio from being passed to the destination (ie: your waiting trunk!). You meet with a reorder because the waiting trunk never "hears" any of the MF tones you are sending, and it times out. So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. (Hint: Take a close look at WATS extenders).
A Black Box is a resistor (and often capacitor in parallel) placed in series across your phone line to cause the phone company equipment to be unable to detect that you have answered your telephone. People who call you will then not be billed for the telephone call. Black boxes do not work under ESS.
| Acrylic | Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems |
| Aqua | Drain the voltage of the FBI lock-in-trace/trap-trace |
| Beige | Lineman's hand set | Black | Allows the calling party to not be billed for the call placed |
| Blast | Phone microphone amplifier |
| Blotto | Supposedly shorts every phone out in the immediate area | Blue | Emulate a true operator by seizing a trunk with a 2600hz tone |
| Brown | Create a party line from 2 phone lines |
| Bud | Tap into your neighbors phone line |
| Chartreuse | Use the electricity from your phone line |
| Cheese | Connect two phones to create a diverter |
| Chrome | Manipulate Traffic Signals by Remote Control | Clear | A telephone pickup coil and a small amp used to make free calls on Fortress Phones |
| Color | Line activated telephone recorder |
| Copper | Cause crosstalk interference on an extender |
| Crimson | Hold button |
| Dark | Re-route outgoing or incoming calls to another phone |
| Dayglo | Connect to your neighbors phone line |
| Diverter | Re-route outgoing or incoming calls to another phone |
| DLOC | Create a party line from 2 phone lines |
| Gold | Dialout router |
| Green | Emulate the Coin Collect, Coin Return, and Ringback tones |
| Infinity | Remotely activated phone tap |
| Jack | Touch-Tone key pad |
| Light | In-use light |
| Lunch | AM transmitter |
| Magenta | Connect a remote phone line to another remote phone line |
| Mauve | Phone tap without cutting into a line |
| Neon | External microphone |
| Noise | Create line noise |
| Olive | External ringer |
| Party | Create a party line from 2 phone lines |
| Pearl | Tone generator |
| Pink | Create a party line from 2 phone lines |
| Purple | Telephone hold button |
| Rainbow | Kill a trace by putting 120v into the phone line (joke) |
| Razz | Tap into your neighbors phone | Red | Make free phone calls from pay phones by generating quarter tones |
| Rock | Add music to your phone line |
| Scarlet | Cause a neighbors phone line to have poor reception |
| Silver | Create the DTMF tones for A, B, C and D |
| Static | Keep the voltage on a phone line high |
| Switch | Add hold, indicator lights, conferencing, etc.. |
| Tan | Line activated telephone recorder | Tron | Reverse the phase of power to your house, causing your electric meter to run slower |
| TV Cable | "See" sound waves on your TV | Urine | Create a capacitative disturbance between the ring and tip wires in another's telephone headset |
| Violet | Keep a payphone from hanging up |
| White | Portable DTMF keypad | Yellow | Add an extension phone |
An ANAC (Automatic Number Announcement Circuit) number is a telephone number that plays back the number of the telephone that called it. ANAC numbers are convenient if you want to know the telephone number of a pair of wires.
How to find your ANAC number:
Look up your NPA (Area Code) and try the number listed for it. If that fails, try 1 plus the number listed for it. If that fails, try the common numbers like 311, 958 and 200-222-2222. If you find the ANAC number for your area, please let us know.
Note that many times the ANAC number will vary for different switches in the same city. The geographic naming on the list is NOT intended to be an accurate reference for coverage patterns, it is for convenience only.
Many companies operate 800 number services which will read back to you the number from which you are calling. Many of these require navigating a series of menus to get the phone number you are looking for. Please use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC numbers.
(800)425-6256: VRS Billing Systems/Integretel
(800)4BLOCKME
(800)487-9240: Another line blocking service
A non-800 ANAC that works nationwide is 404-988-9664. The one catch with this number is that it must be dialed with the AT&T Carrier Access Code 10732. Use of this number does not appear to be billed.
NPA ANAC number Approximate Geographic area USA: 201 958 Hackensack/Jersey City/Newark/Paterson, NJ 202 811 District of Columbia 203 970 CT 205 300-222-2222 Birmingham, AL 205 300-555-5555 Many small towns in AL 205 300-648-1111 Dora, AL 205 300-765-4321 Bessemer, AL 205 300-798-1111 Forestdale, AL 205 300-833-3333 Birmingham 205 557-2311 Birmingham, AL 205 811 Pell City/Cropwell/Lincoln, AL 205 841-1111 Tarrant, AL 205 908-222-2222 Birmingham, AL 206 411 WA (Not US West) 207 200-222-2222 ME 207 958 ME 209 830-2121 Stockton, CA 209 211-9779 Stockton, CA 210 830 Brownsville/Laredo/San Antonio, TX 210 951 Brownsville/Laredo/San Antonio, TX (GTE) 212 958 Manhattan, NY 213 114 Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 switches) 213 1223 Los Angeles, CA (GTE 1AESS and 5ESS switches) 213 211-2345 Los Angeles, CA (English response) 213 211-2346 Los Angeles, CA (DTMF response) 213 760-2??? Los Angeles, CA (DMS switches) 213 61056 Los Angeles, CA 214 570 Dallas, TX 214 790 Dallas, TX (GTE) 214 970 Dallas, TX (GTE) 214 970-222-2222 Dallas, TX (Southwestern Bell) 214 970-x11-1111 Dallas, TX (Southwestern Bell) 215 410-xxxx Philadelphia, PA 215 511 Philadelphia, PA 215 958 Philadelphia, PA 216 200-XXXX Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH 217 200-xxx-xxxx Champaign-Urbana/Springfield, IL 219 550 Gary/Hammond/Michigan City/Southbend, IN 219 559 Gary/Hammond/Michigan City/Southbend, IN 301 2002006969 Hagerstown/Rockville, MD 301 958-9968 Hagerstown/Rockville, MD 303 958 Aspen/Boulder/Denver/Durango/Grand Junction/Steamboat Springs, CO 305 200-555-1212 Ft. Lauderdale/Key West/Miami, FL 305 200200200200200 Ft. Lauderdale/Key West/Miami, FL 305 780-2411 Ft. Lauderdale/Key West/Miami, FL 310 114 Long Beach, CA (On many GTE switches) 310 1223 Long Beach, CA (Some 1AESS switches) 310 211-2345 Long Beach, CA (English response) 310 211-2346 Long Beach, CA (DTMF response) 312 200 Chicago, IL 312 290 Chicago, IL 312 1-200-8825 Chicago, IL (Last four change rapidly) 312 1-200-555-1212 Chicago, IL 313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI 313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI 313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI 313 200200200200200 Ann Arbor/Dearborn/Detroit, MI 313 311 Ann Arbor/Dearborn/Detroit, MI 313 958-1111 Ann Arbor/Dearborn/Detroit, MI (GTE) 314 410-xxxx# Columbia/Jefferson City/St.Louis, MO 315 953 Syracuse/Utica, NY 315 958 Syracuse/Utica, NY 315 998 Syracuse/Utica, NY 317 310-222-2222 Indianapolis/Kokomo, IN 317 559-222-2222 Indianapolis/Kokomo, IN 317 743-1218 Indianapolis/Kokomo, IN 334 5572411 Montgomery, AL 334 5572311 Montgomery, AL 401 200-200-4444 RI 401 222-2222 RI 401 2002006969 RI 402 311 Lincoln, NE 404 311 Atlanta, GA 404 780-2311 Atlanta, GA 404 940-xxx-xxxx Atlanta, GA 404 990 Atlanta, GA 405 890-7777777 Enid/Oklahoma City, OK 405 897 Enid/Oklahoma City, OK 407 200-222-2222 Orlando/West Palm Beach, FL (Bell South) 407 520-3111 Orlando/West Palm Beach, FL (United) 408 300-xxx-xxxx San Jose, CA 408 760 San Jose, CA 408 940 San Jose, CA 409 951 