Search the FAQ Archives

3 - A - B - C - D - E - F - G - H - I - J - K - L - M
N - O - P - Q - R - S - T - U - V - W - X - Y - Z - Internet FAQ Archives

alt.2600 FAQ Revision .014 (2/4)

( Part1 - Part2 - Part3 - Part4 )
[ Usenet FAQs | Web FAQs | Documents | RFC Index | Forum archive ]
Archive-Name: alt-2600/faq/part2
Posting-Frequency: Random
Last-Modified: 2000/05/29
Version: .014

See reader questions & answers on this topic! - Help others by sharing your knowledge
register u_int pktlen;
 register struct ip     *ip;
 register struct tcphdr *tcph;

 { register u_short EtherType=ntohs(((struct
                        ether_header *)cp)->ether_type);

   if(EtherType < 0x600) {
     EtherType = *(u_short *)(cp + SZETH + 6);
     cp+=8; pktlen-=8;

   if(EtherType != ETHERTYPE_IP) /* chuk it if its not IP */

    /* ugh, gotta do an alignment :-( */
 bcopy(cp + SZETH, (char *)Packet,(int)(pktlen - SZETH));

 ip = (struct ip *)Packet;
 if( ip->ip_p != IPPROTO_TCP) /* chuk non tcp pkts */
 tcph = (struct tcphdr *)(Packet + IPHLEN);

 if(!( (TCPD == IPPORT_TELNET) ||
       (TCPD == IPPORT_FTP)
   )) return;

 { register struct CREC *CLm;
   register int length = ((IPLEN - (IPHLEN * 4)) - (TCPOFF * 4));
   register u_char *p = (u_char *)Packet;

   p += ((IPHLEN * 4) + (TCPOFF * 4));

 if(debug) {
  fprintf(LOG,"PKT: (%s %04X) ", TCPflags(tcph->th_flags),length);
  fprintf(LOG,"%s[%s] => ", inet_ntoa(IPS),SERVp(TCPS));
  fprintf(LOG,"%s[%s]\n", inet_ntoa(IPD),SERVp(TCPD));

   if( CLm = GET_NODE(IPS, TCPS, IPD, TCPD) ) {


        if( (CLm->Length + length) < MAXBUFLEN ) {
          ADDDATA_NODE( CLm, p,length);
        } else {
          END_NODE( CLm, p,length, "DATA LIMIT");

      if(TCPFL(TH_FIN|TH_RST)) {
          END_NODE( CLm, (u_char *)NULL,0,
                TCPFL(TH_FIN)?"TH_FIN":"TH_RST" );

   } else {

      if(TCPFL(TH_SYN)) {





/* signal handler
void death()
{ register struct CREC *CLe;

        END_NODE( CLe, (u_char *)NULL,0, "SIGNAL");

    fprintf(LOG,"\nLog ended at => %s\n",NOWtm());
    if(LOG != stdout)

/* opens network interface, performs ioctls and reads from it,
 * passing data to filter function
void do_it()
    int cc;
    char *buf;
    u_short sp_ts_len;

        Pexit(1,"Eth: malloc");

/* this /dev/nit initialization code pinched from etherfind */
    struct strioctl si;
    struct ifreq    ifr;
    struct timeval  timeout;
    u_int  chunksize = CHUNKSIZE;
    u_long if_flags  = NI_PROMISC;

    if((if_fd = open(NIT_DEV, O_RDONLY)) < 0)
        Pexit(1,"Eth: nit open");

    if(ioctl(if_fd, I_SRDOPT, (char *)RMSGD) < 0)
        Pexit(1,"Eth: ioctl (I_SRDOPT)");

    si.ic_timout = INFTIM;

    if(ioctl(if_fd, I_PUSH, "nbuf") < 0)
        Pexit(1,"Eth: ioctl (I_PUSH \"nbuf\")");

    timeout.tv_sec = 1;
    timeout.tv_usec = 0;
    si.ic_cmd = NIOCSTIME;
    si.ic_len = sizeof(timeout);
    si.ic_dp  = (char *)&timeout;
    if(ioctl(if_fd, I_STR, (char *)&si) < 0)
        Pexit(1,"Eth: ioctl (I_STR: NIOCSTIME)");

    si.ic_cmd = NIOCSCHUNK;
    si.ic_len = sizeof(chunksize);
    si.ic_dp  = (char *)&chunksize;
    if(ioctl(if_fd, I_STR, (char *)&si) < 0)
        Pexit(1,"Eth: ioctl (I_STR: NIOCSCHUNK)");

    strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
    ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0';
    si.ic_cmd = NIOCBIND;
    si.ic_len = sizeof(ifr);
    si.ic_dp  = (char *)&ifr;
    if(ioctl(if_fd, I_STR, (char *)&si) < 0)
        Pexit(1,"Eth: ioctl (I_STR: NIOCBIND)");

    si.ic_cmd = NIOCSFLAGS;
    si.ic_len = sizeof(if_flags);
    si.ic_dp  = (char *)&if_flags;
    if(ioctl(if_fd, I_STR, (char *)&si) < 0)
        Pexit(1,"Eth: ioctl (I_STR: NIOCSFLAGS)");

    if(ioctl(if_fd, I_FLUSH, (char *)FLUSHR) < 0)
        Pexit(1,"Eth: ioctl (I_FLUSH)");

    while ((cc = read(if_fd, buf, CHUNKSIZE)) >= 0) {
        register char *bp = buf,
                      *bufstop = (buf + cc);

        while (bp < bufstop) {
            register char *cp = bp;
            register struct nit_bufhdr *hdrp;

            hdrp = (struct nit_bufhdr *)cp;
            cp += sizeof(struct nit_bufhdr);
            bp += hdrp->nhb_totlen;
            filter(cp, (u_long)hdrp->nhb_msglen);
    Pexit((-1),"Eth: read");
 /* Authorize your program, generate your own password and uncomment here */
/* #define AUTHPASSWD "EloiZgZejWyms" */

void getauth()
{ char *buf,*getpass(),*crypt();
  char pwd[21],prmpt[81];

    sprintf(prmpt,"(%s)UP? ",ProgName);
void main(argc, argv)
int argc;
char **argv;
    char   cbuf[BUFSIZ];
    struct ifconf ifc;
    int    s,


 /*     getauth(); */

    while((ac<argc) && (argv[ac][0] == '-')) {
       register char ch = argv[ac++][1];
       switch(toupper(ch)) {
            case 'I': device=argv[ac++];
            case 'F': if(!(LOG=fopen((LogName=argv[ac++]),"a")))
                         Zexit(1,"Output file cant be opened\n");
            case 'B': backg=1;
            case 'D': debug=1;
            default : fprintf(ERR,
                       "Usage: %s [-b] [-d] [-i interface] [-f file]

    if(!device) {
        if((s=socket(AF_INET, SOCK_DGRAM, 0)) < 0)
            Pexit(1,"Eth: socket");

        ifc.ifc_len = sizeof(cbuf);
        ifc.ifc_buf = cbuf;
        if(ioctl(s, SIOCGIFCONF, (char *)&ifc) < 0)
            Pexit(1,"Eth: ioctl");

        device = ifc.ifc_req->ifr_name;

    fprintf(ERR,"Using logical device %s [%s]\n",device,NIT_DEV);
    fprintf(ERR,"Output to %s.%s%s",(LOG)?LogName:"stdout",
            (debug)?" (debug)":"",(backg)?" Backgrounding ":"\n");


    signal(SIGINT, death);

    if(backg && debug) {
         fprintf(ERR,"[Cannot bg with debug on]\n");

    if(backg) {
        register int s;

        if((s=fork())>0) {
           fprintf(ERR,"[pid %d]\n",s);
        } else if(s<0)

        if( (s=open("/dev/tty",O_RDWR))>0 ) {
                ioctl(s,TIOCNOTTY,(char *)NULL);
    fprintf(LOG,"\nLog started at => %s [pid %d]\n",NOWtm(),getpid());



B-06. What is an Internet Outdial?

An Internet outdial is a modem connected to the Internet than you can
use to dial out.  Normal outdials will only call local numbers.  A GOD
(Global OutDial) is capable of calling long distance.  Outdials are an
inexpensive method of calling long distance BBS's.


B-07. What are some Internet Outdials?

This FAQ answer is excerpted from CoTNo #5:

                        Internet Outdial List v3.0
                         by Cavalier and DisordeR

There are several lists of Internet outdials floating around the net
these days. The following is a compilation of other lists, as well as
v2.0 by DeadKat(CoTNo issue 2, article 4). Unlike other lists where the
author just ripped other people and released it, we have sat down and
tested each one of these. Some of them we have gotten "Connection
Refused" or it timed out while trying to connect...these have been
labeled dead.

                           Working Outdials
                            as of 12/29/94

  NPA          IP Address                   Instructions
  ---          ----------                   ------------
  215                modem

  217       atdt x,xxxXXXXX

  218              atdt9,xxxXXXX

  303 3020

  412 2600    Press D at the prompt

  412            tn3270,

  413   Ctrl } gets ENTER NUMBER: xxxxxxx


  502                connect kecnet
                                            @ dial: "outdial2400 or

  602        atdt8,,,,,[x][yyy]xxxyyyy



  713               atdt x,xxxXXXX

  714            atdt[area]0[phone]

  804           connect hayes, 9,,xxx-xxxx

  804      connect telnet
                                            connect hayes

                             Need Password
  206    This is an unbroken password
  303          yuma.ACNS.ColoState.EDU      login: modem
  404                .modem8|CR
  415          annex132-1.EECS.Berkeley.EDU "dial1" or "dial2" or
  514          cartier.CC.UMontreal.CA      externe,9+number
  703          dial2400 -aa

                            Dead/No Connect

  201          idsnet
  204         "dial12" or "dial24"
  212          B719-7e.NYU.EDU              dial3/dial12/dial24
  212          B719-7f.NYU.EDU              dial3/dial12/dial24
  212          DIALOUT-1.NYU.EDU            dial3/dial12/dial24
  212          FREE-138-229.NYU.EDU         dial3/dial12/dial24
  212          UP19-4b.NYU.EDU              dial3/dial12/dial24
  215      "atz" "atdt 9xxxyyyy"
  218               "cli" "rlogin modem"
                                            at "login:"  type "modem"
  218              Hayes 9,XXX-XXXX
  307               Hayes  0,XXX-XXXX
  313                     dial2400-aa or dial1200-aa
                                            or dialout
  404       ".modem8" or ".dialout"
  416         atdt 9,,,,, xxx-xxxx
  416        modem
  514          pacx.CC.UMontreal.CA         externe#9 9xxx-xxxx
  609 (X= 1 - 4)   Hayes
  609  (x = 1 to 4)
  614   "dial"
  615                  dial2400 D 99k #
  615          MATHSUN23.MATH.UTK.EDU       dial 2400  d  99Kxxxxxxx
  617                  2400baud
  617          isdn3.Princeton.EDU
  617          jadwingymkip0.Princeton.EDU
  617          lord-stanley.Princeton.EDU
  617          mpanus.Princeton.EDU
  617          old-dialout.Princeton.EDU
  617          stagger.Princeton.EDU
  617          waddle.Princeton.EDU
  619                  atdt [area][phone]
  619              "dialout"
  713              "c modem96"  "atdt 9xxx-xxxx"
                                            or "Hayes"
  714             atdt 8xxx-xxxx
  801              "C Modem"
  902             "dialout"
  916          connect hayes/dialout
  916  UCDNET <ret> C KEYCLUB <ret>
  ???              (1 - 4)
  ???             nue, X to discontinue, ? for Help
  ???                  ntu            <none>
  ???           cs8005
  ???            guest           <none>
  ???           u349633
  ???           ?
  ???          guest           <none>
  ???            "CALL" or "call"

If you find any of the outdials to have gone dead, changed commands,
or require password, please let us know so we can keep this list as
accurate as possible. If you would like to add to the list, feel free
to mail us and it will be included in future versions of this list,
with your name beside it. Have fun...

