| #hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony |
| Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous |
When a coin is inserted into a payphone, the payphone emits a set of tones to ACTS (Automated Coin Toll System). Red boxes work by fooling ACTS into believing you have actually put money into the phone. The red box simply plays the ACTS tones into the telephone microphone. ACTS hears those tones, and allows you to place your call. The actual tones are:
| Nickel: | 35-160ms 1700hz & 2200hz tone burst, followed by 240ms of silence. |
| Dime: | Two 35-160ms 1700hz & 2200hz bursts, with a spacing of 20-110ms between the bursts, followed by 165 ms of silence. |
| Quarter: | Five 1700hz & 2200hz bursts, with the first and last being 20-100ms in length, and the second through fourth being 20-60ms in length. The spacing between the first and second bursts is 20-110ms, while the spacing between the following bursts is 20-60ms. The tones are followed by 60ms of silence. |
Canada uses a variant of ACTSD called N-ACTS. N-ACTS uses different tones than ACTS. In Canada, the tones to use are:
| Nickel: | 2200hz | 0.060s on |
| Dime: | 2200hz | 0.060s on, 0.060s off, twice repeating |
| Quarter: | 2200hz | 33ms on, 33ms off, 5 times repeating |
Red boxes are commonly manufactured from Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components.
To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open the dialer and replace the crystal with a new one. The purpose of the new crystal is to cause the * button on your tone dialer to create a 1700hz and 2200hz tone instead of the original 941hz and 1209hz tones. The exact value of the replacement crystal should be 6.466806 to create a perfect 1700hz tone and 6.513698 to create a perfect 2200hz tone. A crystal close to those values will create a tone that easily falls within the loose tolerances of ACTS. The most popular choice is the 6.5536Mhz crystal, because it is the easiest to procure. The old crystal is the large shiny metal component labeled "3.579545Mhz." When you are finished replacing the crystal, program the P1 button with five *'s. That will simulate a quarter tone each time you press P1.
You can record the ACTS tones and play them back into the telephone. This is what is done with the Hallmark greeting card. Alternatively, you can build your own circuit using any voice recording chip, such as Radio Shack catalog number 276-1325.
Your best bet is a local electronics store. Radio Shack sells them, but they are overpriced and the store must order them in. This takes approximately two weeks. In addition, many Radio Shack employees do not know that this can be done.
Or, you could order the crystal mail order. This introduces Shipping and Handling charges, which are usually much greater than the price of the crystal. It's best to get several people together to share the S&H cost. Or, buy five or six yourself and sell them later. Some of the places you can order crystals are:
Digi-Key
701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
(800)344-4539
Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND
JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
(800)538-5000
Part Number: 6.5536MHZ
Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
(800)241-8742
Part Number: 10068625
Alltronics
2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057
Mouser
(800)346-6873
Part Number: 332-1066
Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b
Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: 1-800-824-3432
Part Number: CR6.5
Red Boxes will work on telco owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones).
Red boxes work by fooling ACTS (Automated Coin Toll System) into believing you have put money into the pay phone. ACTS is the telephone company software responsible for saying "Please deposit XX cents" and listening for the coins being deposited.
COCOT's do not use ACTS. On a COCOT, the pay phone itself is responsible for determining what coins have been inserted.
Payphones do not use ACTS for local calls. To use your red box for local calls, you have to fool ACTS into getting involved in the call.
One way to do this, in some areas, is by dialing an Equal Access Code before the number you are dialing. For example, to use 10288 (an Equal Access Code belonging to AT&T), dial 10288-xxx-xxxx. This makes your call a long distance call, and brings ACTS into the picture. There are quite a large number of Equal Access Codes available in most geographic regions.
In other areas, you can call Directory Assistance and ask for the number of the person you are trying to reach. The operator will give you the number and then you will hear a message similar to "Your call can be completed automatically for an additional 35 cents." When this happens, you can then use ACTS tones.
Another operator scam involves calling (800) long distance operators, asking them to connect you, and then playing the ACTS tones. This will get ACTS involved, even on COCOT's!
I have heard that in some areas you can dial local calls as if they were long distance. For example, to dial 345-4587 to would dial 303-345-4587. This does not work on payphones in my area.
Blue boxes use a 2600hz tone to size control of telephone switches that use in-band signalling. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the tones provided by the Blue Box.