Beaumont/Galveston, TX 409 970-xxxx Beaumont/Galveston, TX 410 200-6969 Annapolis/Baltimore, MD 410 200-200-6969 Annapolis/Baltimore, MD 410 200-555-1212 Annapolis/Baltimore, MD 410 811 Annapolis/Baltimore, MD 412 711-6633 Pittsburgh, PA 412 711-4411 Pittsburgh, PA 412 999-xxxx Pittsburgh, PA 413 958 Pittsfield/Springfield, MA 413 200-555-5555 Pittsfield/Springfield, MA 414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI 415 200-555-1212 San Francisco, CA 415 211-2111 San Francisco, CA 415 2222 San Francisco, CA 415 640 San Francisco, CA 415 760-2878 San Francisco, CA 415 7600-2222 San Francisco, CA 419 311 Toledo, OH 423 200-200-200 Chatanooga, Johnson City, Knoxville, TN 501 511 AR 501 721-xxx-xxxx AR 502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY 502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY 503 611 Portland, OR 503 999 Portland, OR (GTE) 504 99882233 Baton Rouge/New Orleans, LA 504 201-269-1111 Baton Rouge/New Orleans, LA 504 998 Baton Rouge/New Orleans, LA 504 99851-0000000000 Baton Rouge/New Orleans, LA 508 958 Fall River/New Bedford/Worchester, MA 508 200-222-1234 Fall River/New Bedford/Worchester, MA 508 200-222-2222 Fall River/New Bedford/Worchester, MA 508 26011 Fall River/New Bedford/Worchester, MA 509 560 Spokane/Walla Walla/Yakima, WA 510 760-1111 Oakland, CA 512 830 Austin/Corpus Christi, TX 512 970-xxxx Austin/Corpus Christi, TX 513 380-55555555 Cincinnati/Dayton, OH 515 5463 Des Moines, IA 515 811 Des Moines, IA 516 958 Hempstead/Long Island, NY 516 968 Hempstead/Long Island, NY 517 200-222-2222 Bay City/Jackson/Lansing, MI 517 200200200200200 Bay City/Jackson/Lansing, MI 517 958-1111 Bay City/Jackson/Lansing, MI (GTE) 518 511 Albany/Schenectady/Troy, NY 518 997 Albany/Schenectady/Troy, NY 518 998 Albany/Schenectady/Troy, NY 540 211 Roanoke, VA (GTE) 540 311 Roanoke, VA (GTE) 541 200 Bend, OR 573 511 602 958-3474 Phoenix, AZ 601 200-222-2222 MS 603 200-2222 NH 603 200-222-2222 NH 606 997-555-1212 Ashland/Winchester, KY 606 711 Ashland/Winchester, KY 607 993 Binghamton/Elmira, NY 609 958 Atlantic City/Camden/Trenton/Vineland, NJ 610 958 Allentown/Reading, PA 610 958-4100 Allentown/Reading, PA 612 511 Minneapolis/St.Paul, MN 614 200 Columbus/Steubenville, OH 614 571 Columbus/Steubenville, OH 615 200200200200200 Chatanooga/Knoxville/Nashville, TN 615 2002222222 Chatanooga/Knoxville/Nashville, TN 615 830 Nashville, TN 616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI 616 958-1111 Battle Creek/Grand Rapids/Kalamazoo, MI (GTE) 617 200-222-1234 Boston, MA 617 200-222-2222 Boston, MA 617 200-444-4444 Boston, MA (Woburn, MA) 617 220-2622 Boston, MA 617 958 Boston, MA 618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL 618 930 Alton/Cairo/Mt.Vernon, IL 619 211-2001 San Diego, CA 619 211-2121 San Diego, CA 659 220-2622 Newmarket, NH 703 211 VA 703 511-3636 Culpeper/Orange/Fredericksburg, VA 703 811 Alexandria/Arlington/Roanoke, VA 704 311 Asheville/Charlotte, NC 706 940-xxxx Augusta, GA 707 211-2222 Eureka, CA 707 611 Crescent City, CA 708 1-200-555-1212 Chicago/Elgin, IL 708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly) 708 200-6153 Chicago/Elgin, IL 708 724-9951 Chicago/Elgin, IL 713 380 Houston, TX 713 970-xxxx Houston, TX 713 811 Humble, TX 713 380-5555-5555 Houston, TX 714 114 Anaheim, CA (GTE) 714 211-2121 Anaheim, CA (PacBell) 714 211-2222 Anaheim, CA (Pacbell) 714 211-7777 Anaheim, CA (Pacbell) 716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 717 958 Harrisburg/Scranton/Wilkes-Barre, PA 718 958 Bronx/Brooklyn/Queens/Staten Island, NY 770 780-2311 Marietta/Norcross, GA 770 940-xxx-xxxx Marietta/Norcross, GA 802 2-222-222-2222 Vermont 802 200-222-2222 Vermont 802 1-700-222-2222 Vermont 802 111-2222 Vermont 804 211 Richmond, VA 804 990 Virginia Beach, VA 805 114 Bakersfield/Santa Barbara, CA 805 211-1101 Bakersfield/Santa Barbara, CA 805 211-2345 Bakersfield/Santa Barbara, CA 805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF) 805 830 Bakersfield/Santa Barbara, CA 806 970-xxxx Amarillo/Lubbock, TX 810 200200200200200 Flint/Pontiac/Southfield/Troy, MI 810 311 Pontiac/Southfield/Troy, MI 810 958-1111 Pontiac/Southfield/Troy, MI (GTE) 812 410-555-1212 Evansville, IN 813 311 Ft. Meyers/St. Petersburg/Tampa, FL 815 200-3374 Crystal Lake, IL 815 270-3374 Crystal Lake, IL 815 770-3374 Crystal Lake, IL 815 200-xxx-xxxx La Salle/Rockford, IL 815 290 La Salle/Rockford, IL 817 211 Ft. Worth/Waco, TX 817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell) 817 973-222-11111 Ft. Worth/Waco, TX 818 114 Pasadena, CA (GTE) 818 1223 Pasadena, CA (Some 1AESS switches) (Pac Bell) 818 211-2345 Pasadena, CA (English response) (Pac Bell) 818 211-2346 Pasadena, CA (DTMF response) (Pac Bell) 860 970 CT 901 899-?555 Memphis, TN 903 970-611-1111 Tyler, TX 904 200-222-222 Jackonsville/Pensacola/Tallahasee, FL 904 311 Jackonsville/Pensacola/Tallahasee, FL 904 780-2311 Jackonsville/Pensacola/Tallahasee, FL 906 1-200-222-2222 Marquette/Sault Ste. Marie, MI 906 958-1111 Marquette/Sault Ste. Marie, MI (GTE) 907 811 Anchorage, AK 908 958 New Brunswick, NJ 909 111 Riverside/San Bernardino, CA (GTE) 909 114 Riverside/San Bernardino, CA 910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 912 711 Albany/Savannah, GA 912 780-2311 Albany/Savannah, GA 914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY 915 970-xxxx Abilene/El Paso, TX 916 211-0007 Sacramento, CA (Pac Bell) 916 461 Sacramento, CA (Roseville Telephone) 919 200 Durham, NC 919 711 Durham, NC 919 780-2411 Durham, NC 954 200-555-1212 Ft. Lauderdale, FL 954 200200200200200 Ft. Lauderdale, FL 954 780-2411 Ft. Lauderdale, FL Canada: 204 644-4444 Manitoba 306 115 Saskatchewan 403 311 Alberta, Yukon and N.W. Territory 403 908-222-2222 Alberta, Yukon and N.W. Territory 403 999 Alberta, Yukon and N.W. Territory 416 997-xxxx Toronto, Ontario 416 997-1699 Down Town, Toronto, Ontario 416 997-1699 Riverdale, Toronto, Ontario 416 997-8123 Scarborough, Toronto, Ontario 506 1-555-1313 New Brunswick 514 320-xxxx Montreal, Quebec 514 320-1232 Montreal, Quebec 514 320-1223 Montreal, Quebec 514 320-1233 Montreal, Quebec 519 320-xxxx London, Ontario 604 1116 British Columbia 604 1211 British Columbia 604 211 British Columbia 613 320-2232 Ottawa, Ontario 613 320-5123 Kingston/Belleville/Southeastern Ontario 613 320-5124 Kingston/Belleville/Southeastern Ontario 613 320-9123 Kingston/Belleville/Southeastern Ontario 705 320-4567 North Bay/Saulte Ste. Marie, Ontario 819 320-1112 Quebec Argentina: 5702 Australia: 12722123 United Kingdom: 175 or 17071 Israel: 110
A ringback number is a number that you call that will immediately ring the telephone from which it was called.
In most instances you must call the ringback number, quickly hang up the phone for just a short moment and then let up on the switch, you will then go back off hook and hear a different tone. You may then hang up. You will be called back seconds later. On some systems, you will have to press a button of flash hook again before the final hang up.
An 'x' means insert those numbers from the phone number from which you are calling. A '?' means that the number varies from switch to switch in the area, or changes from time to time. Try all possible combinations.
If the ringback for your NPA is not listed, try common ones such as 114, 951-xxx-xxxx, 954, 957 and 958. Also, try using the numbers listed for other NPA's served by your telephone company.
Note: These geographic areas are for reference purposes only. Ringback numbers may vary from switch to switch within the same city.