[Editors note: Updates have been made to this document after
               the original publication]


B-08. What port is XXX on?

The file /etc/services on most Unix machines lists the port
assignments for that machine.  For a complete list of port
assignments, read RFC (Request For Comments) 1700 "Assigned Numbers"


B-09. What is an anonymous remailer?

This FAQ answer was written by Raph Levien:

An anonymous remailer is a system on the Internet that allows you to
send e-mail or post messages to Usenet anonymously.

There are two sorts of remailers in widespread use.  The first is the style, the second is the cypherpunk style.  The remailer
at is immensely popular, with over 160,000 users over its
lifetime, and probably tens of thousands of messages per day.  Its main
advantage is that it's so easy to use.  The cypherpunks mailers, which
provide much better security, are becoming more popular, however, as
there is more awareness of them.

The user of the system first needs to get an anonymous id.
This is done either by sending mail to somebody who already has one (for
example, by replying to a post on Usenet), or sending mail to  In either case, penet will mail back the new anon
id, which looks like  If an123456 then sends
mail to another user of the system, then this is what happens:

1.  The mail is transported to, which resides somewhere in
    the vicinity of Espoo, Finland.

2.  These steps are carried out by software running on
    Penet first looks up the email address of the sender in its
    database, then replaces it with the numeric code.  All other
    information about the sender is removed.

3.  Then, penet looks up the number of the recipient in the same
    database, and replaces it with the actual email address.

4.  Finally, it sends the mail to the actual email address of the

There are variations on this scheme, such as posting to Usenet (in which
step 3 is eliminated), but that's the basic idea.

Where uses a secret database to match anon id's to actual
email addresses, the cypherpunks remailers use cryptography to hide the
actual identities.  Let's say I want to send email to a real email
address, or post it to Usenet, but keep my identity completely hidden.
To send it through one remailer, this is what happens.

1.  I encrypt the message and the recipient's address, using the public
    key of the remailer of my choice.

2.  I send the email to the remailer.

3.  When the remailer gets the mail, it decrypts it using its private
    key, revealing as plaintext the message and the recipient's

4.  All information about the sender is removed.

5.  Finally, it sends it to the recipient's email address.

If one trusts the remailer operator, this is good enough.  However, the
whole point of the cypherpunks remailers is that you don't _have_ to
trust any one individual or system.  So, people who want real security
use a chain of remailers.  If any one remailer on the "chain" is honest,
then the privacy of the message is assured.

To use a chain of remailers, I first have to prepare the message, which
is nestled within multiple layers of encryption, like a Russian
matryoshka doll.  Preparing such a message is tedious and error prone,
so many people use an automated tool such as my premail package. Anyway,
after preparing the message, it is sent to the first remailer in the
chain, which corresponds to the outermost layer of encryption. Each
remailer strips off one layer of encryption and sends the message to the
next, until it reaches the final remailer.  At this point, only the
innermost layer of encryption remains.  This layer is stripped off,
revealing the plaintext message and recipient for the first time.  At
this point, the message is sent to its actual recipient.

Remailers exist in many locations.  A typical message might go through
Canada, Holland, Berkeley, and Finland before ending up at its final

Aside from the difficulty of preparing all the encrypted messages,
another drawback of the cypherpunk remailers is that they don't easily
allow responses to anonymous mail.  All information about the sender is
stripped away, including any kind of return address.  However the new
alias servers promise to change that.  To use an alias server, one
creates a new email address (mine is  Mail sent to
this new address will be untraceably forwarded to one's real address.

To set this up, one first encrypts one's own email address with multiple
layers of encryption.  Then, using an encrypted channel, one sends the
encrypted address to the alias server, along with the nickname that one
would like.  The alias server registers the encrypted address in the
database.  The alias server then handles reply mail in much the same way
as, except that the mail is forwarded to the chain of
anonymous remailers.

For maximum security, the user can arrange it so that, at each link in
the chain, the remailer adds another layer of encryption to the message
while removing one layer from the email address.  When the user finally
gets the email, it is encrypted in multiple layers.  The matryoshka has
to be opened one doll at a time until the plaintext message hidden
inside is revealed.

One other point is that the remailers must be reliable in order for all
this to work.  This is especially true when a chain of remailers is used
-- if any one of the remailers is not working, then the message will be
dropped.  This is why I maintain a list of reliable remailers. By
choosing reliable remailers to start with, there is a good chance the
message will finally get there.


B-10. What are the addresses of some anonymous remailers?

To see a comprehensive list on anonymous remailers point your web
browser to

For more information regarding anonymous email, check out

The following URL's allow you to send anonymous e-mail via the world
wide web:


B-11. What is is a loopback network connection.  If you telnet, ftp, etc...
to it you are connected to your own machine.

[Note from Dan Mellem: is commonly used as the loopback
address. H.]


B-12. How do I post to a moderated newsgroup?

Usenet messages consist of message headers and message bodies.  The
message header tells the news software how to process the message.
Headers can be divided into two types, required and optional. Required
headers are ones like "From" and "Newsgroups."  Without the required
headers, your message will not be posted properly.

One of the optional headers is the "Approved" header.  To post to a
moderated newsgroup, simply add an Approved header line to your
message header.  The header line should contain the newsgroup
moderators e-mail address.  To see the correct format for your target
newsgroup, save a message from the newsgroup and then look at it using
any text editor.

A "Approved" header line should look like this:


There cannot not be a blank line in the message header.  A blank line
will cause any portion of the header after the blank line to be
interpreted as part of the message body.

For more information, read RFC 1036: Standard for Interchange of
USENET messages.


B-13. How do I post to Usenet via e-mail?

Through an e-mail->Usenet gateway.  Send an a e-mail messages to
<newsgroup>@<servername>.  For example, to post to alt.2600 through, address your mail to

Here are a few e-mail->Usenet gateways:


B-14. What is a firewall?

A firewall is a system that is set up to control traffic flow between
two networks.  Firewalls are most commonly specially configured Unix
systems, but firewalls have also been built out of many other systems,
including systems designed specifically for use as firewalls.  The most
common firewall today is CheckPoint FireWall-1, but competitions such as
Cisco's PIX are quickly catching up on CheckPoint.

Many people disagree on the definiton of a firewall, and in this
discussion I will use the term loosely.

One type of firewall is the packet filtering firewall.  In a packet
filtering firewall, the firewall examines five characteristics of a

        Source IP address
        Source port
        Destination IP address
        Destination port
        IP protocol (TCP or UDP)

Based upon rules configured into the firewall, the packet will either be
allowed through, rejected, or dropped.  If the firewall rejects the
packet, it sends a message back to the sender letting him know that the
packet was rejected.  If the packet was dropped, the firewall simply
does not respond to the packet.  The sender must wait for the
communications to time out.  Dropping packets instead of rejecting them
greatly increases the time required to scan your network. Packet
filtering firewalls operate on Layer 3 of the OSI model, the Network
Layer.  Routers are a very common form of packet filtering firewall.

An improved form of the packet filtering firewall is a packet filtering
firewall with a stateful inspection engine.  With this enhancement, the
firewall "remembers" conversations between systems.  It is then
necessary to fully examine only the first packet of a conversation.

Another type of firewall is the application-proxy firewall.  In a
proxying firewall, every packet is stopped at the firewall.  The packet
is then examined and compared to the rules configured into the firewall.
If the packet passes the examinations, it is re-created and sent out.
Because each packet is destroyed and re-created, there is a potential
that an application-proxy firewall can prevent unknown attacks based
upon weaknesses in the TCP/IP protocol suite that would not be prevented
by a packet filtering firewall.  The drawback is that a separate
application-proxy must be written for each application type being
proxied.  You need an HTTP proxy for web traffic, an FTP proxy for file
transfers, a Gopher proxy for Gopher traffic, etc...  Application- proxy
firewalls operate on Layer 7 of the OSI model, the Application Layer.

Application-gateway firewalls also operate on Layer 7 of the OSI model.
Application-gateway firewalls exist for only a few network applications.
A typical application-gateway firewall is a system where you must telnet
to one system in order telnet again to a system outside of the network.

Another type of application-proxy firewall are SOCKS firewalls.  Where
normal application-proxy firewalls do not require modifications to
network clients, SOCKS firewalls requires specially modified network
clients.  This means you have to modify every system on your internal
network which needs to communicate with the external network.  On a
Windows or OS/2 system, this can be as easy as swapping a few DLL's.


B-15. How do I attack a remote network across the Internet?

On a theoretical level, attacking a remote network across the Internet
is very simple.

First, you research to discover all of the IP address ranges used by the
target.  Search the web, search Usenet, search Internet, search RIPE,
search APNIC, search everywhere.

Second, you identify all hosts in those IP address ranges.  This may be
as simple as pinging each possible host in those networks.  Be warned,
however, that many hosts will be protected by firewalls that prvent ICMP
ECHO Requests (used by ping) from reaching them.  Those hosts may still
have vulnerable services running on them.

Third, you identify all open ports on each of those hosts.  For example,
one host may be providing dns, bootp, and time services.  This is
normally done by "port scanning" the host.  Port scanning UDP ports is
much slower than port scanning TCP ports.  TCP ports will respond
negatively when they are not open.  UDP ports require you to wait for a
timeout.  You may choose to scan only known ports, or to scan only ports
below 1024, or to scan all 65,535 ports.

Fourth, you attack vulnerable services.  If you see a time server
running and you know of a time server exploit, you try it out. Perhaps
the target is running an OS that is not vulnerable, or perhaps the
system administrator has patched the target host.  Or, maybe you will
succeed.  Vulnerability information can be gleaned from Internet WWW
sites or mailing lists, traded privately, or developed on your own.


B-16. What is a TCP sequence prediction attack?

