#hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony
Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous

Section D -- Telephony

D-01. What is a Red Box?

When a coin is inserted into a payphone, the payphone emits a set of tones to ACTS (Automated Coin Toll System). Red boxes work by fooling ACTS into believing you have actually put money into the phone. The red box simply plays the ACTS tones into the telephone microphone. ACTS hears those tones, and allows you to place your call. The actual tones are:

Nickel: 35-160ms 1700hz & 2200hz tone burst, followed by 240ms of silence.

Dime: Two 35-160ms 1700hz & 2200hz bursts, with a spacing of 20-110ms between the bursts, followed by 165 ms of silence.

Quarter: Five 1700hz & 2200hz bursts, with the first and last being 20-100ms in length, and the second through fourth being 20-60ms in length. The spacing between the first and second bursts is 20-110ms, while the spacing between the following bursts is 20-60ms. The tones are followed by 60ms of silence.

Canada uses a variant of ACTSD called N-ACTS. N-ACTS uses different tones than ACTS. In Canada, the tones to use are:

Nickel: 2200hz 0.060s on
Dime: 2200hz 0.060s on, 0.060s off, twice repeating
Quarter: 2200hz 33ms on, 33ms off, 5 times repeating

D-02. How do I build a Red Box?

Red boxes are commonly manufactured from Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components.

To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open the dialer and replace the crystal with a new one. The purpose of the new crystal is to cause the * button on your tone dialer to create a 1700hz and 2200hz tone instead of the original 941hz and 1209hz tones. The exact value of the replacement crystal should be 6.466806 to create a perfect 1700hz tone and 6.513698 to create a perfect 2200hz tone. A crystal close to those values will create a tone that easily falls within the loose tolerances of ACTS. The most popular choice is the 6.5536Mhz crystal, because it is the easiest to procure. The old crystal is the large shiny metal component labeled "3.579545Mhz." When you are finished replacing the crystal, program the P1 button with five *'s. That will simulate a quarter tone each time you press P1.

You can record the ACTS tones and play them back into the telephone. This is what is done with the Hallmark greeting card. Alternatively, you can build your own circuit using any voice recording chip, such as Radio Shack catalog number 276-1325.

D-03. Where can I get a 6.5536Mhz crystal?

Your best bet is a local electronics store. Radio Shack sells them, but they are overpriced and the store must order them in. This takes approximately two weeks. In addition, many Radio Shack employees do not know that this can be done.

Or, you could order the crystal mail order. This introduces Shipping and Handling charges, which are usually much greater than the price of the crystal. It's best to get several people together to share the S&H cost. Or, buy five or six yourself and sell them later. Some of the places you can order crystals are:

701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND

JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
Part Number: 6.5536MHZ

Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
Part Number: 10068625

2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057

Part Number: 332-1066

Blue Saguaro
P.O. Box 37061
Tucson, AZ 85740
Part Number: 1458b

Unicorn Electronics
10000 Canoga Ave, Unit c-2
Chatsworth, CA 91311
Phone: 1-800-824-3432
Part Number: CR6.5

D-04. Which payphones will a Red Box work on?

Red Boxes will work on telco owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones).

Red boxes work by fooling ACTS (Automated Coin Toll System) into believing you have put money into the pay phone. ACTS is the telephone company software responsible for saying "Please deposit XX cents" and listening for the coins being deposited.

COCOT's do not use ACTS. On a COCOT, the pay phone itself is responsible for determining what coins have been inserted.

D-05. How do I make local calls with a Red Box?

Payphones do not use ACTS for local calls. To use your red box for local calls, you have to fool ACTS into getting involved in the call.

One way to do this, in some areas, is by dialing an Equal Access Code before the number you are dialing. For example, to use 10288 (an Equal Access Code belonging to AT&T), dial 10288-xxx-xxxx. This makes your call a long distance call, and brings ACTS into the picture. There are quite a large number of Equal Access Codes available in most geographic regions.

In other areas, you can call Directory Assistance and ask for the number of the person you are trying to reach. The operator will give you the number and then you will hear a message similar to "Your call can be completed automatically for an additional 35 cents." When this happens, you can then use ACTS tones.

Another operator scam involves calling (800) long distance operators, asking them to connect you, and then playing the ACTS tones. This will get ACTS involved, even on COCOT's!

I have heard that in some areas you can dial local calls as if they were long distance. For example, to dial 345-4587 to would dial 303-345-4587. This does not work on payphones in my area.

D-06. What is a Blue Box?

Blue boxes use a 2600hz tone to size control of telephone switches that use in-band signalling. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the tones provided by the Blue Box.

D-07. Do Blue Boxes still work?

This FAQ answer is excerpted from a message posted to Usenet by Marauder of the Legion of Doom:

Somewhere along the line I have seen reference to something similar to "Because of ESS Blue boxing is impossible". This is incorrect. When I lived in Connecticut I was able to blue box under Step by Step, #1AESS, and DMS-100. The reason is simple, even though I was initiating my call to an 800 number from a different exchange (Class 5 office, aka Central Office) in each case, when the 800 call was routed to the toll network it would route through the New Haven #5 Crossbar toll Tandem office. It just so happens that the trunks between the class 5 (CO's) and the class 4 (toll office, in this case New Haven #5 Xbar), utilized in-band (MF) signalling, so regardless of what I dialed, as long as it was an Inter-Lata call, my call would route through this particular set of trunks, and I could Blue box until I was blue in the face. The originating Central Offices switch (SXS/ESS/Etc..) had little effect on my ability to box at all. While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). Unfortunately for the boxer 99% of the Toll Completion centers communicate using CCIS links, This spells disaster for the blue boxer since most of you must dial out of your local area to find trunks that utilize MF signalling, you inevitably cross a portion of the network that is CCIS equipped, you find an exchange that you blow 2600hz at, you are rewarded with a nice "winkstart", and no matter what MF tones you send at it, you meet with a re-order. This is because as soon as you seized the trunk (your application of 2600hz), your Originating Toll Office sees this as a loss of supervision at the destination, and Mutes any further audio from being passed to the destination (ie: your waiting trunk!). You meet with a reorder because the waiting trunk never "hears" any of the MF tones you are sending, and it times out. So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. (Hint: Take a close look at WATS extenders).

D-08. What is a Black Box?

A Black Box is a resistor (and often capacitor in parallel) placed in series across your phone line to cause the phone company equipment to be unable to detect that you have answered your telephone. People who call you will then not be billed for the telephone call. Black boxes do not work under ESS.

D-09. What do all the colored boxes do?

Acrylic Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems
Aqua Drain the voltage of the FBI lock-in-trace/trap-trace
Beige Lineman's hand set
Black Allows the calling party to not be billed for the call placed
Blast Phone microphone amplifier
Blotto Supposedly shorts every phone out in the immediate area
Blue Emulate a true operator by seizing a trunk with a 2600hz tone
Brown Create a party line from 2 phone lines
Bud Tap into your neighbors phone line
Chartreuse Use the electricity from your phone line
Cheese Connect two phones to create a diverter
Chrome Manipulate Traffic Signals by Remote Control
Clear A telephone pickup coil and a small amp used to make free calls on Fortress Phones
Color Line activated telephone recorder
Copper Cause crosstalk interference on an extender
Crimson Hold button
Dark Re-route outgoing or incoming calls to another phone
Dayglo Connect to your neighbors phone line
Diverter Re-route outgoing or incoming calls to another phone
DLOC Create a party line from 2 phone lines
Gold Dialout router
Green Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity Remotely activated phone tap
Jack Touch-Tone key pad
Light In-use light
Lunch AM transmitter
Magenta Connect a remote phone line to another remote phone line
Mauve Phone tap without cutting into a line
Neon External microphone
Noise Create line noise
Olive External ringer
Party Create a party line from 2 phone lines
Pearl Tone generator
Pink Create a party line from 2 phone lines
Purple Telephone hold button
Rainbow Kill a trace by putting 120v into the phone line (joke)
Razz Tap into your neighbors phone
Red Make free phone calls from pay phones by generating quarter tones
Rock Add music to your phone line
Scarlet Cause a neighbors phone line to have poor reception
Silver Create the DTMF tones for A, B, C and D
Static Keep the voltage on a phone line high
Switch Add hold, indicator lights, conferencing, etc..
Tan Line activated telephone recorder
Tron Reverse the phase of power to your house, causing your electric meter to run slower
TV Cable "See" sound waves on your TV
Urine Create a capacitative disturbance between the ring and tip wires in another's telephone headset
Violet Keep a payphone from hanging up
White Portable DTMF keypad
Yellow Add an extension phone

D-10. What is an ANAC number?

An ANAC (Automatic Number Announcement Circuit) number is a telephone number that plays back the number of the telephone that called it. ANAC numbers are convenient if you want to know the telephone number of a pair of wires.

D-11. What is the ANAC number for my area?