| NPA | Ringback number | Approximate Geographic area |
|---|---|---|
| USA: | ||
| 201 | 55?-xxxx | Hackensack/Jersey City/Newark/Paterson, NJ |
| 202 | 958-xxxx | District of Columbia |
| 203 | 99?-xxxx | CT |
| 206 | 571-xxxx | WA |
| 207 | 981-xxxx | ME |
| 208 | 59X-xxxx | ID |
| 208 | 99xxx-xxxx | ID |
| 210 | 211-8849-xxxx | Brownsville/Laredo/San Antonio, TX (GTE) |
| 213 | xxx-xxxx | Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 witches) |
| 213 | 117-xxxx | Los Angeles, CA (GTE 5ESS switches) |
| 213 | 195-xxxx | Los Angeles, CA (GTE 1AESS switches) |
| 214 | 971-xxxx | Dallas, TX |
| 215 | 811-xxxx | Philadelphia, PA |
| 216 | 551-xxxx | Akron/Canton/Cleveland/Lorain/Youngstown, OH |
| 219 | 571-xxx-xxxx | Gary/Hammond/Michigan City/Southbend, IN |
| 219 | 777-xxx-xxxx | Gary/Hammond/Michigan City/Southbend, IN |
| 301 | 579-xxxx | Hagerstown/Rockville, MD |
| 301 | 958-xxxx | Hagerstown/Rockville, MD |
| 303 | 99x-xxxx | Grand Junction, CO |
| 304 | 998-xxxx | WV |
| 305 | 999-xxxx | Ft. Lauderdale/Key West/Miami, FL |
| 312 | 511-xxxx | Chicago, IL |
| 312 | 511-xxx-xxxx | Chicago, IL |
| 312 | 57?-xxxx | Chicago, IL |
| 313 | 116-xxx-xxxx | Ann Arbor/Dearborn/Detroit, MI (GTE) |
| 313 | 951-xxxx | Ann Arbor/Dearborn/Detroit, MI |
| 315 | 98x-xxxx | Syracuse/Utica, NY |
| 317 | 777-xxxx | Indianapolis/Kokomo, IN |
| 317 | xxx-xxxx | Indianapolis/Kokomo, IN (y=3rd digit of phone number) |
| 319 | 79x-xxxx | Davenport/Dubuque, Iowa |
| 334 | 901-xxxx | Montgomery, AL |
| 401 | 98?-xxxx | RI |
| 404 | 450-xxxx | Atlanta, GA |
| 407 | 988-xxxx | Orlando/West Palm Beach, FL |
| 408 | 470-xxxx | San Jose, CA |
| 408 | 580-xxxx | San Jose, CA |
| 412 | 985-xxxx | Pittsburgh, PA |
| 413 | 1983-xxxx | Pittsfield/Springfield, MA |
| 414 | 977-xxxx | Fond du Lac/Green Bay/Milwaukee/Racine, WI |
| 414 | 978-xxxx | Fond du Lac/Green Bay/Milwaukee/Racine, WI |
| 415 | 350-xxxx | San Francisco, CA |
| 417 | 551-xxxx | Joplin/Springfield, MO |
| 501 | 221-xxxx | Ft. Smith, AR (646 prefix) |
| 501 | 221-xxx-xxxx | AR |
| 501 | 780-xxxx | Ft. Smith, AR (452 prefix) |
| 502 | 988 | Frankfort/Louisville/Paducah/Shelbyville, KY |
| 503 | 541-XXXX | OR |
| 504 | 99x-xxxx | Baton Rouge/New Orleans, LA |
| 504 | 9988776655 | Baton Rouge/New Orleans, LA |
| 505 | 59?-xxxx | New Mexico |
| 512 | 95X-xxxx | Austin, TX |
| 513 | 951-xxxx | Cincinnati/Dayton, OH |
| 513 | 955-xxxx | Cincinnati/Dayton, OH |
| 513 | 99?-xxxx | Cincinnati/Dayton, OH (X=0, 1, 2, 3, 4, 8 or 9) |
| 515 | 559-XXXX | Des Moines, IA |
| 516 | 660-xxxx | Hempstead/Long Island, NY |
| 516 | 660-xxx-xxxx | Hempstead/Long Island, NY |
| 517 | 116-xxx-xxxx | Bay City/Jackson/Lansing, MI (GTE) |
| 520 | 594-xxxx | AZ |
| 601 | 777-xxxx | MS |
| 603 | 981-xxxx | NH |
| 609 | 55?-xxxx | Atlantic City/Camden/Trenton/Vineland, NJ |
| 610 | 811-xxxx | Allentown/Reading, PA |
| 612 | 511 | Minneapolis/St.Paul, MN |
| 612 | 999-xxx-xxxx | Minneapolis/St.Paul, MN |
| 614 | 998-xxxx | Columbus/Steubenville, OH |
| 615 | 920-XXXX | Chatanooga/Knoxville/Nashville, TN |
| 615 | 930-xxxx | Chatanooga/Knoxville/Nashville, TN |
| 616 | 116-xxx-xxxx | Battle Creek/Grand Rapids/Kalamazoo, MI (GTE) |
| 616 | 946-xxxx | Battle Creek/Grand Rapids/Kalamazoo, MI |
| 619 | 331-xxxx | San Diego, CA |
| 619 | 332-xxxx | San Diego, CA |
| 659 | 981-XXXX | Newmarket, NH |
| 703 | 511-xxx-xxxx | VA |
| 703 | 958-xxxx | Alexandria/Arlington/Roanoke, VA |
| 708 | 511-xxxx | Chicago/Elgin, IL |
| 713 | 231-xxxx | Los Angeles, CA |
| 714 | 330? | Anaheim, CA (GTE) |
| 714 | 33?-xxxx | Anaheim, CA (PacBell) |
| 716 | 981-xxxx | Rochester, NY (Rochester Tel) |
| 718 | 660-xxxx | Bronx/Brooklyn/Queens/Staten Island, NY |
| 719 | 99x-xxxx | Colorado Springs/Leadville/Pueblo, CO |
| 801 | 938-xxxx | Utah |
| 801 | 939-xxxx | Utah |
| 802 | 987-xxxx | Vermont |
| 804 | 260 | Charlottesville/Newport News/Norfolk/Richmond, VA |
| 805 | 114 | Bakersfield/Santa Barbara, CA |
| 805 | 980-xxxx | Bakersfield/Santa Barbara, CA |
| 810 | 116-xxx-xxxx | Pontiac/Southfield/Troy, MI (GTE) |
| 810 | 951-xxx-xxxx | Pontiac/Southfield/Troy, MI |
| 813 | 711 | Ft. Meyers/St. Petersburg/Tampa, FL |
| 817 | 971 | Ft. Worth/Waco, TX (Flashhook, then 2#) |
| 818 | 915?-xxxx | Pasadena, CA |
| 864 | 999-xxx-xxxx | Greenville/Spartanburg, SC |
| 906 | 116-xxx-xxxx | Marquette/Sault Ste. Marie, MI (GTE) |
| 906 | 951-xxx-xxxx | Marquette/Sault Ste. Marie, MI |
| 908 | 55?-xxxx | New Brunswick, NJ |
| 908 | 953 | New Brunswick, NJ |
| 913 | 951-xxxx | Lawrence/Salina/Topeka, KS |
| 914 | 660-xxxx-xxxx | Peekskill/Poughkeepsie/White Plains/Yonkers, NY |
| Canada: | ||
| 204 | 590-xxx-xxxx | Manitoba |
| 403 | 999-xxx-xxxx | Alberta, Yukon, and N.W. Territories |
| 416 | 57x-xxxx | Toronto, Ontario |
| 416 | 99x-xxxx | Toronto, Ontario |
| 416 | 999-xxx-xxxx | Toronto, Ontario |
| 506 | 572+xxx-xxxx | New Brunswick |
| 514 | 320-xxx-xxxx | Montreal, Quebec |
| 519 | 999-xxx-xxxx | London, Ontario |
| 604 | 311-xxx-xxxx | British Columbia |
| 604 | 871-xxx-xxxx | British Columbia |
| 613 | 999-xxx-xxxx | Ottawa, Ontario |
| 705 | 999-xxx-xxxx | North Bay/Saulte Ste. Marie, Ontario |
| 819 | 320-xxx-xxxx | Quebec |
| 902 | 575-xxx-xxxx | Halifax, Nova Scotia |
| 905 | 999-xxx-xxxx | Hamilton/Mississauga/Niagra Falls, Ontario |
| Argentina: | ||
| 115 | ||
| Australia: | ||
| +61 199 | ||
| Brazil: | ||
| 109 | ||
| France: | ||
| 3644 | ||
| Malaysia: | ||
| 196 | ||
| New Zealand: | ||
| 137 | ||
| Sweden: | ||
| 0058 | ||
| United Kingdom: | ||
| 174 or 1744 or 175 or 0500-89-0011 or 17070 + 1 | ||
| The Netherlands: | ||
| 99-xxxxxx | ||
| 0196 | Amsterdam | |
| 0123456789 | Hilversum | |
| 0123456789 | Breukelen | |
| 951 | Groningen | |
This FAQ answer is excerpted from: ToneLoc v0.99 User Manual by Minor Threat & Mucho Maas
Loops are a pair of phone numbers, usually consecutive, like 836-9998 and 836-9999. They are used by the phone company for testing. What good do loops do us? Well, they are cool in a few ways. Here is a simple use of loops. Each loop has two ends, a 'high' end, and a 'low' end. One end gives a (usually) constant, loud tone when it is called. The other end is silent. Loops don't usually ring either. When BOTH ends are called, the people that called each end can talk through the loop. Some loops are voice filtered and won't pass anything but a constant tone; these aren't much use to you. Here's what you can use working loops for: billing phone calls! First, call the end that gives the loud tone. Then if the operator or someone calls the other end, the tone will go quiet. Act like the phone just rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or what the fuck ever. The operator thinks that she just called you, and that's it! Now the phone bill will go to the loop, and your local RBOC will get the bill! Use this technique in moderation, or the loop may go down. Loops are probably most useful when you want to talk to someone to whom you don't want to give your phone number.
Many (if not most) of these loops are no longer functional. If you are local to any of these loops, please try them out an e-mail me the results of your research.