This FAQ answer is excerpted from a message posted to Usenet by Marauder of the Legion of Doom:
Somewhere along the line I have seen reference to something similar to "Because of ESS Blue boxing is impossible". This is incorrect. When I lived in Connecticut I was able to blue box under Step by Step, #1AESS, and DMS-100. The reason is simple, even though I was initiating my call to an 800 number from a different exchange (Class 5 office, aka Central Office) in each case, when the 800 call was routed to the toll network it would route through the New Haven #5 Crossbar toll Tandem office. It just so happens that the trunks between the class 5 (CO's) and the class 4 (toll office, in this case New Haven #5 Xbar), utilized in-band (MF) signalling, so regardless of what I dialed, as long as it was an Inter-Lata call, my call would route through this particular set of trunks, and I could Blue box until I was blue in the face. The originating Central Offices switch (SXS/ESS/Etc..) had little effect on my ability to box at all. While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). Unfortunately for the boxer 99% of the Toll Completion centers communicate using CCIS links, This spells disaster for the blue boxer since most of you must dial out of your local area to find trunks that utilize MF signalling, you inevitably cross a portion of the network that is CCIS equipped, you find an exchange that you blow 2600hz at, you are rewarded with a nice "winkstart", and no matter what MF tones you send at it, you meet with a re-order. This is because as soon as you seized the trunk (your application of 2600hz), your Originating Toll Office sees this as a loss of supervision at the destination, and Mutes any further audio from being passed to the destination (ie: your waiting trunk!). You meet with a reorder because the waiting trunk never "hears" any of the MF tones you are sending, and it times out. So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. (Hint: Take a close look at WATS extenders).
A Black Box is a resistor (and often capacitor in parallel) placed in series across your phone line to cause the phone company equipment to be unable to detect that you have answered your telephone. People who call you will then not be billed for the telephone call. Black boxes do not work under ESS.
| Acrylic | Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems |
| Aqua | Drain the voltage of the FBI lock-in-trace/trap-trace |
| Beige | Lineman's hand set | Black | Allows the calling party to not be billed for the call placed |
| Blast | Phone microphone amplifier |
| Blotto | Supposedly shorts every phone out in the immediate area | Blue | Emulate a true operator by seizing a trunk with a 2600hz tone |
| Brown | Create a party line from 2 phone lines |
| Bud | Tap into your neighbors phone line |
| Chartreuse | Use the electricity from your phone line |
| Cheese | Connect two phones to create a diverter |
| Chrome | Manipulate Traffic Signals by Remote Control | Clear | A telephone pickup coil and a small amp used to make free calls on Fortress Phones |
| Color | Line activated telephone recorder |
| Copper | Cause crosstalk interference on an extender |
| Crimson | Hold button |
| Dark | Re-route outgoing or incoming calls to another phone |
| Dayglo | Connect to your neighbors phone line |
| Diverter | Re-route outgoing or incoming calls to another phone |
| DLOC | Create a party line from 2 phone lines |
| Gold | Dialout router |
| Green | Emulate the Coin Collect, Coin Return, and Ringback tones |
| Infinity | Remotely activated phone tap |
| Jack | Touch-Tone key pad |
| Light | In-use light |
| Lunch | AM transmitter |
| Magenta | Connect a remote phone line to another remote phone line |
| Mauve | Phone tap without cutting into a line |
| Neon | External microphone |
| Noise | Create line noise |
| Olive | External ringer |
| Party | Create a party line from 2 phone lines |
| Pearl | Tone generator |
| Pink | Create a party line from 2 phone lines |
| Purple | Telephone hold button |
| Rainbow | Kill a trace by putting 120v into the phone line (joke) |
| Razz | Tap into your neighbors phone | Red | Make free phone calls from pay phones by generating quarter tones |
| Rock | Add music to your phone line |
| Scarlet | Cause a neighbors phone line to have poor reception |
| Silver | Create the DTMF tones for A, B, C and D |
| Static | Keep the voltage on a phone line high |
| Switch | Add hold, indicator lights, conferencing, etc.. |
| Tan | Line activated telephone recorder | Tron | Reverse the phase of power to your house, causing your electric meter to run slower |
| TV Cable | "See" sound waves on your TV | Urine | Create a capacitative disturbance between the ring and tip wires in another's telephone headset |
| Violet | Keep a payphone from hanging up |
| White | Portable DTMF keypad | Yellow | Add an extension phone |
An ANAC (Automatic Number Announcement Circuit) number is a telephone number that plays back the number of the telephone that called it. ANAC numbers are convenient if you want to know the telephone number of a pair of wires.