How to find your ANAC number:

Look up your NPA (Area Code) and try the number listed for it. If that fails, try 1 plus the number listed for it. If that fails, try the common numbers like 311, 958 and 200-222-2222. If you find the ANAC number for your area, please let us know.

Note that many times the ANAC number will vary for different switches in the same city. The geographic naming on the list is NOT intended to be an accurate reference for coverage patterns, it is for convenience only.

Many companies operate 800 number services which will read back to you the number from which you are calling. Many of these require navigating a series of menus to get the phone number you are looking for. Please use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC numbers.

(800)425-6256: VRS Billing Systems/Integretel
(800)487-9240: Another line blocking service

A non-800 ANAC that works nationwide is 404-988-9664. The one catch with this number is that it must be dialed with the AT&T Carrier Access Code 10732. Use of this number does not appear to be billed.

These geographic areas are for reference purposes only. ANAC numbers may vary from switch to switch within the same city.

NPA ANAC number Approximate Geographic area
201 958 Hackensack/Jersey City/Newark/Paterson, NJ
202 811 District of Columbia
203 970 CT
205 300-222-2222 Birmingham, AL
205 300-555-5555 Many small towns in AL
205 300-648-1111 Dora, AL
205 300-765-4321 Bessemer, AL
205 300-798-1111 Forestdale, AL
205 300-833-3333 Birmingham
205 557-2311 Birmingham, AL
205 811 Pell City/Cropwell/Lincoln, AL
205 841-1111 Tarrant, AL
205 908-222-2222 Birmingham, AL
206 411 WA (Not US West)
207 200-222-2222 ME
207 958 ME
209 830-2121 Stockton, CA
209 211-9779 Stockton, CA
210 830 Brownsville/Laredo/San Antonio, TX
210 951 Brownsville/Laredo/San Antonio, TX (GTE)
212 958 Manhattan, NY
213 114 Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 switches)
213 1223 Los Angeles, CA (GTE 1AESS and 5ESS switches)
213 211-2345 Los Angeles, CA (English response)
213 211-2346 Los Angeles, CA (DTMF response)
213 760-2??? Los Angeles, CA (DMS switches)
213 61056 Los Angeles, CA
214 570 Dallas, TX
214 790 Dallas, TX (GTE)
214 970 Dallas, TX (GTE)
214 970-222-2222 Dallas, TX (Southwestern Bell)
214 970-x11-1111 Dallas, TX (Southwestern Bell)
215 410-xxxx Philadelphia, PA
215 511 Philadelphia, PA
215 958 Philadelphia, PA
216 200-XXXX Akron/Canton/Cleveland/Lorain/Youngstown, OH
216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH
216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH
217 200-xxx-xxxx Champaign-Urbana/Springfield, IL
219 550 Gary/Hammond/Michigan City/Southbend, IN
219 559 Gary/Hammond/Michigan City/Southbend, IN
301 2002006969 Hagerstown/Rockville, MD
301 958-9968 Hagerstown/Rockville, MD
303 958 Aspen/Boulder/Denver/Durango/Grand Junction/Steamboat Springs, CO
305 200-555-1212 Ft. Lauderdale/Key West/Miami, FL
305 200200200200200 Ft. Lauderdale/Key West/Miami, FL
305 780-2411 Ft. Lauderdale/Key West/Miami, FL
310 114 Long Beach, CA (On many GTE switches)
310 1223 Long Beach, CA (Some 1AESS switches)
310 211-2345 Long Beach, CA (English response)
310 211-2346 Long Beach, CA (DTMF response)
312 200 Chicago, IL
312 290 Chicago, IL
312 1-200-8825 Chicago, IL (Last four change rapidly)
312 1-200-555-1212 Chicago, IL
313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI
313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI
313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI
313 200200200200200 Ann Arbor/Dearborn/Detroit, MI
313 311 Ann Arbor/Dearborn/Detroit, MI
313 958-1111 Ann Arbor/Dearborn/Detroit, MI (GTE)
314 410-xxxx# Columbia/Jefferson City/St.Louis, MO
315 953 Syracuse/Utica, NY
315 958 Syracuse/Utica, NY
315 998 Syracuse/Utica, NY
317 310-222-2222 Indianapolis/Kokomo, IN
317 559-222-2222 Indianapolis/Kokomo, IN
317 743-1218 Indianapolis/Kokomo, IN
334 5572411 Montgomery, AL
334 5572311 Montgomery, AL
401 200-200-4444 RI
401 222-2222 RI
401 2002006969 RI
402 311 Lincoln, NE
404 311 Atlanta, GA
404 780-2311 Atlanta, GA
404 940-xxx-xxxx Atlanta, GA
404 990 Atlanta, GA
405 890-7777777 Enid/Oklahoma City, OK
405 897 Enid/Oklahoma City, OK
407 200-222-2222 Orlando/West Palm Beach, FL (Bell South)
407 520-3111 Orlando/West Palm Beach, FL (United)
408 300-xxx-xxxx San Jose, CA
408 760 San Jose, CA
408 940 San Jose, CA
409 951 Beaumont/Galveston, TX
409 970-xxxx Beaumont/Galveston, TX
410 200-6969 Annapolis/Baltimore, MD
410 200-200-6969 Annapolis/Baltimore, MD
410 200-555-1212 Annapolis/Baltimore, MD
410 811 Annapolis/Baltimore, MD
412 711-6633 Pittsburgh, PA
412 711-4411 Pittsburgh, PA
412 999-xxxx Pittsburgh, PA
413 958 Pittsfield/Springfield, MA
413 200-555-5555 Pittsfield/Springfield, MA
414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 200-555-1212 San Francisco, CA
415 211-2111 San Francisco, CA
415 2222 San Francisco, CA
415 640 San Francisco, CA
415 760-2878 San Francisco, CA
415 7600-2222 San Francisco, CA
419 311 Toledo, OH
423 200-200-200 Chatanooga, Johnson City, Knoxville, TN
501 511 AR
501 721-xxx-xxxx AR
502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY
502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY
503 611 Portland, OR
503 999 Portland, OR (GTE)
504 99882233 Baton Rouge/New Orleans, LA
504 201-269-1111 Baton Rouge/New Orleans, LA
504 998 Baton Rouge/New Orleans, LA
504 99851-0000000000 Baton Rouge/New Orleans, LA
508 958 Fall River/New Bedford/Worchester, MA
508 200-222-1234 Fall River/New Bedford/Worchester, MA
508 200-222-2222 Fall River/New Bedford/Worchester, MA
508 26011 Fall River/New Bedford/Worchester, MA
509 560 Spokane/Walla Walla/Yakima, WA
510 760-1111 Oakland, CA
512 830 Austin/Corpus Christi, TX
512 970-xxxx Austin/Corpus Christi, TX
513 380-55555555 Cincinnati/Dayton, OH
515 5463 Des Moines, IA
515 811 Des Moines, IA
516 958 Hempstead/Long Island, NY
516 968 Hempstead/Long Island, NY
517 200-222-2222 Bay City/Jackson/Lansing, MI
517 200200200200200 Bay City/Jackson/Lansing, MI
517 958-1111 Bay City/Jackson/Lansing, MI (GTE)
518 511 Albany/Schenectady/Troy, NY
518 997 Albany/Schenectady/Troy, NY
518 998 Albany/Schenectady/Troy, NY
540 211 Roanoke, VA (GTE)
540 311 Roanoke, VA (GTE)
541 200 Bend, OR
573 511  
602 958-3474 Phoenix, AZ
601 200-222-2222 MS
603 200-2222 NH
603 200-222-2222 NH
606 997-555-1212 Ashland/Winchester, KY
606 711 Ashland/Winchester, KY
607 993 Binghamton/Elmira, NY
609 958 Atlantic City/Camden/Trenton/Vineland, NJ
610 958 Allentown/Reading, PA
610 958-4100 Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
614 200 Columbus/Steubenville, OH
614 571 Columbus/Steubenville, OH
615 200200200200200 Chatanooga/Knoxville/Nashville, TN
615 2002222222 Chatanooga/Knoxville/Nashville, TN
615 830 Nashville, TN
616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI
616 958-1111 Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
617 200-222-1234 Boston, MA
617 200-222-2222 Boston, MA
617 200-444-4444 Boston, MA (Woburn, MA)
617 220-2622 Boston, MA
617 958 Boston, MA
618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL
618 930 Alton/Cairo/Mt.Vernon, IL
619 211-2001 San Diego, CA
619 211-2121 San Diego, CA
659 220-2622 Newmarket, NH
703 211 VA
703 511-3636 Culpeper/Orange/Fredericksburg, VA
703 811 Alexandria/Arlington/Roanoke, VA
704 311 Asheville/Charlotte, NC
706 940-xxxx Augusta, GA
707 211-2222 Eureka, CA
707 611 Crescent City, CA
708 1-200-555-1212 Chicago/Elgin, IL
708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly)
708 200-6153 Chicago/Elgin, IL
708 724-9951 Chicago/Elgin, IL
713 380 Houston, TX
713 970-xxxx Houston, TX
713 811 Humble, TX
713 380-5555-5555 Houston, TX
714 114 Anaheim, CA (GTE)
714 211-2121 Anaheim, CA (PacBell)
714 211-2222 Anaheim, CA (Pacbell)
714 211-7777 Anaheim, CA (Pacbell)
716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
717 958 Harrisburg/Scranton/Wilkes-Barre, PA
718 958 Bronx/Brooklyn/Queens/Staten Island, NY
770 780-2311 Marietta/Norcross, GA
770 940-xxx-xxxx Marietta/Norcross, GA
802 2-222-222-2222 Vermont
802 200-222-2222 Vermont
802 1-700-222-2222 Vermont
802 111-2222 Vermont
804 211 Richmond, VA
804 990 Virginia Beach, VA
805 114 Bakersfield/Santa Barbara, CA
805 211-1101 Bakersfield/Santa Barbara, CA
805 211-2345 Bakersfield/Santa Barbara, CA
805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF)
805 830 Bakersfield/Santa Barbara, CA
806 970-xxxx Amarillo/Lubbock, TX
810 200200200200200 Flint/Pontiac/Southfield/Troy, MI
810 311 Pontiac/Southfield/Troy, MI
810 958-1111 Pontiac/Southfield/Troy, MI (GTE)
812 410-555-1212 Evansville, IN
813 311 Ft. Meyers/St. Petersburg/Tampa, FL
815 200-3374 Crystal Lake, IL
815 270-3374 Crystal Lake, IL
815 770-3374 Crystal Lake, IL
815 200-xxx-xxxx La Salle/Rockford, IL
815 290 La Salle/Rockford, IL
817 211 Ft. Worth/Waco, TX
817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell)
817 973-222-11111 Ft. Worth/Waco, TX
818 114 Pasadena, CA (GTE)
818 1223 Pasadena, CA (Some 1AESS switches) (Pac Bell)
818 211-2345 Pasadena, CA (English response) (Pac Bell)
818 211-2346 Pasadena, CA (DTMF response) (Pac Bell)
860 970 CT
901 899-?555 Memphis, TN
903 970-611-1111 Tyler, TX
904 200-222-222 Jackonsville/Pensacola/Tallahasee, FL
904 311 Jackonsville/Pensacola/Tallahasee, FL
904 780-2311 Jackonsville/Pensacola/Tallahasee, FL
906 1-200-222-2222 Marquette/Sault Ste. Marie, MI
906 958-1111 Marquette/Sault Ste. Marie, MI (GTE)
907 811 Anchorage, AK
908 958 New Brunswick, NJ
909 111 Riverside/San Bernardino, CA (GTE)
909 114 Riverside/San Bernardino, CA
910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
912 711 Albany/Savannah, GA
912 780-2311 Albany/Savannah, GA
914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY
915 970-xxxx Abilene/El Paso, TX
916 211-0007 Sacramento, CA (Pac Bell)
916 461 Sacramento, CA (Roseville Telephone)
919 200 Durham, NC
919 711 Durham, NC
919 780-2411 Durham, NC
954 200-555-1212 Ft. Lauderdale, FL
954 200200200200200 Ft. Lauderdale, FL
954 780-2411 Ft. Lauderdale, FL
204 644-4444 Manitoba
306 115 Saskatchewan
403 311 Alberta, Yukon and N.W. Territory
403 908-222-2222 Alberta, Yukon and N.W. Territory
403 999 Alberta, Yukon and N.W. Territory
416 997-xxxx Toronto, Ontario
416 997-1699 Down Town, Toronto, Ontario
416 997-1699 Riverdale, Toronto, Ontario
416 997-8123 Scarborough, Toronto, Ontario
506 1-555-1313 New Brunswick
514 320-xxxx Montreal, Quebec
514 320-1232 Montreal, Quebec
514 320-1223 Montreal, Quebec
514 320-1233 Montreal, Quebec
519 320-xxxx London, Ontario
604 1116 British Columbia
604 1211 British Columbia
604 211 British Columbia
613 320-2232 Ottawa, Ontario
613 320-5123 Kingston/Belleville/Southeastern Ontario
613 320-5124 Kingston/Belleville/Southeastern Ontario
613 320-9123 Kingston/Belleville/Southeastern Ontario
705 320-4567 North Bay/Saulte Ste. Marie, Ontario
819 320-1112 Quebec
United Kingdom:
  175 or 17071  