NPA High Low Notes 201 666-9929 666-9930 208 862-9996 862-9997 213 365-1118 365-1119 308 357-0004 357-0005 310 455-0002 455-???? 310 546-0002 546-???? 312 262-9902 262-9903 Very odd sound 313 224-9996 224-9997 313 225-9996 225-9997 313 234-9996 234-9997 313 237-9996 237-9997 313 256-9996 256-9997 313 272-9996 272-9997 313 273-9996 273-9997 313 277-9996 277-9997 313 281-9996 281-9997 313 292-9996 292-9997 313 299-9996 299-9997 313 321-9996 321-9997 313 326-9996 326-9997 313 356-9996 356-9997 313 362-9996 362-9997 313 369-9996 369-9997 313 388-9996 388-9997 313 397-9996 397-9997 313 399-9996 399-9997 313 445-9996 445-9997 313 465-9996 465-9997 313 471-9996 471-9997 313 474-9996 474-9997 313 477-9996 477-9997 313 478-9996 478-9997 313 483-9996 483-9997 313 497-9996 497-9997 313 526-9996 526-9997 313 552-9996 552-9997 313 556-9996 556-9997 313 561-9996 561-9997 313 569-9996 569-9996 313 575-9996 575-9997 313 577-9996 577-9997 313 585-9996 585-9997 313 591-9996 591-9997 313 621-9996 621-9997 313 626-9996 626-9997 313 644-9996 644-9997 313 646-9996 646-9997 313 647-9996 647-9997 313 649-9996 649-9997 313 663-9996 663-9997 313 665-9996 665-9997 313 683-9996 683-9997 313 721-9996 721-9997 313 722-9996 722-9997 313 728-9996 728-9997 313 731-9996 731-9997 313 751-9996 751-9997 313 776-9996 776-9997 313 781-9996 781-9997 313 787-9996 787-9997 313 822-9996 822-9997 313 833-9996 833-9997 313 851-9996 851-9997 313 871-9996 871-9997 313 875-9996 875-9997 313 886-9996 886-9997 313 888-9996 888-9997 313 898-9996 898-9997 313 934-9996 934-9997 313 942-9996 942-9997 313 963-9996 963-9997 313 977-9996 977-9997 315 673-9995 673-9996 315 695-9995 695-9996 406 225-9902 225-9903 408 238-0044 238-0045 408 773-0044 773-0045 501 753-4291 753-4297 517 422-9996 422-9997 517 423-9996 423-9997 517 563-9996 563-9997 517 663-9996 663-???? 517 851-9996 851-9997 613 966-1111 703 591-9994 713 342-1499 342-1799 713 351-1499 351-1799 713 354-1499 354-1799 713 356-1499 356-1799 713 442-1499 442-1799 713 447-1499 447-1799 713 455-1499 455-1799 713 458-1499 458-1799 713 462-1499 462-1799 713 466-1499 466-1799 713 468-1499 468-1799 713 469-1499 469-1799 713 471-1499 471-1799 713 481-1499 481-1799 713 482-1499 482-1799 713 484-1499 484-1799 713 487-1499 487-1799 713 489-1499 489-1799 713 492-1499 492-1799 713 493-1499 493-1799 713 524-1499 524-1799 713 526-1499 526-1799 713 555-1499 555-1799 713 661-1499 661-1799 713 664-1499 664-1799 713 665-1499 665-1799 713 666-1499 666-1799 713 667-1499 667-1799 713 682-1499 976-1799 713 771-1499 771-1799 713 780-1499 780-1799 713 781-1499 997-1799 713 960-1499 960-1799 713 977-1499 977-1799 713 988-1499 988-1799 719 598-0009 598-0010 805 528-0044 528-0045 805 544-0044 544-0045 805 773-0044 773-0045 808 235-9907 235-9908 808 239-9907 239-9908 808 245-9907 245-9908 808 247-9907 247-9908 808 261-9907 261-9908 808 322-9907 322-9908 808 328-9907 328-9908 808 329-9907 329-9908 808 332-9907 332-9908 808 335-9907 335-9908 808 572-9907 572-9908 808 623-9907 623-9908 808 624-9907 624-9908 808 668-9907 668-9908 808 742-9907 742-9908 808 879-9907 879-9908 808 882-9907 882-9908 808 885-9907 885-9908 808 959-9907 959-9908 808 961-9907 961-9908 810 362-9996 362-9997 813 385-9971 385-xxxx 847 724-9951 724-???? 908 254-9929 254-9930 908 558-9929 558-9930 908 560-9929 560-9930 908 776-9930 776-9930 916 221-0044 221-0045 Voice filtered 916 222-0044 222-0045 Voice filtered
CNA stands for Customer Name and Address. The CNA number is a phone number for telephone company personnel to call and get the name and address for a phone number. If a telephone lineman finds a phone line he does not recognize, he can use the ANI number to find its phone number and then call the CNA operator to see who owns it and where they live.
Normal CNA numbers are available only to telephone company personnel. Private citizens may legally get CNA information from private companies. Companies offering this service include:
| Cross-Reference Directories | (900)288-3020 |
| AT&T National Directory Assistance | (900)555-1212 |
| Telename | (900)884-1212 |
| Unidirectory | (900)933-3330 |
Note that these are 900 numbers, and will cost you approximately one dollar per minute.
If you are in 312, 708, or parts of 815, AmeriTech has a pay-for-play CNA service available to the general public. The number is 796-9600. The cost is $.35/call and can look up two numbers per call.
If you are in 415, Pacific Bell offers a public access CNL service at (415)705-9299.
If you are in Bell Atlantic territory you can call (201)555-5454 or (908)555-5454 for automated CNA information. The cost is $.50/call.
The legal telephone company CNA for Ontario is 555-1313.
You can fool (800)967-5356 into giving you a free CNA by requesting a free disk and then entering the number you want the adress for at the prompt.
You can often social engineer CNA information out of telephone company employees or out of employees of other companies with CNA access.
Here is a sample script that works if your target has ever ordered pizza from Domino's or Pizza Hut:
Them: Hi, thanks for call, may I take your order please?
You: Yes, I'd like 4 large pepperoni pizzas.
Them: May I have your phone number please?
You: <State your targets phone number here>
Them: Is this 238 Ward Road?
You: Yes ma'am.
NPA Telephone Number Geography 203 (203)771-8080 CT 214 (214)744-9500 Southwestern Bell 214 (214)745-7505 Southwestern Bell 217 (217)789-8290 Ameritech (Illinois) 312 (312)796-9600 Chicago, IL 506 (506)555-1313 New Brunswick 513 (513)397-9110 Cincinnati/Dayton, OH 516 (516)321-5700 Hempstead/Long Island, NY 614 (614)464-0123 Columbus/Steubenville, OH 813 (813)270-8711 Ft. Meyers/St. Petersburg/Tampa, FL 912 (912)752-2000 #1367 Albany/Savannah, GA NYNEX (518)471-8111 New York, Connecticut, Vermont, Rhode
Island, New Hampshire, and Massachusetts
In the following listings, "xxx" means that the same number is used as a constantly busy number in many different prefixes. In most of these, there are some exchanges that ring busy and some exchanges that are in normal use. ALWAYS test these numbers at least three times during normal business hours before using as a constantly busy number.
NPA Telephone Number Geography 800 999-1803 WATS 201 635-9970 Hackensack/Jersey City/Newark/Paterson, NJ 212 724-9970 Manhattan, NY 213 xxx-1117 Los Angeles, CA 213 xxx-1118 Los Angeles, CA 213 xxx-1119 Los Angeles, CA 213 xxx-9198 Los Angeles, CA 216 xxx-9887 Akron/Canton/Cleveland/Lorain/Youngstown, OH 303 431-0000 Denver, CO 303 866-8660 Denver, CO 310 xxx-1117 Long Beach, CA 310 xxx-1118 Long Beach, CA 310 xxx-1119 Long Beach, CA 310 xxx-9198 Long Beach, CA 316 952-7265 Dodge City/Wichita, KS 501 377-99xx AR 518 571-xxxx Albany, NY 719 472-3772 Colorado Springs/Leadville/Pueblo, CO 805 255-0699 Bakersfield/Santa Barbara, CA 714 xxx-1117 Anaheim, CA 714 xxx-1118 Anaheim, CA 714 xxx-1119 Anaheim, CA 714 xxx-9198 Anaheim, CA 717 292-0009 Harrisburg/Scranton/Wilkes-Barre, PA 717 980-xxxx Harrisburg/Scranton/Wilkes Barre, PA 818 xxx-1117 Pasadena, CA 818 xxx-1118 Pasadena, CA 818 xxx-1119 Pasadena, CA 818 xxx-9198 Pasadena, CA 818 885-0699 Pasadena, CA (???-0699 is a pattern) 860 525-7078 Hartford, CT 906 632-9999 Marquette/Sault Ste. Marie, MI 906 635-9999 Marquette/Sault Ste. Marie, MI
If your NPA is not listed, or the listing does not cover your LATA, try common numbers such as 119 (GTD5 switches) or 511.