TCP is a reliable connection-oriented layer 4 (Transport Layer)
protocol.  Packet transfer between hosts is accomplished by the layers
below layer 4 and TCP takes responsibility to making certain the packets
are delivered to higher layers in the protocol stack in the correct
order.  To accomplish this reordering task, TCP uses the sequence number

To successfully mount a TCP sequence prediction attack, you must first
listen to communications between two systems, one of which is your
target system.  Then, you issue packets from your system to the target
system with the source IP address of the trusted system that is
communicating with the target system.

The packets you issue must have the sequence numbers that the target
system is expecting.  In addition, your packets must arrive before the
packets from the trusted system whose connection you are hijacking. To
accomplish this, it is often necessary to flood the trusted system off
of the network with some form of denial of service attack.

Once you have taken over the connection, you can send data to allow you
to access the target host using a normal TCP/IP connection.  The most
simple way to do this is:

        echo "+ +" > /.rhosts

This specific technique relies upon inherent weaknesses in the BSD Unix
`r` services.  However, SunRPC, NFS, X-Windows, and many other services
which rely upon IP address authentication can be exploited with a TCP
sequence prediction attack.

An excerpt from RFC 793 concering the generation of TCP sequence

        When new connections are created, an initial sequence number
        (ISN) generator is employed which selects a new 32 bit ISN. The
        generator is bound to a (possibly fictitious) 32 bit clock whose
        low order bit is incremented roughly every 4 microseconds. Thus,
        the ISN cycles approximately every 4.55 hours. Since we assume
        that segments will stay in the network no more than the Maximum
        Segment Lifetime (MSL) and that the MSL is less than 4.55 hours
        we can reasonably assume that ISN's will be unique.

The developers of the BSD Unix TCP/IP stack did not follow these
recommendations.  TCP/IP stacks based upon BSD Unix increase the
sequence number by 128,000 every second and by 64,000 for every new TCP
connection.  This is significantly more predictable than the algorithm
specified in the RFC.

TCP sequence prediction attacks are stopped by any router or firewall
that is configured not to allow packets from an internal IP address to
originate from an external interface.

                           TCP Header Format

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   |          Source Port          |       Destination Port        |
   |                        Sequence Number                        |
   |                    Acknowledgment Number                      |
   |  Data |           |U|A|P|R|S|F|                               |
   | Offset| Reserved  |R|C|S|S|Y|I|            Window             |
   |       |           |G|K|H|T|N|N|                               |
   |           Checksum            |         Urgent Pointer        |
   |                    Options                    |    Padding    |
   |                             data                              |

=-=-=-=-=-=-=-=-=-=-=-=  Section C -- Telephony  =-=-=-=-=-=-=-=-=-=-=-=-=

C-01. What is a Red Box?

When a coin is inserted into a payphone, the payphone emits a set of
tones to ACTS (Automated Coin Toll System).  Red boxes work by fooling
ACTS into believing you have actually put money into the phone.  The red
box simply plays the ACTS tones into the telephone microphone. ACTS
hears those tones, and allows you to place your call.  The actual tones

35-160ms 1700hz & 2200hz tone burst, followed by 240ms of silence.

Two 35-160ms 1700hz & 2200hz bursts, with a spacing of 20-110ms between
the bursts, followed by 165 ms of silence.

Five 1700hz & 2200hz bursts, with the first and last being 20-100ms in
length, and the second through fourth being 20-60ms in length.  The
spacing between the first and second bursts is 20-110ms, while the
spacing between the following bursts is 20-60ms. The tones are followed
by 60ms of silence.

Canada uses a variant of ACTSD called N-ACTS.  N-ACTS uses different
tones than ACTS.  In Canada, the tones to use are:

Nickel Signal      2200hz       0.060s on
Dime Signal        2200hz       0.060s on, 0.060s off, twice repeating
Quarter Signal     2200hz       33ms on, 33ms off, 5 times repeating


C-02. How do I build a Red Box?

Red boxes are commonly manufactured from Radio Shack tone dialers,
Hallmark greeting cards, or made from scratch from readily available
electronic components.

To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open
the dialer and replace the crystal with a new one. The purpose of the
new crystal is to cause the * button on your tone dialer to create a
1700hz and 2200hz tone instead of the original 941hz and 1209hz tones.
The exact value of the replacement crystal should be 6.466806 to create
a perfect 1700hz tone and 6.513698 to create a perfect 2200hz tone.  A
crystal close to those values will create a tone that easily falls
within the loose tolerances of ACTS. The most popular choice is the
6.5536Mhz crystal, because it is the easiest to procure.  The old
crystal is the large shiny metal component labeled "3.579545Mhz." When
you are finished replacing the crystal, program the P1 button with five
*'s.  That will simulate a quarter tone each time you press P1.

You can record the ACTS tones and play them back into the telephone.
This is what is done with the Hallmark greeting card.  Alternatively,
you can build your own circuit using any voice recording chip, such as
Radio Shack catalog number 276-1325.


C-03. Where can I get a 6.5536Mhz crystal?

Your best bet is a local electronics store.  Radio Shack sells them, but
they are overpriced and the store must order them in.  This takes
approximately two weeks.  In addition, many Radio Shack employees do not
know that this can be done.

Or, you could order the crystal mail order.  This introduces Shipping
and Handling charges, which are usually much greater than the price of
the crystal.  It's best to get several people together to share the S&H
cost.  Or, buy five or six yourself and sell them later.  Some of the
places you can order crystals are:

701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
Part Number:X415-ND    /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND

JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
Part Number: 6.5536MHZ

Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
Part Number: 10068625

2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057

Part Number: 332-1066

Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b

Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: 1-800-824-3432
Part Number: CR6.5


C-04. Which payphones will a Red Box work on?

Red Boxes will work on telco owned payphones, but not on COCOT's
(Customer Owned Coin Operated Telephones).

Red boxes work by fooling ACTS (Automated Coin Toll System) into
believing you have put money into the pay phone.  ACTS is the
telephone company software responsible for saying "Please deposit XX
cents" and listening for the coins being deposited.

COCOT's do not use ACTS.  On a COCOT, the pay phone itself is
responsible for determining what coins have been inserted.


C-05. How do I make local calls with a Red Box?

Payphones do not use ACTS for local calls.  To use your red box for
local calls, you have to fool ACTS into getting involved in the call.

One way to do this, in some areas, is by dialing an Equal Access Code
before the number you are dialing.  For example, to use 10288 (an Equal
Access Code belonging to AT&T), dial 10288-xxx-xxxx.  This makes your
call a long distance call, and brings ACTS into the picture.  There are
quite a large number of Equal Access Codes available in most geographic

[Note from Dan Mellem: The access codes are now 1010xxx, so AT&T is
1010288+. H.]

In other areas, you can call Directory Assistance and ask for the
number of the person you are trying to reach.  The operator will give
you the number and then you will hear a message similar to "Your call
can be completed automatically for an additional 35 cents."  When this
happens, you can then use ACTS tones.

Another operator scam involves calling (800) long distance operators,
asking them to connect you, and then playing the ACTS tones.  This
will get ACTS involved, even on COCOT's!

I have heard that in some areas you can dial local calls as if they were
long distance.  For example, to dial 345-4587 to would dial
303-345-4587.  This does not work on payphones in my area.


C-06. What is a Blue Box?

Blue boxes use a 2600hz tone to size control of telephone switches
that use in-band signalling.  The caller may then access special
switch functions, with the usual purpose of making free long distance
phone calls, using the tones provided by the Blue Box.


C-07. Do Blue Boxes still work?

This FAQ answer is excerpted from a message posted to Usenet by
Marauder of the Legion of Doom:

        Somewhere along the line I have seen reference to something
        similar to "Because of ESS Blue boxing is impossible".  This is
        incorrect.  When I lived in Connecticut I was able to blue box
        under Step by Step, #1AESS, and DMS-100.  The reason is simple,
        even though I was initiating my call to an 800 number from a
        different exchange (Class 5 office, aka Central Office) in each
        case, when the 800 call was routed to the toll network it would
        route through the New Haven #5 Crossbar toll Tandem office. It
        just so happens that the trunks between the class 5 (CO's) and
        the class 4 (toll office, in this case New Haven #5 Xbar),
        utilized in-band (MF) signalling, so regardless of what I
        dialed, as long as it was an Inter-Lata call, my call would
        route through this particular set of trunks, and I could Blue
        box until I was blue in the face.  The originating Central
        Offices switch (SXS/ESS/Etc..) had little effect on my ability
        to box at all.  While the advent of ESS (and other electronic
        switches) has made the blue boxers task a bit more difficult,
        ESS is not the reason most of you are unable to blue box.  The
        main culprit is the "forward audio mute" feature of CCIS (out of
        band signalling).  Unfortunately for the boxer 99% of the Toll
        Completion centers communicate using CCIS links, This spells
        disaster for the blue boxer since most of you must dial out of
        your local area to find trunks that utilize MF signalling, you
        inevitably cross a portion of the network that is CCIS equipped,
        you find an exchange that you blow 2600hz at, you are rewarded
        with a nice "winkstart", and no matter what MF tones you send at
        it, you meet with a re-order.  This is because as soon as you
        seized the trunk (your application of 2600hz), your Originating
        Toll Office sees this as a loss of supervision at the
        destination, and Mutes any further audio from being passed to
        the destination (ie: your waiting trunk!).  You meet with a
        reorder because the waiting trunk never "hears" any of the MF
        tones you are sending, and it times out.  So for the clever
        amongst you, you must somehow get yourself to the 1000's of
        trunks out there that still utilize MF signalling but
        bypass/disable the CCIS audio mute problem.  (Hint: Take a close
        look at WATS extenders).


C-08. What is a Black Box?

A Black Box is a resistor (and often capacitor in parallel) placed in
series across your phone line to cause the phone company equipment to be
unable to detect that you have answered your telephone.  People who call
you will then not be billed for the telephone call.  Black boxes do not
work under ESS.


C-09. What do all the colored boxes do?