D-12. What is a ringback number?

A ringback number is a number that you call that will immediately ring the telephone from which it was called.

In most instances you must call the ringback number, quickly hang up the phone for just a short moment and then let up on the switch, you will then go back off hook and hear a different tone. You may then hang up. You will be called back seconds later. On some systems, you will have to press a button of flash hook again before the final hang up.

D-13. What is the ringback number for my area?

An 'x' means insert those numbers from the phone number from which you are calling. A '?' means that the number varies from switch to switch in the area, or changes from time to time. Try all possible combinations.

If the ringback for your NPA is not listed, try common ones such as 114, 951-xxx-xxxx, 954, 957 and 958. Also, try using the numbers listed for other NPA's served by your telephone company.

Note: These geographic areas are for reference purposes only. Ringback numbers may vary from switch to switch within the same city.

NPA Ringback number Approximate Geographic area
201 55?-xxxx Hackensack/Jersey City/Newark/Paterson, NJ
202 958-xxxx District of Columbia
203 99?-xxxx CT
206 571-xxxx WA
207 981-xxxx ME
208 59X-xxxx ID
208 99xxx-xxxx ID
210 211-8849-xxxx Brownsville/Laredo/San Antonio, TX (GTE)
213 xxx-xxxx Los Angeles, CA (GTE 2EAX, DMS100, and GTD-5 witches)
213 117-xxxx Los Angeles, CA (GTE 5ESS switches)
213 195-xxxx Los Angeles, CA (GTE 1AESS switches)
214 971-xxxx Dallas, TX
215 811-xxxx Philadelphia, PA
216 551-xxxx Akron/Canton/Cleveland/Lorain/Youngstown, OH
219 571-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
219 777-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
301 579-xxxx Hagerstown/Rockville, MD
301 958-xxxx Hagerstown/Rockville, MD
303 99x-xxxx Grand Junction, CO
304 998-xxxx WV
305 999-xxxx Ft. Lauderdale/Key West/Miami, FL
312 511-xxxx Chicago, IL
312 511-xxx-xxxx Chicago, IL
312 57?-xxxx Chicago, IL
313 116-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI (GTE)
313 951-xxxx Ann Arbor/Dearborn/Detroit, MI
315 98x-xxxx Syracuse/Utica, NY
317 777-xxxx Indianapolis/Kokomo, IN
317 xxx-xxxx Indianapolis/Kokomo, IN (y=3rd digit of phone number)
319 79x-xxxx Davenport/Dubuque, Iowa
334 901-xxxx Montgomery, AL
401 98?-xxxx RI
404 450-xxxx Atlanta, GA
407 988-xxxx Orlando/West Palm Beach, FL
408 470-xxxx San Jose, CA
408 580-xxxx San Jose, CA
412 985-xxxx Pittsburgh, PA
413 1983-xxxx Pittsfield/Springfield, MA
414 977-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
414 978-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 350-xxxx San Francisco, CA
417 551-xxxx Joplin/Springfield, MO
501 221-xxxx Ft. Smith, AR (646 prefix)
501 221-xxx-xxxx AR
501 780-xxxx Ft. Smith, AR (452 prefix)
502 988 Frankfort/Louisville/Paducah/Shelbyville, KY
503 541-XXXX OR
504 99x-xxxx Baton Rouge/New Orleans, LA
504 9988776655 Baton Rouge/New Orleans, LA
505 59?-xxxx New Mexico
512 95X-xxxx Austin, TX
513 951-xxxx Cincinnati/Dayton, OH
513 955-xxxx Cincinnati/Dayton, OH
513 99?-xxxx Cincinnati/Dayton, OH (X=0, 1, 2, 3, 4, 8 or 9)
515 559-XXXX Des Moines, IA
516 660-xxxx Hempstead/Long Island, NY
516 660-xxx-xxxx Hempstead/Long Island, NY
517 116-xxx-xxxx Bay City/Jackson/Lansing, MI (GTE)
520 594-xxxx AZ
601 777-xxxx MS
603 981-xxxx NH
609 55?-xxxx Atlantic City/Camden/Trenton/Vineland, NJ
610 811-xxxx Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
612 999-xxx-xxxx Minneapolis/St.Paul, MN
614 998-xxxx Columbus/Steubenville, OH
615 920-XXXX Chatanooga/Knoxville/Nashville, TN
615 930-xxxx Chatanooga/Knoxville/Nashville, TN
616 116-xxx-xxxx Battle Creek/Grand Rapids/Kalamazoo, MI (GTE)
616 946-xxxx Battle Creek/Grand Rapids/Kalamazoo, MI
619 331-xxxx San Diego, CA
619 332-xxxx San Diego, CA
659 981-XXXX Newmarket, NH
703 511-xxx-xxxx VA
703 958-xxxx Alexandria/Arlington/Roanoke, VA
708 511-xxxx Chicago/Elgin, IL
713 231-xxxx Los Angeles, CA
714 330? Anaheim, CA (GTE)
714 33?-xxxx Anaheim, CA (PacBell)
716 981-xxxx Rochester, NY (Rochester Tel)
718 660-xxxx Bronx/Brooklyn/Queens/Staten Island, NY
719 99x-xxxx Colorado Springs/Leadville/Pueblo, CO
801 938-xxxx Utah
801 939-xxxx Utah
802 987-xxxx Vermont
804 260 Charlottesville/Newport News/Norfolk/Richmond, VA
805 114 Bakersfield/Santa Barbara, CA
805 980-xxxx Bakersfield/Santa Barbara, CA
810 116-xxx-xxxx Pontiac/Southfield/Troy, MI (GTE)
810 951-xxx-xxxx Pontiac/Southfield/Troy, MI
813 711 Ft. Meyers/St. Petersburg/Tampa, FL
817 971 Ft. Worth/Waco, TX (Flashhook, then 2#)
818 915?-xxxx Pasadena, CA
864 999-xxx-xxxx Greenville/Spartanburg, SC
906 116-xxx-xxxx Marquette/Sault Ste. Marie, MI (GTE)
906 951-xxx-xxxx Marquette/Sault Ste. Marie, MI
908 55?-xxxx New Brunswick, NJ
908 953 New Brunswick, NJ
913 951-xxxx Lawrence/Salina/Topeka, KS
914 660-xxxx-xxxx Peekskill/Poughkeepsie/White Plains/Yonkers, NY
204 590-xxx-xxxx Manitoba
403 999-xxx-xxxx Alberta, Yukon, and N.W. Territories
416 57x-xxxx Toronto, Ontario
416 99x-xxxx Toronto, Ontario
416 999-xxx-xxxx Toronto, Ontario
506 572+xxx-xxxx New Brunswick
514 320-xxx-xxxx Montreal, Quebec
519 999-xxx-xxxx London, Ontario
604 311-xxx-xxxx British Columbia
604 871-xxx-xxxx British Columbia
613 999-xxx-xxxx Ottawa, Ontario
705 999-xxx-xxxx North Bay/Saulte Ste. Marie, Ontario
819 320-xxx-xxxx Quebec
902 575-xxx-xxxx Halifax, Nova Scotia
905 999-xxx-xxxx Hamilton/Mississauga/Niagra Falls, Ontario
  +61 199  
New Zealand:
United Kingdom:
  174 or 1744 or 175 or 0500-89-0011 or 17070 + 1  
The Netherlands:
  0196 Amsterdam
  0123456789 Hilversum
  0123456789 Breukelen
  951 Groningen