NPA Telephone Number Geography Length of disconnection 209 999 Stockton/Fresno/Lodi, CA (100 seconds) 313 xxx-9994 Ann Arbor/Dearborn/Detroit, MI (Ameritech) (1 minute) 314 511 Columbia/Jefferson City/St.Louis, MO (1 minute) 404 420 Atlanta, GA (5 minutes) 405 953 Enid/Oklahoma City, OK (1 minute) 407 511 Orlando, FL (United Telephone) (1 minute) 414 958-0013 Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute) 512 200 Austin/Corpus Christi, TX (1 minute) 516 480 Hempstead/Long Island, NY (1 minute) 517 xxx-9994 Bay City/Jackson/Lansing, MI (Ameritech) (1 minute) 518 958 Albany, NY (1 minute) 603 980 NH 614 xxx-9894 Columbus/Steubenville, OH 616 xxx-9994 Battle Creek/Grand Rapids/Kalamazoo, MI (Ameritech)(1 minute) 805 119 Bakersfield/Santa Barbara, CA (3 minutes) 807 211 Thunder Bay, Ontario (3 minutes) 810 xxx-9994 Pontiac/Southfield/Troy, MI (Ameritech) (1 minute) 906 xxx-9994 Marquette/Sault Ste. Marie, MI (Ameritech) (1 minute) 919 211 or 511 Durham, NC (10 min - 1 hour)
A Proctor Test Set is a tool used by telco personnel to diagnose problems with phone lines. You call the Proctor Test Set number and press buttons on a touch tone phone to active the tests you select.
If your NPA is not listed try common numbers such as 111 or 117.
NPA Telephone Number Geography 805 111 Bakersfield/Santa Barbara, CA 909 117 Tyler, TX 913 611-1111 Lawrence/Salina/Topeka, KS
Scanning is dialing a large number of telephone numbers in the hope of finding anything interesting. Interesting items often include test tones, computers, Voice Message Boxes (VMB's), Private Branch Exchanges (PBX's), and government offices.
Scanning can be done by hand, although dialing several thousand telephone numbers by hand is extremely boring and takes a long time.
Much better is to use a scanning program, sometimes called a war dialer or a demon dialer. Currently, the best war dialer available to PC-DOS users is ToneLoc from Minor Threat and Mucho Maas.
For the Macintosh, try Assault Dialer.
A war dialer will dial a range of numbers and log what it finds at each number. You can then only dial up the numbers that the war dialer marked as carriers or tones.
Excerpt from: 2600, Spring 1990, Page 27:
In some places, scanning has been made illegal. It would be hard, though, for someone to file a complaint against you for scanning since the whole purpose is to call every number once and only once. It's not likely to be thought of as harassment by anyone who gets a single phone call from a scanning computer. Some central offices have been known to react strangely when people start scanning. Sometimes you're unable to get a dialtone for hours after you start scanning. But there is no uniform policy. The best thing to do is to first find out if you've got some crazy law saying you can't do it. If, as is likely, there is no such law, the only way to find out what happens is to give it a try.
It should be noted that a law making scanning illegal was recently passed in Colorado Springs, CO. It is now illegal to place a call in Colorado Springs without the intent to communicate.
This FAQ answer was written by Phucked Agent 04:
This is the "right hand" of both the professional and the amatuer lineman. Basically, it is a customized portable telephone which is designed to be hooked onto raw cable terminals in the field and used to monitor the line, talk, or dial out. The monitor function is usually the main difference between the "butt-in" test set and the normal phone. If you don't have a real test set already, the following circuit can convert a normal $4 made-in-taiwan phone into a working test set. The "all-in-one" handset units without bases are the best (I tend to like QUIK's and GTE Flip Phone II's). Anyway-
OFFICIAL Agent 04 Generic Test Set Modification (tm)
OFFICIAL Agent 04 Generic Test Set Modification (tm)
Ring >---------------------------------> to "test set" phone
Tip >------! SPST Switch !-------->
!-----/ ----------!
>from !-------/!/!/!/!--! C = 0.22 uF 200 WVDC Mylar
cable pair ! C R ! R = 10 kOhm 1/2 W
(alligators) !--! (------------! SPST = Talk / Monitor
When SPST is closed, you are in talk mode; when you lift the switch- hook on the "test set" phone, you will get a dial tone as if you were a standard extension of the line you are on. You will be able to dial out and receive calls. When the SPST is opened, the resistor and capacitor are no longer shunted, and they become part of the telephone circuit. When you lift the switchhook on the test set, you will not receive dial tone, due to the fact that the cap blocks DC, and the resistor passes less than 4 mA nominally (far below the amount necessary to saturate the supervisory ferrod on ESS or close the line relay on any other switch). However, you will be able to silently monitor all audio on the line. The cap reactance + the phone's impedance insure that you won't cut the signal too much on the phone line, which might cause a noticeable change (..expedite the shock force, SOMEONE'S ON MY LINE!!). It's also good to have a VOM handy when working outside to rapidly check for active lines or supervision states.
Contact East
335 Willow Street
North Andover, MA 01845-5995
(508)682-2000
Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399
(800)426-1194
Specialized Products
3131 Premier Drive
Irving, TX 75063
(800)866-5353
Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064
(619)679-0303
DTMF stands for Dual Tone Multi Frequency. These are the tones you get when you press a key on your telephone touch pad. The tone of the button is the sum of the column and row tones. The ABCD keys do not exist on standard telephones.
1209hz 1336hz 1477hz 1633hz 697hz 1 2 3 A 770hz 4 5 6 B 852hz 7 8 9 C 941hz * 0 # D
Many of these tones are no longer used and are mentioned here only for historical accuracy.
This is a generic tone used with various interruption patterns for specific tones listed below and described under their own titles:
Line Busy Tone
Reorder
RevertingTone
No Circuit Tone
No Such Number
Vacant Code
Group Busy Tone
Deposit Coin Tone
Vacant Position Tone
Dial Off-Normal Tone
Trouble Tone
Dial Jack Tone
Dial Test Signal
Class of Service
Low Tone 480 Hz and 620 Hz at -24 dBm0/frequency. On some systems manufactured before 1974, Low Tone was 600 Hz modulated at 120, 133, 140 or 160 Hz at 61 - 71 dBrnC.
This is a generic tone used with various interruption patterns for the specific tones listed below and described under their own titles:
Partial Dial Tone
Permanent Signal
Coin Return (Test) Tone
Coin Return Tone
Number Checking Tone
Intercepting Loopback Tone
Warning Tone
Order Tone
Station Ringer Test
Class of Service
High Tone 480 Hz at -17 dBm0. On some systems manufactured before 1974, High Tone was 400 Hz or 500 Hz at 61 - 71 dBrnC.
This tone is sent to a customer or operator to indicate that the receiving end is ready to receive dial pulses or DTMF signals. It is used in all types of dial offices when dial pulses are produced by the customer's or operator's dials. Normally dial tone means that the entire wanted number may be dialed; however, there are some cases where the calling party must await a second dial tone or where an operator, after dialing an initial group of digits, must wait for a second dial tone before the rest of the number can be dialed. Some dialing switchboards are arranged to permit listening for dial tone between certain digits.
Dial Tone is 350 Hz and 440 Hz held steady at -13 dBm0/frequency.
This is a ringing indication which is intercepted by the calling party to mean that the called line has been reached and that the ringing has started. It is also used on calls to operators (special service, long distance, intercepting, etc) during the "awaiting-operator-answer" interval.
Audible Ring Tone is 440 Hz and 480 Hz for 2 seconds on and 4 seconds off at -13 dBm0/frequency.
The Line Busy Tine indicates that the called customer's line has been reached but that it is busy or being rung or on permanent signal. When a line busy signal is applied by an operator, it is sometimes calls a busy-back tone.
Line Busy Tone is Low Tone on and off every .5 seconds.
Reorder indicates that the local or toll switching or transmission paths to the office or equipment serving the called customer is busy. This signal may indicate a condition such as a timed-out sender or unassigned code dialed. It is interpreted by either a customer or an operator as a reorder signal.
Reorder on a local call is Low Tone for .3 seconds on and .2 seconds off. Reorder on a toll call is Low Tone for .2 seconds on and .3 seconds off. In No. 5 crossbar, No. 1/1A ESS, No. 2/2B ESS switching equipment and No. 1 step-by-step offices using the Precise Tone Plan, the temporal pattern is 0.25 second of low tone and 0.25 second off.
Indicates that an operator has connected to the line (emergency interrupt on a busy line during a verification call).
Alerting Tone is 440 Hz on for 2 seconds and then on again for .5 seconds every ten seconds.
When recording equipment is used, this tone is connected to the line to inform the distant party that the conversation is bveing recorded. The tone source is located within the recording equipment and cannot be controlled by the party applying the recording equipment to the line. This tone is required by law and is recorded along with the speech.
Recorder Warning Tone is a .5 second burst at 1400 Hz every 15 seconds.
This tone is used to inform the customer that his/her call is connected to a recording machine and that he/she should proceed to leave a message, dictate, etc. It is to be distinguished from the recorder warning tone, which warns the customer that his/her 2-way conversation is being recorded.
Recorder Warning Tone is a .5 second burst at 440 Hz every 5 seconds.
The same type of signal as line busy tone is used for reverting tone in all systems. In No. 5 crossbar systems, a second dial tone is sometimes also used when a calling party identification digit is required. The reverting signal informs the calling subscriber that the called party is on the same line and that he/she should hang up while the line is being rung.
Reverting Tone is is Low Tone on and off every .5 seconds at -24 dBm0/frequency.
This tone, sent from a Community Dial Office to a post-pay coin telephone, informs the calling party that the called party has answered and that the coin should be deposited.
Deposit Coin Tone is a steady Low Tone.
This tone is used to cause off-hook customers to replace the receiver on-hook on a permanent signal call and to signal a non-PBX off-hook line when ringing key is operated by a switchboard operator.