Acrylic      Steal Three-Way-Calling, Call Waiting and programmable
             Call Forwarding on old 4-wire phone systems
Aqua         Drain the voltage of the FBI lock-in-trace/trap-trace
Beige        Lineman's hand set
Black        Allows the calling party to not be billed for the call
Blast        Phone microphone amplifier
Blotto       Supposedly shorts every phone out in the immediate area
Blue         Emulate a true operator by seizing a trunk with a 2600hz
Brown        Create a party line from 2 phone lines
Bud          Tap into your neighbors phone line
Chartreuse   Use the electricity from your phone line
Cheese       Connect two phones to create a diverter
Chrome       Manipulate Traffic Signals by Remote Control
Clear        A telephone pickup coil and a small amp used to make free
             calls on Fortress Phones
Color        Line activated telephone recorder
Copper       Cause crosstalk interference on an extender
Crimson      Hold button
Dark         Re-route outgoing or incoming calls to another phone
Dayglo       Connect to your neighbors phone line
Diverter     Re-route outgoing or incoming calls to another phone
DLOC         Create a party line from 2 phone lines
Gold         Dialout router
Green        Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity     Remotely activated phone tap
Jack         Touch-Tone key pad
Light        In-use light
Lunch        AM transmitter
Magenta      Connect a remote phone line to another remote phone line
Mauve        Phone tap without cutting into a line
Neon         External microphone
Noise        Create line noise
Olive        External ringer
Party        Create a party line from 2 phone lines
Pearl        Tone generator
Pink         Create a party line from 2 phone lines
Purple       Telephone hold button
Rainbow      Kill a trace by putting 120v into the phone line (joke)
Razz         Tap into your neighbors phone
Red          Make free phone calls from pay phones by generating
             quarter tones
Rock         Add music to your phone line
Scarlet      Cause a neighbors phone line to have poor reception
Silver       Create the DTMF tones for A, B, C and D
Static       Keep the voltage on a phone line high
Switch       Add hold, indicator lights, conferencing, etc..
Tan          Line activated telephone recorder
Tron         Reverse the phase of power to your house, causing your
             electric meter to run slower
TV Cable     "See" sound waves on your TV
Urine        Create a capacitative disturbance between the ring and
             tip wires in another's telephone headset
Violet       Keep a payphone from hanging up
White        Portable DTMF keypad
Yellow       Add an extension phone

Box schematics may be retrieved from these FTP sites:          /pub/br/bradleym          /pub/va/vandal       /users/nitehwk


C-10. What is an ANAC number?

An ANAC (Automatic Number Announcement Circuit) number is a telephone
number that plays back the number of the telephone that called it.
ANAC numbers are convenient if you want to know the telephone number
of a pair of wires.


C-11. What is the ANAC number for my area?

How to find your ANAC number:

Look up your NPA (Area Code) and try the number listed for it. If that
fails, try 1 plus the number listed for it.  If that fails, try the
common numbers like 311, 958 and 200-222-2222.  If you find the ANAC
number for your area, please let us know.

Note that many times the ANAC number will vary for different switches
in the same city.  The geographic naming on the list is NOT intended
to be an accurate reference for coverage patterns, it is for
convenience only.

Many companies operate 800 number services which will read back to you
the number from which you are calling.  Many of these require navigating
a series of menus to get the phone number you are looking for.  Please
use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC

  (800)425-6256   VRS Billing Systems/Integretel (800)4BLOCKME
N (800)487-9240   Another line blocking service

A non-800 ANAC that works nationwide is 404-988-9664.  The one catch
with this number is that it must be dialed with the AT&T Carrier Access
Code 10732.  Use of this number does not appear to be billed.

Note: These geographic areas are for reference purposes only.  ANAC
numbers may vary from switch to switch within the same city.

  NPA  ANAC number      Approximate Geographic area
  ---  ---------------  ---------------------------------------------
  201  958              Hackensack/Jersey City/Newark/Paterson, NJ
  202  811              District of Columbia
  203  970              CT
  205  300-222-2222     Birmingham, AL
  205  300-555-5555     Many small towns in AL
  205  300-648-1111     Dora, AL
  205  300-765-4321     Bessemer, AL
  205  300-798-1111     Forestdale, AL
  205  300-833-3333     Birmingham
  205  557-2311         Birmingham, AL
  205  811              Pell City/Cropwell/Lincoln, AL
  205  841-1111         Tarrant, AL
  205  908-222-2222     Birmingham, AL
  206  411              WA (Not US West)
  207  200-222-2222     ME
  207  958              ME
  209  830-2121         Stockton, CA
  209  211-9779         Stockton, CA
  210  830              Brownsville/Laredo/San Antonio, TX
  210  951              Brownsville/Laredo/San Antonio, TX (GTE)
  212  958              Manhattan, NY
U 213  114              Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 switches)
U 213  1223             Los Angeles, CA (GTE 1AESS and 5ESS switches)
  213  211-2345         Los Angeles, CA (English response)
  213  211-2346         Los Angeles, CA (DTMF response)
  213  760-2???         Los Angeles, CA (DMS switches)
  213  61056            Los Angeles, CA
  214  570              Dallas, TX
  214  790              Dallas, TX (GTE)
N 214  970              Dallas, TX (GTE)
U 214  970-222-2222     Dallas, TX (Southwestern Bell)
  214  970-x11-1111     Dallas, TX (Southwestern Bell)
  215  410-xxxx         Philadelphia, PA
  215  511              Philadelphia, PA
  215  958              Philadelphia, PA
  216  200-XXXX         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  216  331              Akron/Canton/Cleveland/Lorain/Youngstown, OH
  216  959-9892         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  217  200-xxx-xxxx     Champaign-Urbana/Springfield, IL
  219  550              Gary/Hammond/Michigan City/Southbend, IN
  219  559              Gary/Hammond/Michigan City/Southbend, IN
  301  2002006969       Hagerstown/Rockville, MD
  301  958-9968         Hagerstown/Rockville, MD
  303  958              Aspen/Boulder/Denver/Durango/Grand Junction
                        /Steamboat Springs, CO
  305  200-555-1212     Ft. Lauderdale/Key West/Miami, FL
  305  200200200200200  Ft. Lauderdale/Key West/Miami, FL
  305  780-2411         Ft. Lauderdale/Key West/Miami, FL
  310  114              Long Beach, CA (On many GTE switches)
  310  1223             Long Beach, CA (Some 1AESS switches)
  310  211-2345         Long Beach, CA (English response)
  310  211-2346         Long Beach, CA (DTMF response)

[Note from Brian Jones: The new GTE ANAC for the Los Angeles area (310,
etc) is 958-1114 H.]

  312  200              Chicago, IL
  312  290              Chicago, IL
  312  1-200-8825       Chicago, IL (Last four change rapidly)
  312  1-200-555-1212   Chicago, IL
  313  200-200-2002     Ann Arbor/Dearborn/Detroit, MI
  313  200-222-2222     Ann Arbor/Dearborn/Detroit, MI
  313  200-xxx-xxxx     Ann Arbor/Dearborn/Detroit, MI
  313  200200200200200  Ann Arbor/Dearborn/Detroit, MI
N 313  311              Ann Arbor/Dearborn/Detroit, MI
N 313  958-1111         Ann Arbor/Dearborn/Detroit, MI (GTE)
  314  410-xxxx#        Columbia/Jefferson City/St.Louis, MO
  315  953              Syracuse/Utica, NY
  315  958              Syracuse/Utica, NY
  315  998              Syracuse/Utica, NY
  317  310-222-2222     Indianapolis/Kokomo, IN
  317  559-222-2222     Indianapolis/Kokomo, IN
  317  743-1218         Indianapolis/Kokomo, IN
  334  5572411          Montgomery, AL
  334 5572311           Montgomery, AL
  401  200-200-4444     RI
  401  222-2222         RI
  401  2002006969       RI
[401 possibly 118 according to forrest swope. H.]
  402  311              Lincoln, NE
  404  311              Atlanta, GA
  404  780-2311         Atlanta, GA
  404  940-xxx-xxxx     Atlanta, GA
  404  990              Atlanta, GA
  405  890-7777777      Enid/Oklahoma City, OK
  405  897              Enid/Oklahoma City, OK
  407  200-222-2222     Orlando/West Palm Beach, FL (Bell South)
  407  520-3111         Orlando/West Palm Beach, FL (United)
  408  300-xxx-xxxx     San Jose, CA
  408  760              San Jose, CA
  408  940              San Jose, CA
  409  951              Beaumont/Galveston, TX
  409  970-xxxx         Beaumont/Galveston, TX
  410  200-6969         Annapolis/Baltimore, MD
  410  200-200-6969     Annapolis/Baltimore, MD
  410  200-555-1212     Annapolis/Baltimore, MD
  410  811              Annapolis/Baltimore, MD
[410 possibly 118 according to forrest swope. H.]
  412  711-6633         Pittsburgh, PA
  412  711-4411         Pittsburgh, PA
  412  999-xxxx         Pittsburgh, PA
  413  958              Pittsfield/Springfield, MA
  413  200-555-5555     Pittsfield/Springfield, MA
  414  330-2234         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  415  200-555-1212     San Francisco, CA
  415  211-2111         San Francisco, CA
  415  2222             San Francisco, CA
  415  640              San Francisco, CA
  415  760-2878         San Francisco, CA
  415  7600-2222        San Francisco, CA
  419  311              Toledo, OH
  423  200-200-200      Chatanooga, Johnson City, Knoxville, TN
  501  511              AR
U 501  721-xxx-xxxx     AR
  502  2002222222       Frankfort/Louisville/Paducah/Shelbyville, KY
  502  997-555-1212     Frankfort/Louisville/Paducah/Shelbyville, KY
  503  611              Portland, OR
  503  999              Portland, OR (GTE)
  504  99882233         Baton Rouge/New Orleans, LA
  504  201-269-1111     Baton Rouge/New Orleans, LA
  504  998              Baton Rouge/New Orleans, LA
  504  99851-0000000000 Baton Rouge/New Orleans, LA
  508  958              Fall River/New Bedford/Worchester, MA
  508  200-222-1234     Fall River/New Bedford/Worchester, MA
  508  200-222-2222     Fall River/New Bedford/Worchester, MA
  508  26011            Fall River/New Bedford/Worchester, MA
  509  560              Spokane/Walla Walla/Yakima, WA
  510  760-1111         Oakland, CA
  512  830              Austin/Corpus Christi, TX
  512  970-xxxx         Austin/Corpus Christi, TX
  513  380-55555555     Cincinnati/Dayton, OH
  515  5463             Des Moines, IA
  515  811              Des Moines, IA
  516  958              Hempstead/Long Island, NY
  516  968              Hempstead/Long Island, NY
  517  200-222-2222     Bay City/Jackson/Lansing, MI
  517  200200200200200  Bay City/Jackson/Lansing, MI
N 517  958-1111         Bay City/Jackson/Lansing, MI (GTE)
  518  511              Albany/Schenectady/Troy, NY
  518  997              Albany/Schenectady/Troy, NY
  518  998              Albany/Schenectady/Troy, NY
  540  211              Roanoke, VA (GTE)
  540  311              Roanoke, VA (GTE)
  541  200              Bend, OR
N 573  511
N 602  958-3474         Phoenix, AZ
N 601  200-222-2222     MS
N 603  200-2222         NH
  603  200-222-2222     NH
  606  997-555-1212     Ashland/Winchester, KY
  606  711              Ashland/Winchester, KY
  607  993              Binghamton/Elmira, NY
  609  958              Atlantic City/Camden/Trenton/Vineland, NJ
  610  958              Allentown/Reading, PA
  610  958-4100         Allentown/Reading, PA
  612  511              Minneapolis/St.Paul, MN
  614  200              Columbus/Steubenville, OH
  614  571              Columbus/Steubenville, OH
  615  200200200200200  Chatanooga/Knoxville/Nashville, TN
  615  2002222222       Chatanooga/Knoxville/Nashville, TN
  615  830              Nashville, TN
  616  200-222-2222     Battle Creek/Grand Rapids/Kalamazoo, MI
N 616  958-1111         Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
  617  200-222-1234     Boston, MA
  617  200-222-2222     Boston, MA
  617  200-444-4444     Boston, MA (Woburn, MA)
  617  220-2622         Boston, MA
  617  958              Boston, MA
  618  200-xxx-xxxx     Alton/Cairo/Mt.Vernon, IL
  618  930              Alton/Cairo/Mt.Vernon, IL
  619  211-2001         San Diego, CA
  619  211-2121         San Diego, CA
  659  220-2622         Newmarket, NH
  703  211              VA
  703  511-3636         Culpeper/Orange/Fredericksburg, VA
  703  811              Alexandria/Arlington/Roanoke, VA
  704  311              Asheville/Charlotte, NC
  706  940-xxxx         Augusta, GA
  707  211-2222         Eureka, CA
  707  611              Crescent City, CA
  708  1-200-555-1212   Chicago/Elgin, IL
  708  1-200-8825       Chicago/Elgin, IL (Last four change rapidly)
  708  200-6153         Chicago/Elgin, IL
  708  724-9951         Chicago/Elgin, IL
  713  380              Houston, TX
  713  970-xxxx         Houston, TX
  713  811              Humble, TX
  713  380-5555-5555    Houston, TX
  714  114              Anaheim, CA (GTE)
  714  211-2121         Anaheim, CA (PacBell)
  714  211-2222         Anaheim, CA (Pacbell)
  714  211-7777         Anaheim, CA (Pacbell)
  716  511           Buffalo/Niagara Falls/Rochester, NY (Rochester
  716  990           Buffalo/Niagara Falls/Rochester, NY (Rochester
  717  958              Harrisburg/Scranton/Wilkes-Barre, PA
  718  958              Bronx/Brooklyn/Queens/Staten Island, NY
  770  780-2311         Marietta/Norcross, GA
  770  940-xxx-xxxx     Marietta/Norcross, GA
  802  2-222-222-2222   Vermont
  802  200-222-2222     Vermont
  802  1-700-222-2222   Vermont
  802  111-2222         Vermont
  804  211              Richmond, VA
  804  990              Virginia Beach, VA
[804 118 according to forrest swope. H.]
  805  114              Bakersfield/Santa Barbara, CA
  805  211-1101         Bakersfield/Santa Barbara, CA
  805  211-2345         Bakersfield/Santa Barbara, CA
  805  211-2346         Bakersfield/Santa Barbara, CA (Returns DTMF)
  805  830              Bakersfield/Santa Barbara, CA
  806  970-xxxx         Amarillo/Lubbock, TX
  810  200200200200200  Flint/Pontiac/Southfield/Troy, MI
  810  311              Pontiac/Southfield/Troy, MI
N 810  958-1111         Pontiac/Southfield/Troy, MI (GTE)
  812  410-555-1212     Evansville, IN
  813  311              Ft. Meyers/St. Petersburg/Tampa, FL
  815  200-3374         Crystal Lake, IL
  815  270-3374         Crystal Lake, IL
  815  770-3374         Crystal Lake, IL
  815  200-xxx-xxxx     La Salle/Rockford, IL
  815  290              La Salle/Rockford, IL
  817  211              Ft. Worth/Waco, TX
  817  970-611-1111     Ft. Worth/Waco, TX  (Southwestern Bell)
  817  973-222-11111    Ft. Worth/Waco, TX
  818  114              Pasadena, CA (GTE)
  818  1223             Pasadena, CA (Some 1AESS switches) (Pac Bell)
  818  211-2345         Pasadena, CA (English response) (Pac Bell)
  818  211-2346         Pasadena, CA (DTMF response) (Pac Bell)
  860  970              CT
  901  899-?555         Memphis, TN
  903  970-611-1111     Tyler, TX
  904  200-222-222      Jackonsville/Pensacola/Tallahasee, FL
  904  311              Jackonsville/Pensacola/Tallahasee, FL
  904  780-2311         Jackonsville/Pensacola/Tallahasee, FL
  906  1-200-222-2222   Marquette/Sault Ste. Marie, MI
N 906  958-1111         Marquette/Sault Ste. Marie, MI (GTE)
U 907  811              Anchorage, AK
  908  958              New Brunswick, NJ
  909  111              Riverside/San Bernardino, CA (GTE)
  909  114              Riverside/San Bernardino, CA
  910  200             Fayetteville/Greensboro/Raleigh/Winston-Salem,
  910  311             Fayetteville/Greensboro/Raleigh/Winston-Salem,
  910  988             Fayetteville/Greensboro/Raleigh/Winston-Salem,
  912  711              Albany/Savannah, GA
  912  780-2311         Albany/Savannah, GA
  914  990-1111         Peekskill/Poughkeepsie/White Plains/Yonkers,
  915  970-xxxx         Abilene/El Paso, TX
  916  211-0007         Sacramento, CA (Pac Bell)
  916  461              Sacramento, CA (Roseville Telephone)
  919  200              Durham, NC
  919  711              Durham, NC
  919  780-2411         Durham, NC
  954  200-555-1212     Ft. Lauderdale, FL
  954  200200200200200  Ft. Lauderdale, FL
  954  780-2411         Ft. Lauderdale, FL