How to find your ANAC number:
Look up your NPA (Area Code) and try the number listed for it. If that fails, try 1 plus the number listed for it. If that fails, try the common numbers like 311, 958 and 200-222-2222. If you find the ANAC number for your area, please let us know.
Note that many times the ANAC number will vary for different switches in the same city. The geographic naming on the list is NOT intended to be an accurate reference for coverage patterns, it is for convenience only.
Many companies operate 800 number services which will read back to you the number from which you are calling. Many of these require navigating a series of menus to get the phone number you are looking for. Please use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC numbers.
(800)425-6256: VRS Billing Systems/Integretel
(800)4BLOCKME
(800)487-9240: Another line blocking service
A non-800 ANAC that works nationwide is 404-988-9664. The one catch with this number is that it must be dialed with the AT&T Carrier Access Code 10732. Use of this number does not appear to be billed.
NPA ANAC number Approximate Geographic area USA: 201 958 Hackensack/Jersey City/Newark/Paterson, NJ 202 811 District of Columbia 203 970 CT 205 300-222-2222 Birmingham, AL 205 300-555-5555 Many small towns in AL 205 300-648-1111 Dora, AL 205 300-765-4321 Bessemer, AL 205 300-798-1111 Forestdale, AL 205 300-833-3333 Birmingham 205 557-2311 Birmingham, AL 205 811 Pell City/Cropwell/Lincoln, AL 205 841-1111 Tarrant, AL 205 908-222-2222 Birmingham, AL 206 411 WA (Not US West) 207 200-222-2222 ME 207 958 ME 209 830-2121 Stockton, CA 209 211-9779 Stockton, CA 210 830 Brownsville/Laredo/San Antonio, TX 210 951 Brownsville/Laredo/San Antonio, TX (GTE) 212 958 Manhattan, NY 213 114 Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 switches) 213 1223 Los Angeles, CA (GTE 1AESS and 5ESS switches) 213 211-2345 Los Angeles, CA (English response) 213 211-2346 Los Angeles, CA (DTMF response) 213 760-2??? Los Angeles, CA (DMS switches) 213 61056 Los Angeles, CA 214 570 Dallas, TX 214 790 Dallas, TX (GTE) 214 970 Dallas, TX (GTE) 214 970-222-2222 Dallas, TX (Southwestern Bell) 214 970-x11-1111 Dallas, TX (Southwestern Bell) 215 410-xxxx Philadelphia, PA 215 511 Philadelphia, PA 215 958 Philadelphia, PA 216 200-XXXX Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH 217 200-xxx-xxxx Champaign-Urbana/Springfield, IL 219 550 Gary/Hammond/Michigan City/Southbend, IN 219 559 Gary/Hammond/Michigan City/Southbend, IN 301 2002006969 Hagerstown/Rockville, MD 301 958-9968 Hagerstown/Rockville, MD 303 958 Aspen/Boulder/Denver/Durango/Grand Junction/Steamboat Springs, CO 305 200-555-1212 Ft. Lauderdale/Key West/Miami, FL 305 200200200200200 Ft. Lauderdale/Key West/Miami, FL 305 780-2411 Ft. Lauderdale/Key West/Miami, FL 310 114 Long Beach, CA (On many GTE switches) 310 1223 Long Beach, CA (Some 1AESS switches) 310 211-2345 Long Beach, CA (English response) 310 211-2346 Long Beach, CA (DTMF response) 312 200 Chicago, IL 312 290 Chicago, IL 312 1-200-8825 Chicago, IL (Last four change rapidly) 312 1-200-555-1212 Chicago, IL 313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI 313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI 313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI 313 200200200200200 Ann Arbor/Dearborn/Detroit, MI 313 311 Ann Arbor/Dearborn/Detroit, MI 313 958-1111 Ann Arbor/Dearborn/Detroit, MI (GTE) 314 410-xxxx# Columbia/Jefferson City/St.Louis, MO 315 953 