Receiver Off-Hook Tone is 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at 0
dBm0/frequency on and off every .1 second. On some older space division
switching systems Receiver Off-Hook was 1400 Hz, 2060 Hz, 2450 Hz and
2600 Hz at +5 VU on and off every .1 second. On a No. 5 ESS this
continues for 30 seconds. On a No. 2/2B ESS this continues for 40
seconds. On some other AT&T switches there are two iterations of 50
seconds each.
This tone is used in older offices to inform a customer that their receiver is off-hook. It has been superseded by the receiver off-hook tone.
Howler was a 480 Hz tone incremented in volume every second for ten seconds until it reaches +40 VU.
High-tone is used to notify the calling party that he/she has not commenced dialing within a preallotted time, measured after receipt of dial tone (permanent signal condition), or that he/she has not dialed enough digits (partial dial condition). This is a signal to hang up and dial again.
Partial Dial Tone is a steady High Tone.
This signal tells the calling party to hang up, check the called number, and dial again. In modern systems, calls to unassigned or discontinued numbers will also be routed to a machine announcement system, such as 6A or 7A, which verbally supplies the require message. In some older offices, you could be routed to an intercepting operator. In some offices, reorder tone is returned in this condition.
No Such Number is 200 to 400 Hz modulated at 1 Hz, interrupted every 6 seconds for .5 seconds.
This tone is used in crossbar systems to indicate that the dialed office code is unassigned. In step-by-step areas, this signal is called vacant level tone. For operator-originated calls, the verbal announcement is preceeded by two flashes. In modern systems, recorded verbal announcements are used for this service.
Vacant Code is Low Tone for .5 seconds on, .5 seconds off, .5 seconds of and 1.5 seconds off.
Busy verification is a Centrex feature that allows the attendant to call and be connected to a busy Centrex station within the attendant's customer group. The busy verification tone is applied to both parties of the connection to inform them of the intrusion by the attendant. No tone is applied if the station called for busy verification is idle.
Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds and then again for .3 seconds every 7.5 to 10 seconds. On a No. 1/1A ESS, Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds and then again for .3 seconds every 6 seconds.
There is also a TSPS Busy Verification tone, which is 440 Hz at -13 dBm0 for 2 seconds and then on again for .5 seconds every 10 seconds.
Call Waiting is a special service that allows a busy line to answer an incoming call by flashing the switchhook. Audible ring (instead of line busy) is applied to the calling line, and the Call Waiting tone is applied to the called line. (So that only the called party hears the tone, the connection is momentarily broken, and the other party to that connection experiences a moment of silence.) Flashing the switchhook places the existing connection on hold and connects the customer to the waiting call.
Call Waiting Tone is two bursts of 440 Hz at -13 dBm0/frequency for .3 seconds plus or minus ten percent every ten seconds.
This tone is used to acknowledge receipt by automatic equipment of information necessary for special services. It is currently used for:
- Speed Calling - dialed number has been recorded
- Call Forwarding - dialed number has been recorded and service is activated
- Call Forwarding - service is deactivated
Confirmation Tone is 350 Hz and 440 Hz at -13 dBm0/frequency on for .1 second, off for .1 second and then on for .3 seconds.
Attendant camp-on service allows an electronic switching system Centrex attendant to hold incoming calls to busy lines. Each time the attendant releases his/her talking connection from the loop involved in the camped-on call, the indication of camp-on tone is heard by the called customer if the customer has subscribed to the indication of camp-on option. The customer may get this tone several times as the attendant reconnects and releases from the loop in response to timed reminders from the console.
Indication of Camp On is 440 Hz at -13 dBm0 for one second every time the attendant releases from the loop.
This tone is used with Three-Way Calling, Centrex station dial transfer, and Centrex conference (station or attendant) services. The user on an existing connection flashes the switchhook, receives special dial tone, and dials number of the third party to be added to the connection.
Special Dial Tone is 350 Hz and 440 Hz at -13 dBm0/frequency for .1 second on, .1 second off, .1 second on, .1 second off, .1 second on, .1 second off, and then on steady.
This tone replaces normal audible ring for priority calls within the AUTOVON network.
Priority Audible Ring is 440 Hz and 480 Hz at -16 dBm0/frequency on for 1.65 seconds and off for .35 seconds.
This tone is provided to both parties of a connection that is preempted by a priority call from the AUTOVON network.
Preemption Tone is 440 Hz and 620 Hz at -18 dBm0/frequency steady for anywhere from three to fifteen seconds.
This set is heard when manually initiating a data call. It normally occurs shortly after the start of audible ringing and means that the remote data set has answered. The data set at the calling end should then be put into the data mode.
Data Set Answer Back Tone is 2025 Hz steady at -13 dBm.
This tone is used to inform the customer that his/her credit card information must be keyed in. The first 60 milliseconds of this composite tone is 941 Hz abd 1477 Hz which is the DTMF '#'. This tone will release and DTMF to dial pulse converter in the conneciton.
Calling Card Service Prompt Tone is 941 Hz and 1477 Hz at -10 dBm0/frequency at -3 Transmission Level Point for 60 milliseconds and then 440 Hz and 350 Hz at -7 dBm0 for .940 seconds exponentially decayed from -10 dBm per frequency at -3 Transmission Level Point at time constant of .2 seconds.
These signals are used at a toll board operating as an 'A" board to identify the class or service of the calling customer. The indication may be high, low, or no tone.
Class of Service is a single burst of either High Tone or Low Tone for .05 to 1 seconds.
This is a second dial tone returned to an operator between digits indicating that he/she may dial the remainder of the number. For example, when an operator reaches a link-type Community Dial Office via a step-by-step office after dialing a routing code, he/she must pause until an idle link at the Community Dial Office returns dial tone. This method of operation is not recommended or considered standard.
Dial-Normal Transmission Signal is a steady Low Tone.
Low tone is used as a start-dial signal to tell a DSA operator that the connection reached through a dial jack is ready to receive dialing.
Dial Jack Tone is a steady Low Tone.
High tones sent over interposition, local interoffice, or toll trunks indicate:
- the the originating operator that the order should be passed
- to the receiving operator that an order is about to be passed
For Call Announcement and Autometic Display Call Indicator, the tone serves function two only.
- Single-order tone - This is a relatively long (0.5 second) signal which means that the originating operator should pass the office name and number.
- Double-order tone - This signal is two short spurts in quick succession and means that the operator should pass only the desired number.
- Triple-order tone - This signal is three short spurts in quick succession and means that the operator should pass the office name only and wait for another order tone.
- Quadruple-order tone - This signal is four short spurts in quick succession and means that the operator should pass the city name only and wait for another challenge. It is used in manual toll tandem (also called zip tones or trunk assignment tones).
Single-order tone is one .5 spurt of High Tone. Double-order tone is two short spurts of High Tone. Triple-order tone is three short spurts of High Tone. Quadruple-order tone is four short spurts of High Tone.
High tone sent from an intercept operator to the 'A' board operator in manual offices indicates that an intercept operator has completed the call and that the 'A' should disconnect from the circuit. The completion of intercepted calls in this manner is no longer recommended.
Intercepting Loopback Tone is a steady High Tone.
High tone is sometimes used at DSA switchboards in No. 1 crossbar and some step-by-step areas to verify the verbal identification of the calling line.
Number Checking Tone is a steady High Tone. On some older systems, Number Checking Tone was a steady 135 Hz tone.
These tones enable the operator to determine the amount deposited in coin telephones.
Coin Denomination Tones for the old 3 slot payphones were:
Nickel - One tap of 1050 Hz and 1100 Hz (bell)
Dime - Two taps of 1050 Hz and 1100 Hz (bell)
Quarter - One tap at 800 Hz (gong)
Low tone over a coin recording-completing trunk informs the originating toll operator that the local operator or coin control circuit has collected the charge.
Coin Collect Tone is a steady Low Tone.
High tone over a coin recording-completing trunk informs the originating toll operator that the local operator or coin control circuit has returned the change when the connection is not completed (also called coin refund tone).
Coin Return Tone is a single .5 to 1 second burst of High Tone.
High tone is used to tell an operator in a dial central office that a tester has completed a call to his/her position over a coin trunk.
Coin Return (Test) Tone is a single .5 to 1 second burst of High Tone.
This audible signal is indicated by low tone on the sleeve of trunk jacks at cord switchboards. Absense of the tone tells the operator that there is at least one idle trunk in a group.
Group Busy Tone is a steady Low Tone.
Low tone is applied to all straightforward trunks terminating in a vacated position in manual offices.
Vacant Position Tone is a steady Low Tone.
Low tone is returned to an operator after he/she has completed a call into a step-by-step office and after the calling party has answered to remind him/her to restore the dial key.
Dial Off-Normal Tone is a steady Low Tone.
A customer line, not in use, which exhibits a steady off-hook condition is routed to a permanent signal trunk. High tone, superimposed on battery, is supplied through a resistance lamp to the ring of the trunk. The tone is used to inform an operator or other employee making a verification test that the line is temporarily out of service. An intermittent ground may also be applied to the ring of the telephone systems left in the hold condition. Typical reasons for the line condition are:
- No dialing within the allowed waiting interval.
- A handset is off-hook.
- Low insulation resistance or other line trouble.
In some offices, if three or more digits are dialed but not a complete telephone number or code, the call is released and dial tone is returned.