D-14. What is a loop?

This FAQ answer is excerpted from: ToneLoc v0.99 User Manual by Minor Threat & Mucho Maas

Loops are a pair of phone numbers, usually consecutive, like 836-9998 and 836-9999. They are used by the phone company for testing. What good do loops do us? Well, they are cool in a few ways. Here is a simple use of loops. Each loop has two ends, a 'high' end, and a 'low' end. One end gives a (usually) constant, loud tone when it is called. The other end is silent. Loops don't usually ring either. When BOTH ends are called, the people that called each end can talk through the loop. Some loops are voice filtered and won't pass anything but a constant tone; these aren't much use to you. Here's what you can use working loops for: billing phone calls! First, call the end that gives the loud tone. Then if the operator or someone calls the other end, the tone will go quiet. Act like the phone just rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or what the fuck ever. The operator thinks that she just called you, and that's it! Now the phone bill will go to the loop, and your local RBOC will get the bill! Use this technique in moderation, or the loop may go down. Loops are probably most useful when you want to talk to someone to whom you don't want to give your phone number.

D-15. What is a loop in my area?

Many (if not most) of these loops are no longer functional. If you are local to any of these loops, please try them out an e-mail me the results of your research.

NPA High Low Notes
201 666-9929 666-9930  
208 862-9996 862-9997  
213 365-1118 365-1119  
308 357-0004 357-0005  
310 455-0002 455-????  
310 546-0002 546-????  
312 262-9902 262-9903 Very odd sound
313 224-9996 224-9997  
313 225-9996 225-9997  
313 234-9996 234-9997  
313 237-9996 237-9997  
313 256-9996 256-9997  
313 272-9996 272-9997  
313 273-9996 273-9997  
313 277-9996 277-9997  
313 281-9996 281-9997  
313 292-9996 292-9997  
313 299-9996 299-9997  
313 321-9996 321-9997  
313 326-9996 326-9997  
313 356-9996 356-9997  
313 362-9996 362-9997  
313 369-9996 369-9997  
313 388-9996 388-9997  
313 397-9996 397-9997  
313 399-9996 399-9997  
313 445-9996 445-9997  
313 465-9996 465-9997  
313 471-9996 471-9997  
313 474-9996 474-9997  
313 477-9996 477-9997  
313 478-9996 478-9997  
313 483-9996 483-9997  
313 497-9996 497-9997  
313 526-9996 526-9997  
313 552-9996 552-9997  
313 556-9996 556-9997  
313 561-9996 561-9997  
313 569-9996 569-9996  
313 575-9996 575-9997  
313 577-9996 577-9997  
313 585-9996 585-9997  
313 591-9996 591-9997  
313 621-9996 621-9997  
313 626-9996 626-9997  
313 644-9996 644-9997  
313 646-9996 646-9997  
313 647-9996 647-9997  
313 649-9996 649-9997  
313 663-9996 663-9997  
313 665-9996 665-9997  
313 683-9996 683-9997  
313 721-9996 721-9997  
313 722-9996 722-9997  
313 728-9996 728-9997  
313 731-9996 731-9997  
313 751-9996 751-9997  
313 776-9996 776-9997  
313 781-9996 781-9997  
313 787-9996 787-9997  
313 822-9996 822-9997  
313 833-9996 833-9997  
313 851-9996 851-9997  
313 871-9996 871-9997  
313 875-9996 875-9997  
313 886-9996 886-9997  
313 888-9996 888-9997  
313 898-9996 898-9997  
313 934-9996 934-9997  
313 942-9996 942-9997  
313 963-9996 963-9997  
313 977-9996 977-9997  
315 673-9995 673-9996  
315 695-9995 695-9996  
323 626-1118 626-1119  
406 225-9902 225-9903  
408 238-0044 238-0045  
408 773-0044 773-0045  
501 753-4291 753-4297  
517 422-9996 422-9997  
517 423-9996 423-9997  
517 563-9996 563-9997  
517 663-9996 663-????  
517 851-9996 851-9997  
562 369-1118 369-1119  
613 966-1111    
619 364-1118 364-1119  
703 591-9994    
713 342-1499 342-1799  
713 351-1499 351-1799  
713 354-1499 354-1799  
713 356-1499 356-1799  
713 442-1499 442-1799  
713 447-1499 447-1799  
713 455-1499 455-1799  
713 458-1499 458-1799  
713 462-1499 462-1799  
713 466-1499 466-1799  
713 468-1499 468-1799  
713 469-1499 469-1799  
713 471-1499 471-1799  
713 481-1499 481-1799  
713 482-1499 482-1799  
713 484-1499 484-1799  
713 487-1499 487-1799  
713 489-1499 489-1799  
713 492-1499 492-1799  
713 493-1499 493-1799  
713 524-1499 524-1799  
713 526-1499 526-1799  
713 555-1499 555-1799  
713 661-1499 661-1799  
713 664-1499 664-1799  
713 665-1499 665-1799  
713 666-1499 666-1799  
713 667-1499 667-1799  
713 682-1499 976-1799  
713 771-1499 771-1799  
713 780-1499 780-1799  
713 781-1499 997-1799  
713 960-1499 960-1799  
713 977-1499 977-1799  
713 988-1499 988-1799  
714 629-1118 629-1119  
719 598-0009 598-0010  
805 528-0044 528-0045  
805 544-0044 544-0045  
805 773-0044 773-0045  
808 235-9907 235-9908  
808 239-9907 239-9908  
808 245-9907 245-9908  
808 247-9907 247-9908  
808 261-9907 261-9908  
808 322-9907 322-9908  
808 328-9907 328-9908  
808 329-9907 329-9908  
808 332-9907 332-9908  
808 335-9907 335-9908  
808 572-9907 572-9908  
808 623-9907 623-9908  
808 624-9907 624-9908  
808 668-9907 668-9908  
808 742-9907 742-9908  
808 879-9907 879-9908  
808 882-9907 882-9908  
808 885-9907 885-9908  
808 959-9907 959-9908  
808 961-9907 961-9908  
810 362-9996 362-9997  
813 385-9971 385-xxxx  
847 724-9951 724-????  
908 254-9929 254-9930  
908 558-9929 558-9930  
908 560-9929 560-9930  
908 776-9930 776-9930  
909 661-1118 661-1119  
916 221-0044 221-0045 Voice filtered
916 222-0044 222-0045 Voice filtered

D-16. What is a CNA number?