Syracuse/Utica, NY 315 958 Syracuse/Utica, NY 315 998 Syracuse/Utica, NY 317 310-222-2222 Indianapolis/Kokomo, IN 317 559-222-2222 Indianapolis/Kokomo, IN 317 743-1218 Indianapolis/Kokomo, IN 334 5572411 Montgomery, AL 334 5572311 Montgomery, AL 401 200-200-4444 RI 401 222-2222 RI 401 2002006969 RI 402 311 Lincoln, NE 404 311 Atlanta, GA 404 780-2311 Atlanta, GA 404 940-xxx-xxxx Atlanta, GA 404 990 Atlanta, GA 405 890-7777777 Enid/Oklahoma City, OK 405 897 Enid/Oklahoma City, OK 407 200-222-2222 Orlando/West Palm Beach, FL (Bell South) 407 520-3111 Orlando/West Palm Beach, FL (United) 408 300-xxx-xxxx San Jose, CA 408 760 San Jose, CA 408 940 San Jose, CA 409 951 Beaumont/Galveston, TX 409 970-xxxx Beaumont/Galveston, TX 410 200-6969 Annapolis/Baltimore, MD 410 200-200-6969 Annapolis/Baltimore, MD 410 200-555-1212 Annapolis/Baltimore, MD 410 811 Annapolis/Baltimore, MD 412 711-6633 Pittsburgh, PA 412 711-4411 Pittsburgh, PA 412 999-xxxx Pittsburgh, PA 413 958 Pittsfield/Springfield, MA 413 200-555-5555 Pittsfield/Springfield, MA 414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI 415 200-555-1212 San Francisco, CA 415 211-2111 San Francisco, CA 415 2222 San Francisco, CA 415 640 San Francisco, CA 415 760-2878 San Francisco, CA 415 7600-2222 San Francisco, CA 419 311 Toledo, OH 423 200-200-200 Chatanooga, Johnson City, Knoxville, TN 501 511 AR 501 721-xxx-xxxx AR 502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY 502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY 503 611 Portland, OR 503 999 Portland, OR (GTE) 504 99882233 Baton Rouge/New Orleans, LA 504 201-269-1111 Baton Rouge/New Orleans, LA 504 998 Baton Rouge/New Orleans, LA 504 99851-0000000000 Baton Rouge/New Orleans, LA 508 958 Fall River/New Bedford/Worchester, MA 508 200-222-1234 Fall River/New Bedford/Worchester, MA 508 200-222-2222 Fall River/New Bedford/Worchester, MA 508 26011 Fall River/New Bedford/Worchester, MA 509 560 Spokane/Walla Walla/Yakima, WA 510 760-1111 Oakland, CA 512 830 Austin/Corpus Christi, TX 512 970-xxxx Austin/Corpus Christi, TX 513 380-55555555 Cincinnati/Dayton, OH 515 5463 Des Moines, IA 515 811 Des Moines, IA 516 958 Hempstead/Long Island, NY 516 968 Hempstead/Long Island, NY 517 200-222-2222 Bay City/Jackson/Lansing, MI 517 200200200200200 Bay City/Jackson/Lansing, MI 517 958-1111 Bay City/Jackson/Lansing, MI (GTE) 518 511 Albany/Schenectady/Troy, NY 518 997 Albany/Schenectady/Troy, NY 518 998 Albany/Schenectady/Troy, NY 540 211 Roanoke, VA (GTE) 540 311 Roanoke, VA (GTE) 541 200 Bend, OR 573 511 602 958-3474 Phoenix, AZ 601 200-222-2222 MS 603 200-2222 NH 603 200-222-2222 NH 606 997-555-1212 Ashland/Winchester, KY 606 711 Ashland/Winchester, KY 607 993 Binghamton/Elmira, NY 609 958 Atlantic City/Camden/Trenton/Vineland, NJ 610 958 Allentown/Reading, PA 610 958-4100 Allentown/Reading, PA 612 511 Minneapolis/St.Paul, MN 614 200 Columbus/Steubenville, OH 614 571 Columbus/Steubenville, OH 615 200200200200200 Chatanooga/Knoxville/Nashville, TN 615 2002222222 Chatanooga/Knoxville/Nashville, TN 615 830 Nashville, TN 616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI 616 958-1111 Battle Creek/Grand Rapids/Kalamazoo, MI (GTE) 617 200-222-1234 Boston, MA 617 200-222-2222 Boston, MA 617 200-444-4444 Boston, MA (Woburn, MA) 617 220-2622 Boston, MA 617 958 Boston, MA 618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL 618 930 Alton/Cairo/Mt.Vernon, IL 619 211-2001 San Diego, CA 619 211-2121 San Diego, CA 659 220-2622 