Permanent Signal is a steady High Tone.
High tone warns an operator that the circuit he/she is connected to is not in condition for normal operation. Examples:
- An operator at an Automatic Display Call Indicator position plugs in the wrong jack.
- An operator at a sender monitor position plugs into a sender supervisory jack while the sender is under test.
Warning Tone is a steady High Tone.
Low tone applied by an operator or test person at a B position in a manual office to the jack sleeve of a line or trunk in a calling multiple tells other operators the line or trunk is in trouble (also called plugging up codr tone).
Trouble Tone is a steady Low Tone.
This tone indicated that the trunk to which it is applied is being service-observed.
Service Observing Tone is a steady 135 Hz.
This tone informs the operator that an overseas sender has been siezed and the address information (KP-CC-CC-ST) should be transmitted.
Proceed to Send Tone is a steady 480 Hz at -22 dBm0.
This tone tells the centralized intercept bureau operator that a call has reached the position.
Centralized Intercept Bureau Order Tone is a .5 second burst of 1850 Hz at -17 dBm0.
This tone tells the ONI operator that a call has reached the position.
ONI Order Tone is 700 Hz and 1100 Hz at -25 dBm for .095 to .25 seconds.
According to AT&T, the ringing signal is an 88v 20Hz A.C. signal superimposed on 48v nominal D.C. supervisory voltage. However, the actual rining signal used can and does vary greatly from one location to another. The frequency of the AC signal is normally between 15 and 70Hz. The interval between ringing signals is normally four seconds.
Local Area Signalling Services (LASS) and Custom Calling Feature Control Codes:
| Service | Tone | Pulse/rotary | Notes |
|---|---|---|---|
| Assistance/Police | 12 | n/a | [1] |
| Cancel forwarding | 30 | n/a | [C1] |
| Automatic Forwarding | 31 | n/a | [C1] |
| Notify | 32 | n/a | [C1] [2] |
| Intercom Ring 1 (..) | 51 | 1151 | [3] |
| Intercom Ring 2 (.._) | 52 | 1152 | [3] |
| Intercom Ring 3 (._.) | 53 | 1153 | [3] |
| Extension Hold | 54 | 1154 | [3] |
| Customer Originated Trace | 57 | 1157 | |
| Selective Call Rejection | 60 | 1160 | (or Call Screen) |
| Selective Distinct Alert | 61 | 1161 | |
| Selective Call Acceptance | 62 | 1162 | |
| Selective Call Forwarding | 63 | 1163 | |
| ICLID Activation | 65 | 1165 | |
| Call Return (outgoing) | 66 | 1166 | |
| Number Display Blocking | 67 | 1167 | [4] |
| Computer Access Restriction | 68 | 1168 | |
| Call Return (incoming) | 69 | 1169 | |
| Call Waiting disable | 70 | 1170 | [4] |
| No Answer Call Transfer | 71 | 1171 | |
| Usage Sensitive 3 way call | 71 | 1171 | |
| Call Forwarding: start | 72 or 72# | 1172 | |
| Call Forwarding: cancel | 73 or 73# | 1173 | |
| Speed Calling (8 numbers) | 74 or 74# | 1174 | |
| Speed Calling (30 numbers) | 75 or 75# | 1175 | |
| Anonymous Call Rejection | 77 | 1177 | [5] [M: *58] |
| Call Screen Disable | 80 | 1180 | (or Call Screen) [M: *50] |
| Selective Distinct Disable | 81 | 1181 | [M: *51] |
| Select. Acceptance Disable | 82 | 1182 | [4] [7] |
| Select. Forwarding Disable | 83 | 1183 | [M: *53] |
| ICLID Disable | 85 | 1185 | |
| Call Return (cancel out) | 86 | 1186 | [6] [M: *56] |
| Anon. Call Reject (cancel) | 87 | 1187 | [5] [M: *68] |
| Call Return (cancel in) | 89 | 1189 | [6] [M: *59] |
Notes:
[C1] - Means code used for Cellular One serviceThe reason for different codes for some features in MLVP is that call-pickup is *8 in MLVP so all *8x codes are reassigned *5x
These appear to be standard, but may be changed locally
Under GTE, some LASS/CLASS tones may be changed from *NN to NN#. Under pulse, GTD5 allows either NN<pause> or 11NN, but with 11NN it may conflict with a test number.
At one time these were called CLASS Codes, for Custom Local Area Signalling Services.
Here are the frequencies for the first generation 46/49mhz phones.
| Channel | Handset Transmit | Base Transmit |
|---|---|---|
| 1 | 49.670mhz | 46.610mhz |
| 2 | 49.845 | 46.630 |
| 3 | 49.860 | 46.670 |
| 4 | 49.770 | 46.710 |
| 5 | 49.875 | 46.730 |
| 6 | 49.830 | 46.770 |
| 7 | 49.890 | 46.830 |
| 8 | 49.930 | 46.870 |
| 9 | 49.990 | 46.930 |
| 10 | 49.970 | 46.970 |
Second generation 900Mhz cordless phones have been allocated the frequencies between 902-228MHz, with channel spacing between 30-100KHz.
Following are some examples of the frequencies used by example phones:
Panasonic KX-T9000 (60 Channels)
Base: 902.100 - 903.870
Handset: 926.100 - 927.870
| Channel | Base | Handset | Channel | Base | Handset | Channel | Base | Handset |
|---|---|---|---|---|---|---|---|---|
| 01 | 902.100 | 926.100 | 11 | 902.400 | 926.400 | 21 | 902.700 | 926.700 |
| 02 | 902.130 | 926.130 | 12 | 902.430 | 926.430 | 22 | 902.730 | 926.730 |
| 03 | 902.160 | 926.160 | 13 | 902.460 | 926.460 | 23 | 902.760 | 926.760 |
| 04 | 902.190 | 926.190 | 14 | 902.490 | 926.490 | 24 | 902.790 | 926.790 |
| 05 | 902.220 | 926.220 | 15 | 902.520 | 926.520 | 25 | 902.820 | 926.820 |
| 06 | 902.250 | 926.250 | 16 | 902.550 | 926.550 | 26 | 902.850 | 926.850 |
| 07 | 902.280 | 926.280 | 17 | 902.580 | 926.580 | 27 | 902.880 | 926.880 |
| 08 | 902.310 | 926.310 | 18 | 902.610 | 926.610 | 28 | 902.910 | 926.910 |
| 09 | 902.340 | 926.340 | 19 | 902.640 | 926.640 | 29 | 902.940 | 926.940 | 10 | 902.370 | 926.370 | 20 | 902.670 | 926.670 | 30 | 902.970 | 926.970 |
| 31 | 903.000 | 927.000 | 41 | 903.300 | 927.300 | 51 | 903.600 | 927.600 |
| 32 | 903.030 | 927.030 | 42 | 903.330 | 927.330 | 52 | 903.630 | 927.630 |
| 33 | 903.060 | 927.060 | 43 | 903.360 | 927.360 | 53 | 903.660 | 927.660 |
| 34 | 903.090 | 927.090 | 44 | 903.390 | 927.390 | 54 | 903.690 | 927.690 |
| 35 | 903.120 | 927.120 | 45 | 903.420 | 927.420 | 55 | 903.720 | 927.720 |
| 36 | 903.150 | 927.150 | 46 | 903.450 | 927.450 | 56 | 903.750 | 927.750 |
| 37 | 903.180 | 927.180 | 47 | 903.480 | 927.480 | 57 | 903.780 | 927.780 |
| 38 | 903.210 | 927.210 | 48 | 903.510 | 927.510 | 58 | 903.810 | 927.810 |
| 39 | 903.240 | 927.240 | 49 | 903.540 | 927.540 | 59 | 903.840 | 927.840 |
| 40 | 903.270 | 927.270 | 50 | 903.570 | 927.570 | 60 | 903.870 | 927.870 |
Base: 905.6 - 907.5 (100Khz spacing)
Handset: 925.5 - 927.4
| Channel | Base | Handset | Channel | Base | Handset | Channel | Base | Handset |
|---|---|---|---|---|---|---|---|---|
| 01 | 905.600 | 925.500 | 08 | 906.300 | 926.200 | 15 | 907.000 | 926.900 |
| 02 | 905.700 | 925.600 | 09 | 906.400 | 926.300 | 16 | 907.100 | 927.000 |
| 03 | 905.800 | 925.700 | 10 | 906.500 | 926.400 | 17 | 907.200 | 927.100 |
| 04 | 905.900 | 925.800 | 11 | 906.600 | 926.500 | 18 | 907.300 | 927.200 |
| 05 | 906.000 | 925.900 | 12 | 906.700 | 926.600 | 19 | 907.400 | 927.300 |
| 06 | 906.100 | 926.000 | 13 | 906.800 | 926.700 | 20 | 907.500 | 927.400 |
| 07 | 906.200 | 926.100 | 14 | 906.900 | 926.800 |
Other 900mhz cordless phones:
| AT&T #9120 | 902.0 - 905.0 & 925.0 - 928.0 Mhz |
| Otron Corp. #CP-1000 | 902.1 - 903.9 & 926.1 - 927.9 Mhz |
| Samsung #SP-R912 | 903.0 & 927.0 Mhz |
This FAQ answer is stolen from Rockwell:
Calling Number Delivery (CND), better known as Caller ID, is a telephone service intended for residential and small business customers. It allows the called Customer Premises Equipment (CPE) to receive a calling party's directory number and the date and time of the call during the first 4 second silent interval in the ringing cycle.