  204  644-4444         Manitoba
  306  115              Saskatchewan
  403  311              Alberta, Yukon and N.W. Territory
  403  908-222-2222     Alberta, Yukon and N.W. Territory
  403  999              Alberta, Yukon and N.W. Territory
  416  997-xxxx         Toronto, Ontario
N 416  997-1699         Down Town, Toronto, Ontario
N 416  997-1699         Riverdale, Toronto, Ontario
N 416  997-8123         Scarborough, Toronto, Ontario
  506  1-555-1313       New Brunswick
  514  320-xxxx         Montreal, Quebec
  514  320-1232         Montreal, Quebec
  514  320-1223         Montreal, Quebec
  514  320-1233         Montreal, Quebec
  519  320-xxxx         London, Ontario
  604  1116             British Columbia
  604  1211             British Columbia
  604  211              British Columbia
  613  320-2232         Ottawa, Ontario
N 613  320-5123         Kingston/Belleville/Southeastern Ontario
N 613  320-5124         Kingston/Belleville/Southeastern Ontario
N 613  320-9123         Kingston/Belleville/Southeastern Ontario
  705  320-4567         North Bay/Saulte Ste. Marie, Ontario
  819  320-1112         Quebec
[Note from Mike: I found the new ANAC for the 604 calling area in
Vancouver, BC, Canada it is (604)958-6111. Also any prefix followed with
2011, so xxx-2011 is the high end of a loop. However, I can't find the
low end.. xxx-2012 gives a constantly busy and xxx-2010 rings forever.
Any help with finding the other end would be greatly appreciated. H.]

N Argentina:

  +61  03-552-4111      Victoria 03 area
  +612 19123            All major capital cities
  +612 11544

  United Kingdom:
U 175 or 17071



C-12. What is a ringback number?

A ringback number is a number that you call that will immediately
ring the telephone from which it was called.

In most instances you must call the ringback number, quickly hang up
the phone for just a short moment and then let up on the switch, you
will then go back off hook and hear a different tone.  You may then
hang up.  You will be called back seconds later.  On some systems,
you will have to press a button of flash hook again before the final
hang up.


C-13. What is the ringback number for my area?

An 'x' means insert those numbers from the phone number from which you
are calling.  A '?' means that the number varies from switch to switch
in the area, or changes from time to time.  Try all possible

If the ringback for your NPA is not listed, try common ones such as 114,
951-xxx-xxxx, 954, 957 and 958.  Also, try using the numbers listed for
other NPA's served by your telephone company.

Note: These geographic areas are for reference purposes only. Ringback
numbers may vary from switch to switch within the same city.