CNA stands for Customer Name and Address. The CNA number is a phone number for telephone company personnel to call and get the name and address for a phone number. If a telephone lineman finds a phone line he does not recognize, he can use the ANI number to find its phone number and then call the CNA operator to see who owns it and where they live.

Normal CNA numbers are available only to telephone company personnel. Private citizens may legally get CNA information from private companies. Companies offering this service include:

Cross-Reference Directories (900)288-3020
AT&T National Directory Assistance (900)555-1212
Telename (900)884-1212
Unidirectory (900)933-3330

Note that these are 900 numbers, and will cost you approximately one dollar per minute.

If you are in 312, 708, or parts of 815, AmeriTech has a pay-for-play CNA service available to the general public. The number is 796-9600. The cost is $.35/call and can look up two numbers per call.

If you are in 415, Pacific Bell offers a public access CNL service at (415)705-9299.

If you are in Bell Atlantic territory you can call (201)555-5454 or (908)555-5454 for automated CNA information. The cost is $.50/call.

The legal telephone company CNA for Ontario is 555-1313.

You can fool (800)967-5356 into giving you a free CNA by requesting a free disk and then entering the number you want the adress for at the prompt.

You can often social engineer CNA information out of telephone company employees or out of employees of other companies with CNA access.

Here is a sample script that works if your target has ever ordered pizza from Domino's or Pizza Hut:

Them: Hi, thanks for call, may I take your order please?

You: Yes, I'd like 4 large pepperoni pizzas.

Them: May I have your phone number please?

You: <State your targets phone number here>

Them: Is this 238 Ward Road?

You: Yes ma'am.

D-17. What is the telephone company CNA number for my area?

NPA Telephone Number Geography
203 (203)771-8080 CT
214 (214)744-9500 Southwestern Bell
214 (214)745-7505 Southwestern Bell
217 (217)789-8290 Ameritech (Illinois)
312 (312)796-9600 Chicago, IL
506 (506)555-1313 New Brunswick
513 (513)397-9110 Cincinnati/Dayton, OH
516 (516)321-5700 Hempstead/Long Island, NY
614 (614)464-0123 Columbus/Steubenville, OH
813 (813)270-8711 Ft. Meyers/St. Petersburg/Tampa, FL
912 (912)752-2000 #1367 Albany/Savannah, GA
NYNEX (518)471-8111 New York, Connecticut, Vermont, Rhode
Island, New Hampshire, and Massachusetts

D-18. What are some numbers that always ring busy?

In the following listings, "xxx" means that the same number is used as a constantly busy number in many different prefixes. In most of these, there are some exchanges that ring busy and some exchanges that are in normal use. ALWAYS test these numbers at least three times during normal business hours before using as a constantly busy number.

NPA Telephone Number Geography
800 999-1803 WATS
201 635-9970 Hackensack/Jersey City/Newark/Paterson, NJ
212 724-9970 Manhattan, NY
213 xxx-1117 Los Angeles, CA
213 xxx-1118 Los Angeles, CA
213 xxx-1119 Los Angeles, CA
213 xxx-9198 Los Angeles, CA
216 xxx-9887 Akron/Canton/Cleveland/Lorain/Youngstown, OH
303 431-0000 Denver, CO
303 866-8660 Denver, CO
310 xxx-1117 Long Beach, CA
310 xxx-1118 Long Beach, CA
310 xxx-1119 Long Beach, CA
310 xxx-9198 Long Beach, CA
316 952-7265 Dodge City/Wichita, KS
501 377-99xx AR
518 571-xxxx Albany, NY
719 472-3772 Colorado Springs/Leadville/Pueblo, CO
805 255-0699 Bakersfield/Santa Barbara, CA
714 xxx-1117 Anaheim, CA
714 xxx-1118 Anaheim, CA
714 xxx-1119 Anaheim, CA
714 xxx-9198 Anaheim, CA
717 292-0009 Harrisburg/Scranton/Wilkes-Barre, PA
717 980-xxxx Harrisburg/Scranton/Wilkes Barre, PA
818 xxx-1117 Pasadena, CA
818 xxx-1118 Pasadena, CA
818 xxx-1119 Pasadena, CA
818 xxx-9198 Pasadena, CA
818 885-0699 Pasadena, CA (???-0699 is a pattern)
860 525-7078 Hartford, CT
906 632-9999 Marquette/Sault Ste. Marie, MI
906 635-9999 Marquette/Sault Ste. Marie, MI

D-19. What are some numbers that temporarily disconnect phone service?

If your NPA is not listed, or the listing does not cover your LATA, try common numbers such as 119 (GTD5 switches) or 511.

NPA Telephone Number Geography Length of disconnection
209 999 Stockton/Fresno/Lodi, CA (100 seconds)
313 xxx-9994 Ann Arbor/Dearborn/Detroit, MI (Ameritech) (1 minute)
314 511 Columbia/Jefferson City/St.Louis, MO (1 minute)
404 420 Atlanta, GA (5 minutes)
405 953 Enid/Oklahoma City, OK (1 minute)
407 511 Orlando, FL (United Telephone) (1 minute)
414 958-0013 Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute)
512 200 Austin/Corpus Christi, TX (1 minute)
516 480 Hempstead/Long Island, NY (1 minute)
517 xxx-9994 Bay City/Jackson/Lansing, MI (Ameritech) (1 minute)
518 958 Albany, NY (1 minute)
603 980 NH  
614 xxx-9894 Columbus/Steubenville, OH  
616 xxx-9994 Battle Creek/Grand Rapids/Kalamazoo, MI (Ameritech)(1 minute)
805 119 Bakersfield/Santa Barbara, CA (3 minutes)
807 211 Thunder Bay, Ontario (3 minutes)
810 xxx-9994 Pontiac/Southfield/Troy, MI (Ameritech) (1 minute)
906 xxx-9994 Marquette/Sault Ste. Marie, MI (Ameritech) (1 minute)
919 211 or 511 Durham, NC (10 min - 1 hour)

D-20. What is a Proctor Test Set?

A Proctor Test Set is a tool used by telco personnel to diagnose problems with phone lines. You call the Proctor Test Set number and press buttons on a touch tone phone to active the tests you select.

D-21. What is a Proctor Test Set in my area?

If your NPA is not listed try common numbers such as 111 or 117.

NPA Telephone Number Geography
805 111 Bakersfield/Santa Barbara, CA
909 117 Tyler, TX
913 611-1111 Lawrence/Salina/Topeka, KS

D-22. What is scanning?

Scanning is dialing a large number of telephone numbers in the hope of finding anything interesting. Interesting items often include test tones, computers, Voice Message Boxes (VMB's), Private Branch Exchanges (PBX's), and government offices.

Scanning can be done by hand, although dialing several thousand telephone numbers by hand is extremely boring and takes a long time.

Much better is to use a scanning program, sometimes called a war dialer or a demon dialer. Currently, the best war dialer available to PC-DOS users is ToneLoc from Minor Threat and Mucho Maas.

For the Macintosh, try Assault Dialer.

A war dialer will dial a range of numbers and log what it finds at each number. You can then only dial up the numbers that the war dialer marked as carriers or tones.

D-23. Is scanning illegal?

Excerpt from: 2600, Spring 1990, Page 27:

In some places, scanning has been made illegal. It would be hard, though, for someone to file a complaint against you for scanning since the whole purpose is to call every number once and only once. It's not likely to be thought of as harassment by anyone who gets a single phone call from a scanning computer. Some central offices have been known to react strangely when people start scanning. Sometimes you're unable to get a dialtone for hours after you start scanning. But there is no uniform policy. The best thing to do is to first find out if you've got some crazy law saying you can't do it. If, as is likely, there is no such law, the only way to find out what happens is to give it a try.

It should be noted that a law making scanning illegal was recently passed in Colorado Springs, CO. It is now illegal to place a call in Colorado Springs without the intent to communicate.

D-24. How can I make a lineman's handset?