The data signalling interface has the following characteristics:
Link Type: 2-wire, simplex Transmission Scheme: Analog, phase-coherent FSK Logical 1 (mark) 1200 +/- 12 Hz Logical 0 (space) 2200 +/- 22 Hz Transmission Rate: 1200 bps Transmission Level: 13.5 +/- dBm into 900 ohm load
The protocol uses 8-bit data words (bytes), each bounded by a start bit and a stop bit. The CND message uses the Single Data Message format shown below.
Channel Carrier Message Message Data Checksum Seizure Signal Type Length Word(s) Word Signal Word Word
The channel seizure is 30 continuous bytes of 55h (01010101) providing a detectable alternating function to the CPE (i.e. the modem data pump).
The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to condition the receiver for data.
The message type word indicates the service and capability associated with the data message. The message type word for CND is 04h (00000100).
The message length word specifies the total number of data words to follow.
The data words are encoded in ASCII and represent the following information:
If the calling party's directory number is not available to the terminating central office, the data word field contains an ASCII "O". If the calling party invokes the privacy capability, the data word field contains an ASCII "P".
The Checksum Word contains the twos complement of the modulo 256 sum of the other words in the data message (i.e., message type, message length, and data words). The receiving equipment may calculate the modulo 256 sum of the received words and add this sum to the received checksum word. A result of zero generally indicates that the message was correctly received. Message retransmission is not supported.
An example of a received CND message, beginning with the message type word, follows:
04 12 30 39 33 30 31 32 32 34 36 30 39 35 35 35 31 32 31 32 51
| 04h | Calling number delivery information code (message type word) |
| 12h | 18 decimal; Number of data words (date,time, and directory number words) |
| 30,39 | 09; September |
| 33,30 | 30; 30th day |
| 31,32 | 12; 12:00 PM |
| 32,34 | 24; 24 minutes (i.e., 12:24 PM) |
| 36,30,39,35,35,35,31,32,31,32 | (609) 555-1212; calling party's directory number |
| 51h | Checksum Word |
To receive CND information, the modem monitors the phone line between the first and second ring bursts without causing the DAA to go off hook in the conventional sense, which would inhibit the transmission of CND by the local central office. A simple modification to an existing DAA circuit easily accomplishes the task.
Although the data signalling interface parameters match those of a Bell 202 modem, the receiving CPE need not be a Bell 202 modem. A V.23 1200 bps modem receiver may be used to demodulate the Bell 202 signal. The ring indicate bit (RI) may be used on a modem to indicate when to monitor the phone line for CND information. After the RI bit sets, indicating the first ring burst, the host waits for the RI bit to reset. The host then configures the modem to monitor the phone line for CND information.
According to Bellcore specifications, CND signalling starts as early as 300 mS after the first ring burst and ends at least 475 mS before the second ring burst
Once CND information is received the user may process the information in a number of ways.
For more information on Calling Number Delivery (CND), refer to Bellcore publications TR-TSY-000030 and TR-TSY-000031.
To obtain Bellcore documents contact:
Bellcore Customer Service
60 New England Avenue, Room 1B252 Piscataway, NJ 08834-4196
(908) 699-5800
Always test as much as possible before relying on any method of blocking Caller-ID. Some of these methods work in some areas, but not in others.
Forward your phone line to a friend who lives in another LATA. When he receives the anonymous phone call, have him use *69 Call Return to dial to offending party back. As he is now placing a long distance phone call, the telephone number of the anonymous caller will show up on your friends phone bill at the end of the month.
A variation of this system is available in areas where the local phone company offers per-call billing (as opposed to unlimited flat rate local calling) and where the local phone company issues itemized bills on those local phone calls. In those areas, you can switch your phone line to itemized local calling, *69 Call Return the anonymous telephone call, and read the anonymous callers telephone number at the end of the month.
If you are particularly anxious, you can often request your toll records from your local telephone company without waiting for your final bill.
A PBX (Private Branch Exchange) is a small telephone switch owned by a company or organization. These organizations purchase PBX's to reduce the total number of telephone lines they need to lease from the telephone company. Without a PBX, a company will need to lease one telephone line for every employee with a telephone.
With a PBX, every employees telephone line is wired to the PBX. When an employee takes the receiver off hook (i.e. picks up the telephone) and dials the outside access code (usually 9), the PBX connect the employee to an outside line (often, though somewhat incorrectly, referred to as a trunk). With a PBX, the company only needs to lease as many lines from the telephone company as the maximum number of employees that will be making outside calls at one time. This is usually around 10% of the number of extensions.
Two common PBX systems are AT&T's Definity series (also known as the System 75 and Sytem 85) and Northern Telecom's Meridian series. Other manufacturers include ROLM, Siemens, NEC, and Mitel.
A VMB (Voice Mail Box) is a computer that acts as an answering machine for hundreds or thousands of users. Each user will have their own Voice Mail Box on the system. Each mail box will have a box number and a pass code.
Without a passcode, you will usually be able to leave messages to users on the VMB system. With a passcode, you can read messages and administer a mailbox. Often, mailboxes will exist that were created by default or are no longer used. These mailboxes may be taken over by guessing their passcode. Often the passcode will be the mailbox number or a common number such as 1234.
Two common VMB systems are AT&T's Audix system and Northern Telecom's Meridian Mail.
The ABCD tones are simply additional DTFM tones that may be used in any way the standard (0-9) tones are used. The ABCD tones are used in the U.S. military telephone network (AutoVon), in some Automatic Call Distributor (ACD) systems, for control messages in some PBX systems, and in some amateur radio auto-patches.
In the AutoVon network, special telephones are equipped with ABCD keys. The ABCD keys are defined as such:
A - Flash B - Flash override priority C - Priority communication D - Priority override
Using a built-in maintenance mode of the Automatic Call Distributor (ACD) systems once used by Directory Assistance operators, you could connect two callers together.
The purpose of the Silver Box is to create the ABCD tones.
See also "What are the DTMF Frequencies?"
The numbers are used so that you may connect to an operator from a foreign telephone network, without incurring long distance charges. These numbers may be useful in blue boxing, as many countries still have older switching equipment in use.
Australia (800)682-2878 Austria (800)624-0043 Belgium (800)472-0032 Belize (800)235-1154 Bermuda (800)232-2067 Brazil (800)344-1055 British VI (800)278-6585 Cayman (800)852-3653 Chile (800)552-0056 China (Shanghai) (800)532-4462 Costa Rica (800)252-5114 Denmark (800)762-0045 El Salvador (800)422-2425 Finland (800)232-0358 France (800)537-2623 Germany (800)292-0049 Greece (800)443-5527 Guam (800)367-4826 HK (800)992-2323 Hungary (800)352-9469 Indonesia (800)242-4757 Ireland (800)562-6262 Italy (800)543-7662 Japan (800)543-0051 Korea (800)822-8256 Macau (800)622-2821 Malaysia (800)772-7369 Netherlands (800)432-0031 Norway (800)292-0047 New Zealand (800)248-0064 Panama (800)872-6106 Portugal (800)822-2776 Philippines (800)336-7445 Singapore (800)822-6588 Spain (800)247-7246 Sweden (800)345-0046 Taiwan (800)626-0979 Thailand (800)342-0066 Turkey (800)828-2646 UK (800)445-5667 Uruguay (800)245-8411 Yugoslavia (800)367-9842 (Belgrade)
367-9841 (Zagreb)USA from outside (800)874-4000 Ext. 107
SWITCH VENDOR TYPE DESCRIPTION 1AES AT&T Analog No. 1A ESS 1ES AT&T Analog No. 1 ESS 2BES AT&T Analog No. 2B ESS 2ES AT&T Analog No. 2 ESS 3ES AT&T Analog No. 3 ESS 3XB AT&T E/M No. 3 Cross-Bar 4ES AT&T Digital No. 4 ESS 5AXB AT&T E/M No. 5A Cross-Bar 5ES AT&T Digital No. 5 ESS 5ORM AT&T Digital Optical Remote Module 5RSM AT&T Digital Remote Switching Module 5XB AT&T E/M No. 5 Cross-Bar AXE10 Ericsson Digital Stand Alone or Host AXRSS Ericsson Digital Remote DGTL Digital Generic Digital Switch DMS1/200 NTI Digital DMS 100/200 DMS10 NTI Digital DMS 10 DMS100 NTI Digital DMS 100 DMS200 NTI Digital DMS 200 DPN NTI Packet Packet Switch EDX Siemens Packet Packet Switch NC23 NEC E/M NEC Cross-Bar NEAX61E NEC Digital NEC switch RLCM NTI Digital Remote Line Conc Module RLCM-10 NTI Digital Remote Line Conc Module RLM NTI Digital Remote Line Module RSC NTI Digital Remote Switching Center RSCI NTI Digital ISDN RSC RSLE NTI Digital Remote Subscr Line Equip RSM AT&T Digital Remote Switching System RSS AT&T Analog Remote Switching System RSU Digital Generic Remote Switching Unit SXS AT&T E/M Step by Step
| #hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony |
| Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous |
| © 1994 - 2003 HackFAQ.org
All Rights Reserved |