  NPA  Ringback number  Approximate Geographic area
  ---  ---------------  ---------------------------------------------
  201  55?-xxxx         Hackensack/Jersey City/Newark/Paterson, NJ
  202  958-xxxx         District of Columbia
  203  99?-xxxx         CT
  206  571-xxxx         WA
  207  981-xxxx         ME
  208  59X-xxxx         ID
  208  99xxx-xxxx       ID
  210  211-8849-xxxx    Brownsville/Laredo/San Antonio, TX (GTE)
N 213  xxx-xxxx    Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 switches)
N 213  117-xxxx         Los Angeles, CA (GTE 5ESS switches)
U 213  195-xxxx         Los Angeles, CA (GTE 1AESS switches)
  214  971-xxxx         Dallas, TX
  215  811-xxxx         Philadelphia, PA
  216  551-xxxx         Akron/Canton/Cleveland/Lorain/Youngstown, OH
  219  571-xxx-xxxx     Gary/Hammond/Michigan City/Southbend, IN
  219  777-xxx-xxxx     Gary/Hammond/Michigan City/Southbend, IN
  301  579-xxxx         Hagerstown/Rockville, MD
  301  958-xxxx         Hagerstown/Rockville, MD
  303  99x-xxxx         Grand Junction, CO
  304  998-xxxx         WV
  305  999-xxxx         Ft. Lauderdale/Key West/Miami, FL
  312  511-xxxx         Chicago, IL
  312  511-xxx-xxxx     Chicago, IL
  312  57?-xxxx         Chicago, IL
N 313  116-xxx-xxxx     Ann Arbor/Dearborn/Detroit, MI (GTE)
N 313  951-xxxx         Ann Arbor/Dearborn/Detroit, MI
  315  98x-xxxx         Syracuse/Utica, NY
  317  777-xxxx         Indianapolis/Kokomo, IN
  317  xxx-xxxx    Indianapolis/Kokomo, IN (y=3rd digit of phone number)
  319  79x-xxxx         Davenport/Dubuque, Iowa
  334  901-xxxx         Montgomery, AL
  401  98?-xxxx         RI
  404  450-xxxx         Atlanta, GA
  407  988-xxxx         Orlando/West Palm Beach, FL
  408  470-xxxx         San Jose, CA
  408  580-xxxx         San Jose, CA
  412  985-xxxx         Pittsburgh, PA
N 413  1983-xxxx        Pittsfield/Springfield, MA
  414  977-xxxx         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  414  978-xxxx         Fond du Lac/Green Bay/Milwaukee/Racine, WI
  415  350-xxxx         San Francisco, CA
  417  551-xxxx         Joplin/Springfield, MO
N 501  221-xxxx         Ft. Smith, AR (646 prefix)
  501  221-xxx-xxxx     AR
N 501  780-xxxx         Ft. Smith, AR (452 prefix)
  502  988              Frankfort/Louisville/Paducah/Shelbyville, KY
  503  541-XXXX         OR
  504  99x-xxxx         Baton Rouge/New Orleans, LA
  504  9988776655       Baton Rouge/New Orleans, LA
  505  59?-xxxx         New Mexico
  512  95X-xxxx         Austin, TX
  513  951-xxxx         Cincinnati/Dayton, OH
  513  955-xxxx         Cincinnati/Dayton, OH
  513  99?-xxxx         Cincinnati/Dayton, OH (X=0, 1, 2, 3, 4, 8 or
  515  559-XXXX         Des Moines, IA
N 516  660-xxxx         Hempstead/Long Island, NY
  516  660-xxx-xxxx     Hempstead/Long Island, NY
N 517  116-xxx-xxxx     Bay City/Jackson/Lansing, MI (GTE)
N 520  594-xxxx         AZ
  601  777-xxxx         MS
  603  981-xxxx         NH
  609  55?-xxxx         Atlantic City/Camden/Trenton/Vineland, NJ
  610  811-xxxx         Allentown/Reading, PA
  612  511              Minneapolis/St.Paul, MN
  612  999-xxx-xxxx     Minneapolis/St.Paul, MN
  614  998-xxxx         Columbus/Steubenville, OH
  615  920-XXXX         Chatanooga/Knoxville/Nashville, TN
  615  930-xxxx         Chatanooga/Knoxville/Nashville, TN
N 616  116-xxx-xxxx     Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
  616  946-xxxx         Battle Creek/Grand Rapids/Kalamazoo, MI
  619  331-xxxx         San Diego, CA
  619  332-xxxx         San Diego, CA
  659  981-XXXX         Newmarket, NH
  703  511-xxx-xxxx     VA
  703  958-xxxx         Alexandria/Arlington/Roanoke, VA
  708  511-xxxx         Chicago/Elgin, IL
  713  231-xxxx         Los Angeles, CA
  714  330?             Anaheim, CA (GTE)
  714  33?-xxxx         Anaheim, CA (PacBell)
  716  981-xxxx         Rochester, NY (Rochester Tel)
  718  660-xxxx         Bronx/Brooklyn/Queens/Staten Island, NY
  719  99x-xxxx         Colorado Springs/Leadville/Pueblo, CO
  801  938-xxxx         Utah
  801  939-xxxx         Utah
  802  987-xxxx         Vermont
  804  260             Charlottesville/Newport News/Norfolk/Richmond, VA
  805  114              Bakersfield/Santa Barbara, CA
  805  980-xxxx         Bakersfield/Santa Barbara, CA
N 810  116-xxx-xxxx     Pontiac/Southfield/Troy, MI (GTE)
  810  951-xxx-xxxx     Pontiac/Southfield/Troy, MI
  813  711              Ft. Meyers/St. Petersburg/Tampa, FL
  817  971              Ft. Worth/Waco, TX (Flashhook, then 2#)
  818  915?-xxxx        Pasadena, CA
  864  999-xxx-xxxx     Greenville/Spartanburg, SC
N 906  116-xxx-xxxx     Marquette/Sault Ste. Marie, MI (GTE)
  906  951-xxx-xxxx     Marquette/Sault Ste. Marie, MI
  908  55?-xxxx         New Brunswick, NJ
  908  953              New Brunswick, NJ
  913  951-xxxx         Lawrence/Salina/Topeka, KS
  914  660-xxxx-xxxx    Peekskill/Poughkeepsie/White Plains/Yonkers, NY

  204  590-xxx-xxxx     Manitoba
N 403  999-xxx-xxxx     Alberta, Yukon, and N.W. Territories
  416  57x-xxxx         Toronto, Ontario
  416  99x-xxxx         Toronto, Ontario
  416  999-xxx-xxxx     Toronto, Ontario
  506  572+xxx-xxxx     New Brunswick
  514  320-xxx-xxxx     Montreal, Quebec
  519  999-xxx-xxxx     London, Ontario
  604  311-xxx-xxxx     British Columbia
N 604  871-xxx-xxxx     British Columbia
  613  999-xxx-xxxx     Ottawa, Ontario
  705  999-xxx-xxxx     North Bay/Saulte Ste. Marie, Ontario
  819  320-xxx-xxxx     Quebec
N 902  575-xxx-xxxx     Halifax, Nova Scotia
  905  999-xxx-xxxx     Hamilton/Mississauga/Niagra Falls, Ontario

N Argentina             115
  Australia:            +61 199
U Brazil:               109
  France:               3644
  Holland:              99-xxxxxx
  Malaysia              196
  New Zealand:          137
  Sweden:               0058
U United Kingdom:       174 or 1744 or 175 or 0500-89-0011 or 17070 +
  Amsterdam             0196
  Hilversum             0123456789
  Breukelen             0123456789
  Groningen             951


C-14. What is a loop?

This FAQ answer is excerpted from: ToneLoc v0.99 User Manual
                                   by Minor Threat & Mucho Maas

Loops are a pair of phone numbers, usually consecutive, like 836-9998
and 836-9999.  They are used by the phone company for testing.  What
good do loops do us?  Well, they are cool in a few ways.  Here is a
simple use of loops.  Each loop has two ends, a 'high' end, and a
'low' end.  One end gives a (usually) constant, loud tone when it is
called. The other end is silent.  Loops don't usually ring either.
When BOTH ends are called, the people that called each end can talk
through the loop.  Some loops are voice filtered and won't pass
anything but a constant tone; these aren't much use to you.  Here's
what you can use working loops for:  billing phone calls!  First, call
the end that gives the loud tone.  Then if the operator or someone
calls the other end, the tone will go quiet.  Act like the phone just
rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or
what the fuck ever.  The operator thinks that she just called you, and
that's it!  Now the phone bill will go to the loop, and your local
RBOC will get the bill!  Use this technique in moderation, or the loop
may go down.  Loops are probably most useful when you want to talk to
someone to whom you don't want to give your phone number.


C-15. What is a loop in my area?

Many (if not most) of these loops are no longer functional.  If you are
local to any of these loops, please try them out an e-mail me the
results of your research.

  NPA    High      Low
  ---  --------  --------
  201  666-9929  666-9930
  208  862-9996  862-9997
  213  365-1118  365-1119
  308  357-0004  357-0005
  310  455-0002  455-????
  310  546-0002  546-????
  312  262-9902  262-9903 (Editors note: Very odd sound)
  313  224-9996  224-9997
  313  225-9996  225-9997
  313  234-9996  234-9997
  313  237-9996  237-9997
  313  256-9996  256-9997
  313  272-9996  272-9997
  313  273-9996  273-9997
  313  277-9996  277-9997
  313  281-9996  281-9997
  313  292-9996  292-9997
  313  299-9996  299-9997
  313  321-9996  321-9997
  313  326-9996  326-9997
  313  356-9996  356-9997
  313  362-9996  362-9997
  313  369-9996  369-9997
  313  388-9996  388-9997
  313  397-9996  397-9997
  313  399-9996  399-9997
  313  445-9996  445-9997
  313  465-9996  465-9997
  313  471-9996  471-9997
  313  474-9996  474-9997
  313  477-9996  477-9997
  313  478-9996  478-9997
  313  483-9996  483-9997
  313  497-9996  497-9997
  313  526-9996  526-9997
  313  552-9996  552-9997
  313  556-9996  556-9997
  313  561-9996  561-9997
  313  569-9996  569-9996
  313  575-9996  575-9997
  313  577-9996  577-9997
  313  585-9996  585-9997
  313  591-9996  591-9997
  313  621-9996  621-9997
  313  626-9996  626-9997
  313  644-9996  644-9997
  313  646-9996  646-9997
  313  647-9996  647-9997
  313  649-9996  649-9997
  313  663-9996  663-9997
  313  665-9996  665-9997
  313  683-9996  683-9997
  313  721-9996  721-9997
  313  722-9996  722-9997
  313  728-9996  728-9997
  313  731-9996  731-9997
  313  751-9996  751-9997
  313  776-9996  776-9997
  313  781-9996  781-9997
  313  787-9996  787-9997
  313  822-9996  822-9997
  313  833-9996  833-9997
  313  851-9996  851-9997
  313  871-9996  871-9997
  313  875-9996  875-9997
  313  886-9996  886-9997
  313  888-9996  888-9997
  313  898-9996  898-9997
  313  934-9996  934-9997
  313  942-9996  942-9997
  313  963-9996  963-9997
  313  977-9996  977-9997
  315  673-9995  673-9996
  315  695-9995  695-9996
  406  225-9902  225-9903
  408  238-0044  238-0045
  408  773-0044  773-0045
N 501  753-4291  753-4297
  517  422-9996  422-9997
  517  423-9996  423-9997
  517  563-9996  563-9997
  517  663-9996  663-????
  517  851-9996  851-9997
  613  966-1111
N 703  591-9994
  713  342-1499  342-1799
  713  351-1499  351-1799
  713  354-1499  354-1799
  713  356-1499  356-1799
  713  442-1499  442-1799
  713  447-1499  447-1799
  713  455-1499  455-1799
  713  458-1499  458-1799
  713  462-1499  462-1799
  713  466-1499  466-1799
  713  468-1499  468-1799
  713  469-1499  469-1799
  713  471-1499  471-1799
  713  481-1499  481-1799
  713  482-1499  482-1799
  713  484-1499  484-1799
  713  487-1499  487-1799
  713  489-1499  489-1799
  713  492-1499  492-1799
  713  493-1499  493-1799
  713  524-1499  524-1799
  713  526-1499  526-1799
  713  555-1499  555-1799
  713  661-1499  661-1799
  713  664-1499  664-1799
  713  665-1499  665-1799
  713  666-1499  666-1799
  713  667-1499  667-1799
  713  682-1499  976-1799
  713  771-1499  771-1799
  713  780-1499  780-1799
  713  781-1499  997-1799
  713  960-1499  960-1799
  713  977-1499  977-1799
  713  988-1499  988-1799
  719  598-0009  598-0010
  805  528-0044  528-0045
  805  544-0044  544-0045
  805  773-0044  773-0045
  808  235-9907  235-9908
  808  239-9907  239-9908
  808  245-9907  245-9908
  808  247-9907  247-9908
  808  261-9907  261-9908
  808  322-9907  322-9908
  808  328-9907  328-9908
  808  329-9907  329-9908
  808  332-9907  332-9908
  808  335-9907  335-9908
  808  572-9907  572-9908
  808  623-9907  623-9908
  808  624-9907  624-9908
  808  668-9907  668-9908
  808  742-9907  742-9908
  808  879-9907  879-9908
  808  882-9907  882-9908
  808  885-9907  885-9908
  808  959-9907  959-9908
  808  961-9907  961-9908
  810  362-9996  362-9997
  813  385-9971  385-xxxx
  847  724-9951  724-????
  908  254-9929  254-9930
  908  558-9929  558-9930
  908  560-9929  560-9930
  908  776-9930  776-9930
N 916  221-0044  221-0045       // Voice filtered
N 916  222-0044  222-0045       // Voice filtered


C-16. What is a CNA number?