This FAQ answer was written by Phucked Agent 04:

This is the "right hand" of both the professional and the amatuer lineman. Basically, it is a customized portable telephone which is designed to be hooked onto raw cable terminals in the field and used to monitor the line, talk, or dial out. The monitor function is usually the main difference between the "butt-in" test set and the normal phone. If you don't have a real test set already, the following circuit can convert a normal $4 made-in-taiwan phone into a working test set. The "all-in-one" handset units without bases are the best (I tend to like QUIK's and GTE Flip Phone II's). Anyway-

OFFICIAL Agent 04 Generic Test Set Modification (tm)

OFFICIAL Agent 04 Generic Test Set Modification (tm)

  Ring >---------------------------------> to "test set" phone
   Tip >------!  SPST Switch    !-------->
              !-----/ ----------!
>from         !-------/!/!/!/!--!    C = 0.22 uF  200 WVDC Mylar
cable pair    !   C       R     !    R = 10 kOhm 1/2 W
(alligators)  !--! (------------! SPST = Talk / Monitor

When SPST is closed, you are in talk mode; when you lift the switch- hook on the "test set" phone, you will get a dial tone as if you were a standard extension of the line you are on. You will be able to dial out and receive calls. When the SPST is opened, the resistor and capacitor are no longer shunted, and they become part of the telephone circuit. When you lift the switchhook on the test set, you will not receive dial tone, due to the fact that the cap blocks DC, and the resistor passes less than 4 mA nominally (far below the amount necessary to saturate the supervisory ferrod on ESS or close the line relay on any other switch). However, you will be able to silently monitor all audio on the line. The cap reactance + the phone's impedance insure that you won't cut the signal too much on the phone line, which might cause a noticeable change (..expedite the shock force, SOMEONE'S ON MY LINE!!). It's also good to have a VOM handy when working outside to rapidly check for active lines or supervision states.

D-25. Where can I purchase a lineman's handset?

Contact East
335 Willow Street
North Andover, MA 01845-5995

Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399

Specialized Products
3131 Premier Drive
Irving, TX 75063

Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064

D-26. What are the DTMF frequencies?

DTMF stands for Dual Tone Multi Frequency. These are the tones you get when you press a key on your telephone touch pad. The tone of the button is the sum of the column and row tones. The ABCD keys do not exist on standard telephones.

  1209hz 1336hz 1477hz 1633hz
697hz 1 2 3 A
770hz 4 5 6 B
852hz 7 8 9 C
941hz * 0 # D

D-27. What are the frequencies of the telephone tones?

Many of these tones are no longer used and are mentioned here only for historical accuracy.

Low Tone

This is a generic tone used with various interruption patterns for specific tones listed below and described under their own titles:

Line Busy Tone
No Circuit Tone
No Such Number
Vacant Code
Group Busy Tone
Deposit Coin Tone
Vacant Position Tone
Dial Off-Normal Tone
Trouble Tone
Dial Jack Tone
Dial Test Signal
Class of Service

Low Tone 480 Hz and 620 Hz at -24 dBm0/frequency. On some systems manufactured before 1974, Low Tone was 600 Hz modulated at 120, 133, 140 or 160 Hz at 61 - 71 dBrnC.

High Tone

This is a generic tone used with various interruption patterns for the specific tones listed below and described under their own titles:

Partial Dial Tone
Permanent Signal
Coin Return (Test) Tone
Coin Return Tone
Number Checking Tone
Intercepting Loopback Tone
Warning Tone
Order Tone
Station Ringer Test
Class of Service

High Tone 480 Hz at -17 dBm0. On some systems manufactured before 1974, High Tone was 400 Hz or 500 Hz at 61 - 71 dBrnC.

Dial Tone

This tone is sent to a customer or operator to indicate that the receiving end is ready to receive dial pulses or DTMF signals. It is used in all types of dial offices when dial pulses are produced by the customer's or operator's dials. Normally dial tone means that the entire wanted number may be dialed; however, there are some cases where the calling party must await a second dial tone or where an operator, after dialing an initial group of digits, must wait for a second dial tone before the rest of the number can be dialed. Some dialing switchboards are arranged to permit listening for dial tone between certain digits.

Dial Tone is 350 Hz and 440 Hz held steady at -13 dBm0/frequency.

Audible Ring Tone

This is a ringing indication which is intercepted by the calling party to mean that the called line has been reached and that the ringing has started. It is also used on calls to operators (special service, long distance, intercepting, etc) during the "awaiting-operator-answer" interval.

Audible Ring Tone is 440 Hz and 480 Hz for 2 seconds on and 4 seconds off at -13 dBm0/frequency.

Line Busy Tone

The Line Busy Tine indicates that the called customer's line has been reached but that it is busy or being rung or on permanent signal. When a line busy signal is applied by an operator, it is sometimes calls a busy-back tone.

Line Busy Tone is Low Tone on and off every .5 seconds.


Reorder indicates that the local or toll switching or transmission paths to the office or equipment serving the called customer is busy. This signal may indicate a condition such as a timed-out sender or unassigned code dialed. It is interpreted by either a customer or an operator as a reorder signal.

Reorder on a local call is Low Tone for .3 seconds on and .2 seconds off. Reorder on a toll call is Low Tone for .2 seconds on and .3 seconds off. In No. 5 crossbar, No. 1/1A ESS, No. 2/2B ESS switching equipment and No. 1 step-by-step offices using the Precise Tone Plan, the temporal pattern is 0.25 second of low tone and 0.25 second off.

Alerting Tone

Indicates that an operator has connected to the line (emergency interrupt on a busy line during a verification call).

Alerting Tone is 440 Hz on for 2 seconds and then on again for .5 seconds every ten seconds.

Recorder Warning Tone

When recording equipment is used, this tone is connected to the line to inform the distant party that the conversation is bveing recorded. The tone source is located within the recording equipment and cannot be controlled by the party applying the recording equipment to the line. This tone is required by law and is recorded along with the speech.

Recorder Warning Tone is a .5 second burst at 1400 Hz every 15 seconds.

Recorder Connected Tone

This tone is used to inform the customer that his/her call is connected to a recording machine and that he/she should proceed to leave a message, dictate, etc. It is to be distinguished from the recorder warning tone, which warns the customer that his/her 2-way conversation is being recorded.

Recorder Warning Tone is a .5 second burst at 440 Hz every 5 seconds.

Reverting Tone

The same type of signal as line busy tone is used for reverting tone in all systems. In No. 5 crossbar systems, a second dial tone is sometimes also used when a calling party identification digit is required. The reverting signal informs the calling subscriber that the called party is on the same line and that he/she should hang up while the line is being rung.

Reverting Tone is is Low Tone on and off every .5 seconds at -24 dBm0/frequency.

Deposit Coin Tone

This tone, sent from a Community Dial Office to a post-pay coin telephone, informs the calling party that the called party has answered and that the coin should be deposited.

Deposit Coin Tone is a steady Low Tone.

Receiver Off-Hook Tone

This tone is used to cause off-hook customers to replace the receiver on-hook on a permanent signal call and to signal a non-PBX off-hook line when ringing key is operated by a switchboard operator.

Receiver Off-Hook Tone is 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at 0 dBm0/frequency on and off every .1 second. On some older space division switching systems Receiver Off-Hook was 1400 Hz, 2060 Hz, 2450 Hz and 2600 Hz at +5 VU on and off every .1 second. On a No. 5 ESS this continues for 30 seconds. On a No. 2/2B ESS this continues for 40 seconds. On some other AT&T switches there are two iterations of 50 seconds each.


This tone is used in older offices to inform a customer that their receiver is off-hook. It has been superseded by the receiver off-hook tone.

Howler was a 480 Hz tone incremented in volume every second for ten seconds until it reaches +40 VU.

Partial Dial Tone

High-tone is used to notify the calling party that he/she has not commenced dialing within a preallotted time, measured after receipt of dial tone (permanent signal condition), or that he/she has not dialed enough digits (partial dial condition). This is a signal to hang up and dial again.

Partial Dial Tone is a steady High Tone.

No Such Number a.k.a. "Cry Baby"

This signal tells the calling party to hang up, check the called number, and dial again. In modern systems, calls to unassigned or discontinued numbers will also be routed to a machine announcement system, such as 6A or 7A, which verbally supplies the require message. In some older offices, you could be routed to an intercepting operator. In some offices, reorder tone is returned in this condition.

No Such Number is 200 to 400 Hz modulated at 1 Hz, interrupted every 6 seconds for .5 seconds.

Vacant Code

This tone is used in crossbar systems to indicate that the dialed office code is unassigned. In step-by-step areas, this signal is called vacant level tone. For operator-originated calls, the verbal announcement is preceeded by two flashes. In modern systems, recorded verbal announcements are used for this service.

Vacant Code is Low Tone for .5 seconds on, .5 seconds off, .5 seconds of and 1.5 seconds off.

Busy Verification Tone (Centrex)

Busy verification is a Centrex feature that allows the attendant to call and be connected to a busy Centrex station within the attendant's customer group. The busy verification tone is applied to both parties of the connection to inform them of the intrusion by the attendant. No tone is applied if the station called for busy verification is idle.

Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds and then again for .3 seconds every 7.5 to 10 seconds. On a No. 1/1A ESS, Busy Verification Tone (Centrex) is 440 Hz at -13 dBm0 for 1.5 seconds and then again for .3 seconds every 6 seconds.

There is also a TSPS Busy Verification tone, which is 440 Hz at -13 dBm0 for 2 seconds and then on again for .5 seconds every 10 seconds.

Call Waiting Tone

Call Waiting is a special service that allows a busy line to answer an incoming call by flashing the switchhook. Audible ring (instead of line busy) is applied to the calling line, and the Call Waiting tone is applied to the called line. (So that only the called party hears the tone, the connection is momentarily broken, and the other party to that connection experiences a moment of silence.) Flashing the switchhook places the existing connection on hold and connects the customer to the waiting call.

Call Waiting Tone is two bursts of 440 Hz at -13 dBm0/frequency for .3 seconds plus or minus ten percent every ten seconds.

Confirmation Tone

This tone is used to acknowledge receipt by automatic equipment of information necessary for special services. It is currently used for:

  1. Speed Calling - dialed number has been recorded
  2. Call Forwarding - dialed number has been recorded and service is activated
  3. Call Forwarding - service is deactivated

Confirmation Tone is 350 Hz and 440 Hz at -13 dBm0/frequency on for .1 second, off for .1 second and then on for .3 seconds.

Indication of Camp-On

Attendant camp-on service allows an electronic switching system Centrex attendant to hold incoming calls to busy lines. Each time the attendant releases his/her talking connection from the loop involved in the camped-on call, the indication of camp-on tone is heard by the called customer if the customer has subscribed to the indication of camp-on option. The customer may get this tone several times as the attendant reconnects and releases from the loop in response to timed reminders from the console.

Indication of Camp On is 440 Hz at -13 dBm0 for one second every time the attendant releases from the loop.

Special Dial Tone

This tone is used with Three-Way Calling, Centrex station dial transfer, and Centrex conference (station or attendant) services. The user on an existing connection flashes the switchhook, receives special dial tone, and dials number of the third party to be added to the connection.

Special Dial Tone is 350 Hz and 440 Hz at -13 dBm0/frequency for .1 second on, .1 second off, .1 second on, .1 second off, .1 second on, .1 second off, and then on steady.

Priority Audible Ring (AUTOVON)

This tone replaces normal audible ring for priority calls within the AUTOVON network.

Priority Audible Ring is 440 Hz and 480 Hz at -16 dBm0/frequency on for 1.65 seconds and off for .35 seconds.

Preemption Tone (AUTOVON)

This tone is provided to both parties of a connection that is preempted by a priority call from the AUTOVON network.

Preemption Tone is 440 Hz and 620 Hz at -18 dBm0/frequency steady for anywhere from three to fifteen seconds.

Data Set Answer Back Tone

This set is heard when manually initiating a data call. It normally occurs shortly after the start of audible ringing and means that the remote data set has answered. The data set at the calling end should then be put into the data mode.

Data Set Answer Back Tone is 2025 Hz steady at -13 dBm.

Calling Card Service Prompt Tone

This tone is used to inform the customer that his/her credit card information must be keyed in. The first 60 milliseconds of this composite tone is 941 Hz abd 1477 Hz which is the DTMF '#'. This tone will release and DTMF to dial pulse converter in the conneciton.

Calling Card Service Prompt Tone is 941 Hz and 1477 Hz at -10 dBm0/frequency at -3 Transmission Level Point for 60 milliseconds and then 440 Hz and 350 Hz at -7 dBm0 for .940 seconds exponentially decayed from -10 dBm per frequency at -3 Transmission Level Point at time constant of .2 seconds.

Class of Service

These signals are used at a toll board operating as an 'A" board to identify the class or service of the calling customer. The indication may be high, low, or no tone.

Class of Service is a single burst of either High Tone or Low Tone for .05 to 1 seconds.

Dial-Normal Transmission Signal

This is a second dial tone returned to an operator between digits indicating that he/she may dial the remainder of the number. For example, when an operator reaches a link-type Community Dial Office via a step-by-step office after dialing a routing code, he/she must pause until an idle link at the Community Dial Office returns dial tone. This method of operation is not recommended or considered standard.

Dial-Normal Transmission Signal is a steady Low Tone.

Dial Jack Tone

Low tone is used as a start-dial signal to tell a DSA operator that the connection reached through a dial jack is ready to receive dialing.

Dial Jack Tone is a steady Low Tone.

Order Tone

High tones sent over interposition, local interoffice, or toll trunks indicate:

  1. the the originating operator that the order should be passed
  2. to the receiving operator that an order is about to be passed

For Call Announcement and Autometic Display Call Indicator, the tone serves function two only.

  1. Single-order tone - This is a relatively long (0.5 second) signal which means that the originating operator should pass the office name and number.

  2. Double-order tone - This signal is two short spurts in quick succession and means that the operator should pass only the desired number.

  3. Triple-order tone - This signal is three short spurts in quick succession and means that the operator should pass the office name only and wait for another order tone.

  4. Quadruple-order tone - This signal is four short spurts in quick succession and means that the operator should pass the city name only and wait for another challenge. It is used in manual toll tandem (also called zip tones or trunk assignment tones).

Single-order tone is one .5 spurt of High Tone. Double-order tone is two short spurts of High Tone. Triple-order tone is three short spurts of High Tone. Quadruple-order tone is four short spurts of High Tone.

Intercepting Loopback Tone

High tone sent from an intercept operator to the 'A' board operator in manual offices indicates that an intercept operator has completed the call and that the 'A' should disconnect from the circuit. The completion of intercepted calls in this manner is no longer recommended.

Intercepting Loopback Tone is a steady High Tone.

Number Checking Tone

High tone is sometimes used at DSA switchboards in No. 1 crossbar and some step-by-step areas to verify the verbal identification of the calling line.

Number Checking Tone is a steady High Tone. On some older systems, Number Checking Tone was a steady 135 Hz tone.

Coin Denomination Tones

These tones enable the operator to determine the amount deposited in coin telephones.

Coin Denomination Tones for the old 3 slot payphones were:

Nickel - One tap of 1050 Hz and 1100 Hz (bell)

Dime - Two taps of 1050 Hz and 1100 Hz (bell)

Quarter - One tap at 800 Hz (gong)

Coin Collect Tone

Low tone over a coin recording-completing trunk informs the originating toll operator that the local operator or coin control circuit has collected the charge.

Coin Collect Tone is a steady Low Tone.

Coin Return Tone

High tone over a coin recording-completing trunk informs the originating toll operator that the local operator or coin control circuit has returned the change when the connection is not completed (also called coin refund tone).

Coin Return Tone is a single .5 to 1 second burst of High Tone.

Coin Return (Test) Tone

High tone is used to tell an operator in a dial central office that a tester has completed a call to his/her position over a coin trunk.

Coin Return (Test) Tone is a single .5 to 1 second burst of High Tone.

Group Busy Tone

This audible signal is indicated by low tone on the sleeve of trunk jacks at cord switchboards. Absense of the tone tells the operator that there is at least one idle trunk in a group.

Group Busy Tone is a steady Low Tone.

Vacant Position Tone

Low tone is applied to all straightforward trunks terminating in a vacated position in manual offices.

Vacant Position Tone is a steady Low Tone.

Dial Off-Normal Tone

Low tone is returned to an operator after he/she has completed a call into a step-by-step office and after the calling party has answered to remind him/her to restore the dial key.

Dial Off-Normal Tone is a steady Low Tone.

Permanent Signal

A customer line, not in use, which exhibits a steady off-hook condition is routed to a permanent signal trunk. High tone, superimposed on battery, is supplied through a resistance lamp to the ring of the trunk. The tone is used to inform an operator or other employee making a verification test that the line is temporarily out of service. An intermittent ground may also be applied to the ring of the telephone systems left in the hold condition. Typical reasons for the line condition are:

  1. No dialing within the allowed waiting interval.
  2. A handset is off-hook.
  3. Low insulation resistance or other line trouble.

In some offices, if three or more digits are dialed but not a complete telephone number or code, the call is released and dial tone is returned.

Permanent Signal is a steady High Tone.

Warning Tone

High tone warns an operator that the circuit he/she is connected to is not in condition for normal operation. Examples:

  1. An operator at an Automatic Display Call Indicator position plugs in the wrong jack.
  2. An operator at a sender monitor position plugs into a sender supervisory jack while the sender is under test.

Warning Tone is a steady High Tone.

Trouble Tone

Low tone applied by an operator or test person at a B position in a manual office to the jack sleeve of a line or trunk in a calling multiple tells other operators the line or trunk is in trouble (also called plugging up codr tone).

Trouble Tone is a steady Low Tone.

Service Observing Tone

This tone indicated that the trunk to which it is applied is being service-observed.