Newmarket, NH 703 211 VA 703 511-3636 Culpeper/Orange/Fredericksburg, VA 703 811 Alexandria/Arlington/Roanoke, VA 704 311 Asheville/Charlotte, NC 706 940-xxxx Augusta, GA 707 211-2222 Eureka, CA 707 611 Crescent City, CA 708 1-200-555-1212 Chicago/Elgin, IL 708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly) 708 200-6153 Chicago/Elgin, IL 708 724-9951 Chicago/Elgin, IL 713 380 Houston, TX 713 970-xxxx Houston, TX 713 811 Humble, TX 713 380-5555-5555 Houston, TX 714 114 Anaheim, CA (GTE) 714 211-2121 Anaheim, CA (PacBell) 714 211-2222 Anaheim, CA (Pacbell) 714 211-7777 Anaheim, CA (Pacbell) 716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel) 717 958 Harrisburg/Scranton/Wilkes-Barre, PA 718 958 Bronx/Brooklyn/Queens/Staten Island, NY 770 780-2311 Marietta/Norcross, GA 770 940-xxx-xxxx Marietta/Norcross, GA 802 2-222-222-2222 Vermont 802 200-222-2222 Vermont 802 1-700-222-2222 Vermont 802 111-2222 Vermont 804 211 Richmond, VA 804 990 Virginia Beach, VA 805 114 Bakersfield/Santa Barbara, CA 805 211-1101 Bakersfield/Santa Barbara, CA 805 211-2345 Bakersfield/Santa Barbara, CA 805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF) 805 830 Bakersfield/Santa Barbara, CA 806 970-xxxx Amarillo/Lubbock, TX 810 200200200200200 Flint/Pontiac/Southfield/Troy, MI 810 311 Pontiac/Southfield/Troy, MI 810 958-1111 Pontiac/Southfield/Troy, MI (GTE) 812 410-555-1212 Evansville, IN 813 311 Ft. Meyers/St. Petersburg/Tampa, FL 815 200-3374 Crystal Lake, IL 815 270-3374 Crystal Lake, IL 815 770-3374 Crystal Lake, IL 815 200-xxx-xxxx La Salle/Rockford, IL 815 290 La Salle/Rockford, IL 817 211 Ft. Worth/Waco, TX 817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell) 817 973-222-11111 Ft. Worth/Waco, TX 818 114 Pasadena, CA (GTE) 818 1223 Pasadena, CA (Some 1AESS switches) (Pac Bell) 818 211-2345 Pasadena, CA (English response) (Pac Bell) 818 211-2346 Pasadena, CA (DTMF response) (Pac Bell) 860 970 CT 901 899-?555 Memphis, TN 903 970-611-1111 Tyler, TX 904 200-222-222 Jackonsville/Pensacola/Tallahasee, FL 904 311 Jackonsville/Pensacola/Tallahasee, FL 904 780-2311 Jackonsville/Pensacola/Tallahasee, FL 906 1-200-222-2222 Marquette/Sault Ste. Marie, MI 906 958-1111 Marquette/Sault Ste. Marie, MI (GTE) 907 811 Anchorage, AK 908 958 New Brunswick, NJ 909 111 Riverside/San Bernardino, CA (GTE) 909 114 Riverside/San Bernardino, CA 910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC 912 711 Albany/Savannah, GA 912 780-2311 Albany/Savannah, GA 914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY 915 970-xxxx Abilene/El Paso, TX 916 211-0007 Sacramento, CA (Pac Bell) 916 461 Sacramento, CA (Roseville Telephone) 919 200 Durham, NC 919 711 Durham, NC 919 780-2411 Durham, NC 954 200-555-1212 Ft. Lauderdale, FL 954 200200200200200 Ft. Lauderdax Albany, NY 719 472-3772 Colorado Springs/Leadville/Pueblo, CO 805 255-0699 Bakersfield/Santa Barbara, CA 714 xxx-1117 Anaheim, CA 714 xxx-1118 Anaheim, CA 714 xxx-1119 Anaheim, CA 714 xxx-9198 Anaheim, CA 717 292-0009 Harrisburg/Scranton/Wilkes-Barre, PA 717 980-xxxx Harrisburg/Scranton/Wilkes Barre, PA 818 xxx-1117 Pasadena, CA 818 xxx-1118 Pasadena, CA 818 xxx-1119 Pasadena, CA 818 xxx-9198 Pasadena, CA 818 885-0699 Pasadena, CA (???-0699 is a pattern) 860 525-7078 Hartford, CT 906 632-9999 Marquette/Sault Ste. Marie, MI 906 635-9999 Marquette/Sault Ste. Marie, MI
If your NPA is not listed, or the listing does not cover your LATA, try common numbers such as 119 (GTD5 switches) or 511.