CNA stands for Customer Name and Address.  The CNA number is a phone
number for telephone company personnel to call and get the name and
address for a phone number.  If a telephone lineman finds a phone line
he does not recognize, he can use the ANI number to find its phone
number and then call the CNA operator to see who owns it and where
they live.

Normal CNA numbers are available only to telephone company personnel.
Private citizens may legally get CNA information from private
companies.  Two such companies are:

Cross-Reference Directories             (900)288-3020
AT&T National Directory Assistance      (900)555-1212
Telename                                (900)884-1212
Unidirectory                            (900)933-3330

Note that these are 900 numbers, and will cost you approximately one
dollar per minute.

If you are in 312, 708, or parts of 815, AmeriTech has a pay-for-play
CNA service available to the general public.  The number is 796-9600.
The cost is $.35/call and can look up two numbers per call.

If you are in 415, Pacific Bell offers a public access CNL service at

If you are in Bell Atlantic territory you can call (201)555-5454 or
(908)555-5454 for automated CNA information.  The cost is $.50/call.

The legal telephone company CNA for Ontario is 555-1313.

You can fool (800)967-5356 into giving you a free CNA by requesting a
free disk and then entering the number you want the adress for at the

You can often social engineer CNA information out of telephone company
employees or out of employees of other companies with CNA access.

Here is a sample script that works if your target has ever ordered
pizza from Domino's or Pizza Hut:

        Them: Hi, thanks for call, may I take your order please?
        You:  Yes, I'd like 4 large pepperoni pizzas.
        Them: May I have your phone number please?
        You:  <State your targets phone number here>
        Them: Is this 238 Ward Road?
        You:  Yes ma'am.


C-17. What is the telephone company CNA number for my area?

  203    (203)771-8080         CT
N 214    (214)744-9500         Southwestern Bell
N 214    (214)745-7505         Southwestern Bell
N 217    (217)789-8290         Ameritech (Illinois)
  312    (312)796-9600         Chicago, IL
  506    (506)555-1313         New Brunswick
  513    (513)397-9110         Cincinnati/Dayton, OH
  516    (516)321-5700         Hempstead/Long Island, NY
  614    (614)464-0123         Columbus/Steubenville, OH
  813    (813)270-8711         Ft. Meyers/St. Petersburg/Tampa, FL
N 912    (912)752-2000 #1367   Albany/Savannah, GA
  NYNEX  (518)471-8111         New York, Connecticut, Vermont, Rhode
                               Island, New Hampshire, and


C-18. What are some numbers that always ring busy?

In the following listings, "xxx" means that the same number is used as a
constantly busy number in many different prefixes.  In most of these,
there are some exchanges that ring busy and some exchanges that are in
normal use.  *ALWAYS* test these numbers at least three times during
normal business hours before using as a constantly busy number.

  800  999-1803              WATS
  201  635-9970              Hackensack/Jersey City/Newark/Paterson, NJ
  212  724-9970              Manhattan, NY
  213  xxx-1117              Los Angeles, CA
  213  xxx-1118              Los Angeles, CA
  213  xxx-1119              Los Angeles, CA
  213  xxx-9198              Los Angeles, CA
  216  xxx-9887             Akron/Canton/Cleveland/Lorain/Youngstown, OH
  303  431-0000              Denver, CO
  303  866-8660              Denver, CO
  310  xxx-1117              Long Beach, CA
  310  xxx-1118              Long Beach, CA
  310  xxx-1119              Long Beach, CA
  310  xxx-9198              Long Beach, CA
  316  952-7265              Dodge City/Wichita, KS
  501  377-99xx              AR
N 518  571-xxxx              Albany, NY
  719  472-3772              Colorado Springs/Leadville/Pueblo, CO
  805  255-0699              Bakersfield/Santa Barbara, CA
  714  xxx-1117              Anaheim, CA
  714  xxx-1118              Anaheim, CA
  714  xxx-1119              Anaheim, CA
  714  xxx-9198              Anaheim, CA
  717  292-0009              Harrisburg/Scranton/Wilkes-Barre, PA
N 717  980-xxxx              Harrisburg/Scranton/Wilkes Barre, PA
  818  xxx-1117              Pasadena, CA
  818  xxx-1118              Pasadena, CA
  818  xxx-1119              Pasadena, CA
  818  xxx-9198              Pasadena, CA
  818  885-0699              Pasadena, CA  (???-0699 is a pattern)
  860  525-7078              Hartford, CT
  906  632-9999              Marquette/Sault Ste. Marie, MI
  906  635-9999              Marquette/Sault Ste. Marie, MI


C-19. What are some numbers that temporarily disconnect phone service?

  If your NPA is not listed, or the listing does not cover your LATA,
  try common numbers such as 119 (GTD5 switches) or 511.

N 209  999        Stockton/Fresno/Lodi, CA                 (100 seconds)
N 313  xxx-9994   Ann Arbor/Dearborn/Detroit, MI (Ameritech) (1 minute)
  314  511        Columbia/Jefferson City/St.Louis, MO       (1 minute)
  404  420        Atlanta, GA                                (5 minutes)
  405  953        Enid/Oklahoma City, OK                     (1 minute)
  407  511        Orlando, FL (United Telephone)             (1 minute)
  414 958-0013    Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute)
  512  200        Austin/Corpus Christi, TX                  (1 minute)
  516  480        Hempstead/Long Island, NY                  (1 minute)
N 517  xxx-9994   Bay City/Jackson/Lansing, MI (Ameritech)   (1 minute)
N 518  958        Albany, NY                                 (1 minute)
  603  980        NH
  614  xxx-9894   Columbus/Steubenville, OH
N 616  xxx-9994   Battle Creek/Grand Rapids/Kalamazoo, MI (Ameritech)
                                                        (1 minute)
  805  119        Bakersfield/Santa Barbara, CA              (3 minutes)
  807  211        Thunder Bay, Ontario                       (3 minutes)
N 810  xxx-9994   Pontiac/Southfield/Troy, MI (Ameritech)    (1 minute)
N 906  xxx-9994   Marquette/Sault Ste. Marie, MI (Ameritech) (1 minute)
  919  211 or 511 Durham, NC                           (10 min - 1 hour)


C-20. What is a Proctor Test Set?

A Proctor Test Set is a tool used by telco personnel to diagnose
problems with phone lines.  You call the Proctor Test Set number and
press buttons on a touch tone phone to active the tests you select.


C-21. What is a Proctor Test Set in my area?

If your NPA is not listed try common numbers such as 111 or 117.

  805  111        Bakersfield/Santa Barbara, CA
  909  117        Tyler, TX
  913  611-1111   Lawrence/Salina/Topeka, KS


C-22. What is scanning?

Scanning is dialing a large number of telephone numbers in the hope of
finding anything interesting.  Interesting items often include test
tones, computers, Voice Message Boxes (VMB's), Private Branch Exchanges
(PBX's), and government offices.

Scanning can be done by hand, although dialing several thousand
telephone numbers by hand is extremely boring and takes a long time.

Much better is to use a scanning program, sometimes called a war dialer
or a demon dialer.  Currently, the best war dialer available to PC-DOS
users is ToneLoc from Minor Threat and Mucho Maas.  ToneLoc can be ftp'd
from /pub/toneloc/.  For the Macintosh, try Assault

A war dialer will dial a range of numbers and log what it finds at each
number.  You can then only dial up the numbers that the war dialer
marked as carriers or tones.


C-23. Is scanning illegal?

Excerpt from: 2600, Spring 1990, Page 27:

In some places, scanning has been made illegal.  It would be hard,
though, for someone to file a complaint against you for scanning since
the whole purpose is to call every number once and only once.  It's
not likely to be thought of as harassment by anyone who gets a single
phone call from a scanning computer.  Some central offices have been
known to react strangely when people start scanning.  Sometimes you're
unable to get a dialtone for hours after you start scanning.  But
there is no uniform policy.  The best thing to do is to first find out
if you've got some crazy law saying you can't do it.  If, as is
likely, there is no such law, the only way to find out what happens is
to give it a try.

It should be noted that a law making scanning illegal was recently
passed in Colorado Springs, CO.  It is now illegal to place a call
in Colorado Springs without the intent to communicate.


C-24. How can I make a lineman's handset?

This FAQ answer was written by Phucked Agent 04:

This is the "right hand" of both the professional and the amatuer
lineman. Basically, it is a customized portable telephone which is
designed to be hooked onto raw cable terminals in the field and used to
monitor the line, talk, or dial out.  The monitor function is usually
the main difference between the "butt-in" test set and the normal phone.
If you don't have a real test set already, the following circuit can
convert a normal $4 made-in-taiwan phone into a working test set.  The
"all-in-one" handset units without bases are the best (I tend to like
QUIK's and GTE Flip Phone II's). Anyway-

OFFICIAL Agent 04 Generic Test Set Modification (tm)

  Ring >---------------------------------> to "test set" phone
   Tip >------!  SPST Switch    !-------->
              !-----/ ----------!
>from         !-------/!/!/!/!--!    C = 0.22 uF  200 WVDC Mylar
cable pair    !   C       R     !    R = 10 kOhm 1/2 W
(alligators)  !--! (------------! SPST = Talk / Monitor

When SPST is closed, you are in talk mode; when you lift the switch-
hook on the "test set" phone, you will get a dial tone as if you were a
standard extension of the line you are on.  You will be able to dial out
and receive calls.  When the SPST is opened, the resistor and capacitor
are no longer shunted, and they become part of the telephone circuit.
When you lift the switchhook on the test set, you will not receive dial
tone, due to the fact that the cap blocks DC, and the resistor passes
less than 4 mA nominally (far below the amount necessary to saturate the
supervisory ferrod on ESS or close the line relay on any other switch).
However, you will be able to silently monitor all audio on the line. The
cap reactance + the phone's impedance insure that you won't cut the
signal too much on the phone line, which might cause a noticeable change
(..expedite the shock force, SOMEONE'S ON MY LINE!!). It's also good to
have a VOM handy when working outside to rapidly check for active lines
or supervision states.


C-25. Where can I purchase a lineman's handset?

Contact East
335 Willow Street
North Andover, MA 01845-5995

Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399

Specialized Products
3131 Premier Drive
Irving, TX 75063

Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064


C-26. What are the DTMF frequencies?

DTMF stands for Dual Tone Multi Frequency.  These are the tones you get
when you press a key on your telephone touch pad.  The tone of the
button is the sum of the column and row tones.  The ABCD keys do not
exist on standard telephones.

             1209hz 1336hz 1477hz 1633hz

     697hz      1      2      3      A

     770hz      4      5      6      B

     852hz      7      8      9      C

     941hz      *      0      #      D


C-27. What are the frequencies of the telephone tones?

Many of these tones are no longer used and are mentioned here only for
historical accuracy.