NPA Telephone Number Geography Length of disconnection 209 999 Stockton/Fresno/Lodi, CA (100 seconds) 313 xxx-9994 Ann Arbor/Dearborn/Detroit, MI (Ameritech) (1 minute) 314 511 Columbia/Jefferson City/St.Louis, MO (1 minute) 404 420 Atlanta, GA (5 minutes) 405 953 Enid/Oklahoma City, OK (1 minute) 407 511 Orlando, FL (United Telephone) (1 minute) 414 958-0013 Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute) 512 200 Austin/Corpus Christi, TX (1 minute) 516 480 Hempstead/Long Island, NY (1 minute) 517 xxx-9994 Bay City/Jackson/Lansing, MI (Ameritech) (1 minute) 518 958 Albany, NY (1 minute) 603 980 NH 614 xxx-9894 Columbus/Steubenville, OH 616 xxx-9994 Battle Creek/Grand Rapids/Kalamazoo, MI (Ameritech)(1 minute) 805 119 Bakersfield/Santa Barbara, CA (3 minutes) 807 211 Thunder Bay, Ontario (3 minutes) 810 xxx-9994 Pontiac/Southfield/Troy, MI (Ameritech) (1 minute) 906 xxx-9994 Marquette/Sault Ste. Marie, MI (Ameritech) (1 minute) 919 211 or 511 Durham, NC (10 min - 1 hour)
A Proctor Test Set is a tool used by telco personnel to diagnose problems with phone lines. You call the Proctor Test Set number and press buttons on a touch tone phone to active the tests you select.
If your NPA is not listed try common numbers such as 111 or 117.
NPA Telephone Number Geography 805 111 Bakersfield/Santa Barbara, CA 909 117 Tyler, TX 913 611-1111 Lawrence/Salina/Topeka, KS
Scanning is dialing a large number of telephone numbers in the hope of finding anything interesting. Interesting items often include test tones, computers, Voice Message Boxes (VMB's), Private Branch Exchanges (PBX's), and government offices.
Scanning can be done by hand, although dialing several thousand telephone numbers by hand is extremely boring and takes a long time.
Much better is to use a scanning program, sometimes called a war dialer or a demon dialer. Currently, the best war dialer available to PC-DOS users is ToneLoc from Minor Threat and Mucho Maas.
For the Macintosh, try Assault Dialer.
A war dialer will dial a range of numbers and log what it finds at each number. You can then only dial up the numbers that the war dialer marked as carriers or tones.
Excerpt from: 2600, Spring 1990, Page 27:
In some places, scanning has been made illegal. It would be hard, though, for someone to file a complaint against you for scanning since the whole purpose is to call every number once and only once. It's not likely to be thought of as harassment by anyone who gets a single phone call from a scanning computer. Some central offices have been known to react strangely when people start scanning. Sometimes you're unable to get a dialtone for hours after you start scanning. But there is no uniform policy. The best thing to do is to first find out if you've got some crazy law saying you can't do it. If, as is likely, there is no such law, the only way to find out what happens is to give it a try.
It should be noted that a law making scanning illegal was recently passed in Colorado Springs, CO. It is now illegal to place a call in Colorado Springs without the intent to communicate.
This FAQ answer was written by Phucked Agent 04:
This is the "right hand" of both the professional and the amatuer lineman. Basically, it is a customized portable telephone which is designed to be hooked onto raw cable terminals in the field and used to monitor the line, talk, or dial out. The monitor function is usually the main difference between the "butt-in" test set and the normal phone. If you don't have a real test set already, the following circuit can convert a normal $4 made-in-taiwan phone into a working test set. The "all-in-one" handset units without bases are the best (I tend to like QUIK's and GTE Flip Phone II's). Anyway-
OFFICIAL Agent 04 Generic Test Set Modification (tm)
OFFICIAL Agent 04 Generic Test Set Modification (tm)
Ring >---------------------------------> to "test set" phone
Tip >------! SPST Switch !-------->
!-----/ ----------!
>from !-------/!/!/!/!--! C = 0.22 uF 200 WVDC Mylar
cable pair ! C R ! R = 10 kOhm 1/2 W
(alligators) !--! (------------! SPST = Talk / Monitor
When SPST is closed, you are in talk mode; when you lift the switch- hook on the "test set" phone, you will get a dial tone as if you were a standard extension of the line you are on. You will be able to dial out and receive calls. When the SPST is opened, the resistor and capacitor are no longer shunted, and they become part of the telephone circuit. When you lift the switchhook on the test set, you will not receive dial tone, due to the fact that the cap blocks DC, and the resistor passes less than 4 mA nominally (far below the amount necessary to saturate the supervisory ferrod on ESS or close the line relay on any other switch). However, you will be able to silently monitor all audio on the line. The cap reactance + the phone's impedance insure that you won't cut the signal too much on the phone line, which might cause a noticeable change (..expedite the shock force, SOMEONE'S ON MY LINE!!). It's also good to have a VOM handy when working outside to rapidly check for active lines or supervision states.
Contact East
335 Willow Street
North Andover, MA 01845-5995
(508)682-2000
Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399
(800)426-1194
Specialized Products
3131 Premier Drive
Irving, TX 75063
(800)866-5353
Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064
(619)679-0303
DTMF stands for Dual Tone Multi Frequency. These are the tones you get when you press a key on your telephone touch pad. The tone of the button is the sum of the column and row tones. The ABCD keys do not exist on standard telephones.
1209hz 1336hz 1477hz 1633hz 697hz 1 2 3 A 770hz 4 5 6 B 852hz 7 8 9 C 941hz * 0 # D
Many of these tones are no longer used and are mentioned here only for historical accuracy.
This is a generic tone used with various interruption patterns for specific tones listed below and described under their own titles:
Line Busy Tone
Reorder
RevertingTone
No Circuit Tone
No Such Number
Vacant Code
Group Busy Tone
Deposit Coin Tone
Vacant Position Tone
Dial Off-Normal Tone
Trouble Tone
Dial Jack Tone
Dial Test Signal
Class of Service
Low Tone 480 Hz and 620 Hz at -24 dBm0/frequency. On some systems manufactured before 1974, Low Tone was 600 Hz modulated at 120, 133, 140 or 160 Hz at 61 - 71 dBrnC.
This is a generic tone used with various interruption patterns for the specific tones listed below and described under their own titles:
Partial Dial Tone
Permanent Signal
Coin Return (Test) Tone
Coin Return Tone
Number Checking Tone
Intercepting Loopback Tone
Warning Tone
Order Tone
Station Ringer Test
Class of Service
High Tone 480 Hz at -17 dBm0. On some systems manufactured before 1974, High Tone was 400 Hz or 500 Hz at 61 - 71 dBrnC.
This tone is sent to a customer or operator to indicate that the receiving end is ready to receive dial pulses or DTMF signals. It is used in all types of dial offices when dial pulses are produced by the customer's or operator's dials. Normally dial tone means that the entire wanted number may be dialed; however, there are some cases where the calling party must await a second dial tone or where an operator, after dialing an initial group of digits, must wait for a second dial tone before the rest of the number can be dialed. Some dialing switchboards are arranged to permit listening for dial tone between certain digits.
Dial Tone is 350 Hz and 440 Hz held steady at -13 dBm0/frequency.
This is a ringing indication which is intercepted by the calling party to mean that the called line has been reached and that the ringing has started. It is also used on calls to operators (special service, long distance, intercepting, etc) during the "awaiting-operator-answer" interval.