Low Tone
This is a generic tone used with various interruption patterns for
specific tones listed below and described under their own titles:

        Line Busy Tone
        No Circuit Tone
        No Such Number
        Vacant Code
        Group Busy Tone
        Deposit Coin Tone
        Vacant Position Tone
        Dial Off-Normal Tone
        Trouble Tone
        Dial Jack Tone
        Dial Test Signal
        Class of Service

Low Tone 480 Hz and 620 Hz at -24 dBm0/frequency.  On some systems
manufactured before 1974, Low Tone was 600 Hz modulated at 120, 133, 140
or 160 Hz at 61 - 71 dBrnC.

High Tone
This is a generic tone used with various interruption patterns for the
specific tones listed below and described under their own titles:

        Partial Dial Tone
        Permanent Signal
        Coin Return (Test) Tone
        Coin Return Tone
        Number Checking Tone
        Intercepting Loopback Tone
        Warning Tone
        Order Tone
        Station Ringer Test
        Class of Service

High Tone 480 Hz at -17 dBm0.  On some systems manufactured before 1974,
High Tone was 400 Hz or 500 Hz at 61 - 71 dBrnC.

Dial Tone
This tone is sent to a customer or operator to indicate that the
receiving end is ready to receive dial pulses or DTMF signals. It is
used in all types of dial offices when dial pulses are produced by the
customer's or operator's dials.  Normally dial tone means that the
entire wanted number may be dialed; however, there are some cases where
the calling party must await a second dial tone or where an operator,
after dialing an initial group of digits, must wait for a second dial
tone before the rest of the number can be dialed. Some dialing
switchboards are arranged to permit listening for dial tone between
certain digits.

Dial Tone is 350 Hz and 440 Hz held steady at -13 dBm0/frequency.

Audible Ring Tone
This is a ringing indication which is intercepted by the calling party
to mean that the called line has been reached and that the ringing has
started.  It is also used on calls to operators (special service, long
distance, intercepting, etc) during the "awaiting-operator-answer"

Audible Ring Tone is 440 Hz and 480 Hz for 2 seconds on and 4 seconds
off at -13 dBm0/frequency.

Line Busy Tone
The Line Busy Tine indicates that the called customer's line has been
reached but that it is busy or being rung or on permanent signal. When a
line busy signal is applied by an operator, it is sometimes calls a
busy-back tone.

Line Busy Tone is Low Tone on and off every .5 seconds.

Reorder indicates that the local or toll switching or transmission paths
to the office or equipment serving the called customer is busy.  This
signal may indicate a condition such as a timed-out sender or unassigned
code dialed.  It is interpreted by either a customer or an operator as a
reorder signal.

Reorder on a local call is Low Tone for .3 seconds on and .2 seconds
off. Reorder on a toll call is Low Tone for .2 seconds on and .3 seconds
off.  In No. 5 crossbar, No. 1/1A ESS, No. 2/2B ESS switching equipment
and No. 1 step-by-step offices using the Precise Tone Plan, the temporal
pattern is 0.25 second of low tone and 0.25 second off.

Alerting Tone
Indicates that an operator has connected to the line (emergency
interrupt on a busy line during a verification call).

Alerting Tone is 440 Hz on for 2 seconds and then on again for .5
seconds every ten seconds.

Recorder Warning Tone
When recording equipment is used, this tone is connected to the line to
inform the distant party that the conversation is bveing recorded. The
tone source is located within the recording equipment and cannot be
controlled by the party applying the recording equipment to the line.
This tone is required by law and is recorded along with the speech.

Recorder Warning Tone is a .5 second burst at 1400 Hz every 15 seconds.

Recorder Connected Tone
This tone is used to inform the customer that his/her call is connected
to a recording machine and that he/she should proceed to leave a
message, dictate, etc.  It is to be distinguished from the recorder
warning tone, which warns the customer that his/her 2-way conversation
is being recorded.

Recorder Warning Tone is a .5 second burst at 440 Hz every 5 seconds.

Reverting Tone
The same type of signal as line busy tone is used for reverting tone in
all systems.  In No. 5 crossbar systems, a second dial tone is sometimes
also used when a calling party identification digit is required.  The
reverting signal informs the calling subscriber that the called party is
on the same line and that he/she should hang up while the line is being

Reverting Tone is is Low Tone on and off every .5 seconds at -24

Deposit Coin Tone
This tone, sent from a Community Dial Office to a post-pay coin
telephone, informs the calling party that the called party has answered
and that the coin should be deposited.

Deposit Coin Tone is a steady Low Tone.

Receiver Off-Hook Tone
This tone is used to cause off-hook customers to replace the receiver
on-hook on a permanent signal call and to signal a non-PBX off-hook line
when ringing key is operated by a switchboard operator.

Receiver Off-Hook Tone is 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at 0
dBm0/frequency on and off every .1 second.  On some older space division
switching systems Receiver Off-Hook was 1400 Hz, 2060 Hz, 2450 Hz and
2600 Hz at +5 VU on and off every .1 second.  On a No. 5 ESS this
continues for 30 seconds.  On a No. 2/2B ESS this continues for 40
seconds.  On some other AT&T switches there are two iterations of 50
seconds each.

This tone is used in older offices to inform a customer that their
receiver is off-hook.  It has been superseded by the receiver off-hook

Howler was a 480 Hz tone incremented in volume every second for ten
seconds until it reaches +40 VU.

Partial Dial Tone
High-tone is used to notify the calling party that he/she has not
commenced dialing within a preallotted time, measured after receipt of
dial tone (permanent signal condition), or that he/she has not dialed
enough digits (partial dial condition).  This is a signal to hang up and
dial again.

Partial Dial Tone is a steady High Tone.

No Such Number a.k.a. "Cry Baby"
This signal tells the calling party to hang up, check the called number,
and dial again.  In modern systems, calls to unassigned or discontinued
numbers will also be routed to a machine announcement system, such as 6A
or 7A, which verbally supplies the require message.  In some older
offices, you could be routed to an intercepting operator.  In some
offices, reorder tone is returned in this condition.

No Such Number is 200 to 400 Hz modulated at 1 Hz, interrupted every 6
seconds for .5 seconds.

Vacant Code
This tone is used in crossbar systems to indicate that the dialed office
code is unassigned. In step-by-step areas, this signal is called vacant
level tone.  For operator-originated calls, the verbal announcement is
preceeded by two flashes.  In modern systems, recorded verbal
announcements are used for this service.

Vacant Code is Low Tone for .5 seconds on, .5 seconds off, .5 seconds of
and 1.5 seconds off.

Busy Verification Tone (Centrex)
Busy verification is a Centrex feature that allows the attendant to call
and be connected to a busy Centrex station within the attendant's
customer group.  The busy verification tone is applied to both parties
of the connection to inform them of the intrusion by the attendant. No
tone is applied if the station called for busy verification is idle.

Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds
and then again for .3 seconds every 7.5 to 10 seconds. On a No. 1/1A
ESS, Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5
seconds and then again for .3 seconds every 6 seconds.

There is also a TSPS Busy Verification tone, which is 440 Hz at -13 dBm0
for 2 seconds and then on again for .5 seconds every 10 seconds.

Call Waiting Tone
Call Waiting is a special service that allows a busy line to answer an
incoming call by flashing the switchhook.  Audible ring (instead of line
busy) is applied to the calling line, and the Call Waiting tone is
applied to the called line.  (So that only the called party hears the
tone, the connection is momentarily broken, and the other party to that
connection experiences a moment of silence.)  Flashing the switchhook
places the existing connection on hold and connects the customer to the
waiting call.

Call Waiting Tone is two bursts of 440 Hz at -13 dBm0/frequency for .3
seconds plus or minus ten percent every ten seconds.

Confirmation Tone
This tone is used to acknowledge receipt by automatic equipment of
information necessary for special services.  It is currently used for:

        (1) Speed Calling   - dialed number has been recorded
        (2) Call Forwarding - dialed number has been recorded and
                              service is activated
        (3) Call Forwarding - service is deactivated

Confirmation Tone is 350 Hz and 440 Hz at -13 dBm0/frequency on for .1
second, off for .1 second and then on for .3 seconds.

Indication of Camp-On
Attendant camp-on service allows an electronic switching system Centrex
attendant to hold incoming calls to busy lines.  Each time the attendant
releases his/her talking connection from the loop involved in the
camped-on call, the indication of camp-on tone is heard by the called
customer if the customer has subscribed to the indication of camp-on
option.  The customer may get this tone several times as the attendant
reconnects and releases from the loop in response to timed reminders
from the console.

Indication of Camp On is 440 Hz at -13 dBm0 for one second every time
the attendant releases from the loop.

Special Dial Tone
This tone is used with Three-Way Calling, Centrex station dial transfer,
and Centrex conference (station or attendant) services.  The user on an
existing connection flashes the switchhook, receives special dial tone,
and dials number of the third party to be added to the connection.

Special Dial Tone is 350 Hz and 440 Hz at -13 dBm0/frequency for .1
second on, .1 second off, .1 second on, .1 second off, .1 second on, .1
second off, and then on steady.

Priority Audible Ring (AUTOVON)
This tone replaces normal audible ring for priority calls within the
AUTOVON network.

Priority Audible Ring is 440 Hz and 480 Hz at -16 dBm0/frequency on for
1.65 seconds and off for .35 seconds.

Preemption Tone (AUTOVON)
This tone is provided to both parties of a connection that is preempted
by a priority call from the AUTOVON network.

Preemption Tone is 440 Hz and 620 Hz at -18 dBm0/frequency steady for
anywhere from three to fifteen seconds.

Data Set Answer Back Tone
This set is heard when manually initiating a data call.  It normally
occurs shortly after the start of audible ringing and means that the
remote data set has answered.  The data set at the calling end should
then be put into the data mode.

Data Set Answer Back Tone is 2025 Hz steady at -13 dBm.

Calling Card Service Prompt Tone
This tone is used to inform the customer that his/her credit card
information must be keyed in.  The first 60 milliseconds of this
composite tone is 941 Hz abd 1477 Hz which is the DTMF '#'.  This tone
will release and DTMF to dial pulse converter in the conneciton.

Calling Card Service Prompt Tone is 941 Hz and 1477 Hz at -10
dBm0/frequency at -3 Transmission Level Point for 60 milliseconds and
then 440 Hz and 350 Hz at -7 dBm0 for .940 seconds exponentially decayed
from -10 dBm per frequency at -3 Transmission Level Point at time
constant of .2 seconds.

Class of Service
These signals are used at a toll board operating as an 'A" board to
identify the class or service of the calling customer.  The indication
may be high, low, or no tone.

Class of Service is a single burst of either High Tone or Low Tone for
.05 to 1 seconds.

Dial-Normal Transmission Signal

User Contributions:

Comment about this article, ask questions, or add new information about this topic:

Part1 - Part2 - Part3 - Part4

[ Usenet FAQs | Web FAQs | Documents | RFC Index ]

Send corrections/additions to the FAQ Maintainer:
"FAQ Comments address" <>,Harlequin <>

Last Update March 27 2014 @ 02:11 PM