Audible Ring Tone is 440 Hz and 480 Hz for 2 seconds on and 4 seconds off at -13 dBm0/frequency.
The Line Busy Tine indicates that the called customer's line has been reached but that it is busy or being rung or on permanent signal. When a line busy signal is applied by an operator, it is sometimes calls a busy-back tone.
Line Busy Tone is Low Tone on and off every .5 seconds.
Reorder indicates that the local or toll switching or transmission paths to the office or equipment serving the called customer is busy. This signal may indicate a condition such as a timed-out sender or unassigned code dialed. It is interpreted by either a customer or an operator as a reorder signal.
Reorder on a local call is Low Tone for .3 seconds on and .2 seconds off. Reorder on a toll call is Low Tone for .2 seconds on and .3 seconds off. In No. 5 crossbar, No. 1/1A ESS, No. 2/2B ESS switching equipment and No. 1 step-by-step offices using the Precise Tone Plan, the temporal pattern is 0.25 second of low tone and 0.25 second off.
Indicates that an operator has connected to the line (emergency interrupt on a busy line during a verification call).
Alerting Tone is 440 Hz on for 2 seconds and then on again for .5 seconds every ten seconds.
When recording equipment is used, this tone is connected to the line to inform the distant party that the conversation is bveing recorded. The tone source is located within the recording equipment and cannot be controlled by the party applying the recording equipment to the line. This tone is required by law and is recorded along with the speech.
Recorder Warning Tone is a .5 second burst at 1400 Hz every 15 seconds.
This tone is used to inform the customer that his/her call is connected to a recording machine and that he/she should proceed to leave a message, dictate, etc. It is to be distinguished from the recorder warning tone, which warns the customer that his/her 2-way conversation is being recorded.
Recorder Warning Tone is a .5 second burst at 440 Hz every 5 seconds.
The same type of signal as line busy tone is used for reverting tone in all systems. In No. 5 crossbar systems, a second dial tone is sometimes also used when a calling party identification digit is required. The reverting signal informs the calling subscriber that the called party is on the same line and that he/she should hang up while the line is being rung.
Reverting Tone is is Low Tone on and off every .5 seconds at -24 dBm0/frequency.
This tone, sent from a Community Dial Office to a post-pay coin telephone, informs the calling party that the called party has answered and that the coin should be deposited.
Deposit Coin Tone is a steady Low Tone.
This tone is used to cause off-hook customers to replace the receiver on-hook on a permanent signal call and to signal a non-PBX off-hook line when ringing key is operated by a switchboard operator.
Receiver Off-Hook Tone is 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at 0
dBm0/frequency on and off every .1 second. On some older space division
switching systems Receiver Off-Hook was 1400 Hz, 2060 Hz, 2450 Hz and
2600 Hz at +5 VU on and off every .1 second. On a No. 5 ESS this
continues for 30 seconds. On a No. 2/2B ESS this continues for 40
seconds. On some other AT&T switches there are two iterations of 50
seconds each.
This tone is used in older offices to inform a customer that their receiver is off-hook. It has been superseded by the receiver off-hook tone.
Howler was a 480 Hz tone incremented in volume every second for ten seconds until it reaches +40 VU.
High-tone is used to notify the calling party that he/she has not commenced dialing within a preallotted time, measured after receipt of dial tone (permanent signal condition), or that he/she has not dialed enough digits (partial dial condition). This is a signal to hang up and dial again.
Partial Dial Tone is a steady High Tone.
This signal tells the calling party to hang up, check the called number, and dial again. In modern systems, calls to unassigned or discontinued numbers will also be routed to a machine announcement system, such as 6A or 7A, which verbally supplies the require message. In some older offices, you could be routed to an intercepting operator. In some offices, reorder tone is returned in this condition.
No Such Number is 200 to 400 Hz modulated at 1 Hz, interrupted every 6 seconds for .5 seconds.
This tone is used in crossbar systems to indicate that the dialed office code is unassigned. In step-by-step areas, this signal is called vacant level tone. For operator-originated calls, the verbal announcement is preceeded by two flashes. In modern systems, recorded verbal announcements are used for this service.
Vacant Code is Low Tone for .5 seconds on, .5 seconds off, .5 seconds of and 1.5 seconds off.
| © 1994 - 2003 HackFAQ.org
All Rights Reserved |