Service Observing Tone is a steady 135 Hz.

Proceed to Send Tone (International Direct Distance Dialing)

This tone informs the operator that an overseas sender has been siezed and the address information (KP-CC-CC-ST) should be transmitted.

Proceed to Send Tone is a steady 480 Hz at -22 dBm0.

Centralized Intercept Bureau Order Tone

This tone tells the centralized intercept bureau operator that a call has reached the position.

Centralized Intercept Bureau Order Tone is a .5 second burst of 1850 Hz at -17 dBm0.

ONI Order Tone

This tone tells the ONI operator that a call has reached the position.

ONI Order Tone is 700 Hz and 1100 Hz at -25 dBm for .095 to .25 seconds.

D-28. What is the voltage used to ring a telephone?

According to AT&T, the ringing signal is an 88v 20Hz A.C. signal superimposed on 48v nominal D.C. supervisory voltage. However, the actual rining signal used can and does vary greatly from one location to another. The frequency of the AC signal is normally between 15 and 70Hz. The interval between ringing signals is normally four seconds.

D-29. What are all of the * (LASS) codes?

Local Area Signalling Services (LASS) and Custom Calling Feature Control Codes:

Service Tone Pulse/rotary Notes
Assistance/Police 12 n/a [1]
Cancel forwarding 30 n/a [C1]
Automatic Forwarding 31 n/a [C1]
Notify 32 n/a [C1] [2]
Intercom Ring 1 (..) 51 1151 [3]
Intercom Ring 2 (.._) 52 1152 [3]
Intercom Ring 3 (._.) 53 1153 [3]
Extension Hold 54 1154 [3]
Customer Originated Trace 57 1157  
Selective Call Rejection 60 1160 (or Call Screen)
Selective Distinct Alert 61 1161  
Selective Call Acceptance 62 1162  
Selective Call Forwarding 63 1163  
ICLID Activation 65 1165  
Call Return (outgoing) 66 1166  
Number Display Blocking 67 1167 [4]
Computer Access Restriction 68 1168  
Call Return (incoming) 69 1169  
Call Waiting disable 70 1170 [4]
No Answer Call Transfer 71 1171  
Usage Sensitive 3 way call 71 1171  
Call Forwarding: start 72 or 72# 1172  
Call Forwarding: cancel 73 or 73# 1173  
Speed Calling (8 numbers) 74 or 74# 1174  
Speed Calling (30 numbers) 75 or 75# 1175  
Anonymous Call Rejection 77 1177 [5] [M: *58]
Call Screen Disable 80 1180 (or Call Screen) [M: *50]
Selective Distinct Disable 81 1181 [M: *51]
Select. Acceptance Disable 82 1182 [4] [7]
Select. Forwarding Disable 83 1183 [M: *53]
ICLID Disable 85 1185  
Call Return (cancel out) 86 1186 [6] [M: *56]
Anon. Call Reject (cancel) 87 1187 [5] [M: *68]
Call Return (cancel in) 89 1189 [6] [M: *59]


[C1] - Means code used for Cellular One service
[1] - for cellular in Pittsburgh, PA A/C 412 in some areas
[2] - indicates that you are not local and maybe how to reach you
[3] - found in Pac Bell territory; Intercom ring causes a distinctive ring to be generated on the current line; Hold keeps a call connected until another extension is picked up
[4] - applied once before each call
[5] - A.C.R. blocks calls from those who blocked Caller ID (used in C&P territory, for instance)
[6] - cancels further return attempts
[7] - *82 (1182) has been mandated to be the nationwide code for "Send CLID info regardless of the default setting on this phone line."
[M: *xx] - alternate code used for MLVP (multi-line variety package) by Bellcore. It goes by different names in different RBOCs. In Bellsouth it is called Prestige.
It is an arrangement of ESSEX like features for single or small multiple line groups.

The reason for different codes for some features in MLVP is that call-pickup is *8 in MLVP so all *8x codes are reassigned *5x

These appear to be standard, but may be changed locally

Under GTE, some LASS/CLASS tones may be changed from *NN to NN#. Under pulse, GTD5 allows either NN<pause> or 11NN, but with 11NN it may conflict with a test number.

At one time these were called CLASS Codes, for Custom Local Area Signalling Services.

D-30. What frequencies do cordless phones operate on?

Here are the frequencies for the first generation 46/49mhz phones.

Channel Handset Transmit Base Transmit
1 49.670mhz 46.610mhz
2 49.845 46.630
3 49.860 46.670
4 49.770 46.710
5 49.875 46.730
6 49.830 46.770
7 49.890 46.830
8 49.930 46.870
9 49.990 46.930
10 49.970 46.970

Second generation 900Mhz cordless phones have been allocated the frequencies between 902-928MHz, with channel spacing between 30-100KHz.

Following are some examples of the frequencies used by example phones:

Panasonic KX-T9000 (60 Channels)
Base: 902.100 - 903.870
Handset: 926.100 - 927.870

Channel Base Handset Channel Base Handset Channel Base Handset
01 902.100 926.100 11 902.400 926.400 21 902.700 926.700
02 902.130 926.130 12 902.430 926.430 22 902.730 926.730
03 902.160 926.160 13 902.460 926.460 23 902.760 926.760
04 902.190 926.190 14 902.490 926.490 24 902.790 926.790
05 902.220 926.220 15 902.520 926.520 25 902.820 926.820
06 902.250 926.250 16 902.550 926.550 26 902.850 926.850
07 902.280 926.280 17 902.580 926.580 27 902.880 926.880
08 902.310 926.310 18 902.610 926.610 28 902.910 926.910
09 902.340 926.340 19 902.640 926.640 29 902.940 926.940
10 902.370 926.370 20 902.670 926.670 30 902.970 926.970
31 903.000 927.000 41 903.300 927.300 51 903.600 927.600
32 903.030 927.030 42 903.330 927.330 52 903.630 927.630
33 903.060 927.060 43 903.360 927.360 53 903.660 927.660
34 903.090 927.090 44 903.390 927.390 54 903.690 927.690
35 903.120 927.120 45 903.420 927.420 55 903.720 927.720
36 903.150 927.150 46 903.450 927.450 56 903.750 927.750
37 903.180 927.180 47 903.480 927.480 57 903.780 927.780
38 903.210 927.210 48 903.510 927.510 58 903.810 927.810
39 903.240 927.240 49 903.540 927.540 59 903.840 927.840
40 903.270 927.270 50 903.570 927.570 60 903.870 927.870

V-Tech Tropez DX900 (20 Channels)

Base: 905.6 - 907.5 (100Khz spacing)
Handset: 925.5 - 927.4

Channel Base Handset Channel Base Handset Channel Base Handset
01 905.600 925.500 08 906.300 926.200 15 907.000 926.900
02 905.700 925.600 09 906.400 926.300 16 907.100 927.000
03 905.800 925.700 10 906.500 926.400 17 907.200 927.100
04 905.900 925.800 11 906.600 926.500 18 907.300 927.200
05 906.000 925.900 12 906.700 926.600 19 907.400 927.300
06 906.100 926.000 13 906.800 926.700 20 907.500 927.400
07 906.200 926.100 14 906.900 926.800      

Other 900mhz cordless phones:

AT&T #9120 902.0 - 905.0 & 925.0 - 928.0 Mhz
Otron Corp. #CP-1000 902.1 - 903.9 & 926.1 - 927.9 Mhz
Samsung #SP-R912 903.0 & 927.0 Mhz

Third generation 2.4Ghz cordless phones have been allocated the frequencies between 2.4Ghz and 2.48Ghz, with channel spacing of 5Mhz.

D-31. What is Caller-ID?

This FAQ answer is stolen from Rockwell:

Calling Number Delivery (CND), better known as Caller ID, is a telephone service intended for residential and small business customers. It allows the called Customer Premises Equipment (CPE) to receive a calling party's directory number and the date and time of the call during the first 4 second silent interval in the ringing cycle.


The data signalling interface has the following characteristics:

Link Type: 2-wire, simplex
Transmission Scheme: Analog, phase-coherent FSK
Logical 1 (mark) 1200 +/- 12 Hz
Logical 0 (space) 2200 +/- 22 Hz
Transmission Rate: 1200 bps
Transmission Level: 13.5 +/- dBm into 900 ohm load


The protocol uses 8-bit data words (bytes), each bounded by a start bit and a stop bit. The CND message uses the Single Data Message format shown below.

Channel Carrier Message Message Data Checksum
Seizure Signal Type Length Word(s) Word
Signal   Word Word    

Channel Seizure Signal

The channel seizure is 30 continuous bytes of 55h (01010101) providing a detectable alternating function to the CPE (i.e. the modem data pump).

Carrier Signal

The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to condition the receiver for data.

Message Type Word

The message type word indicates the service and capability associated with the data message. The message type word for CND is 04h (00000100).

Message Length Word

The message length word specifies the total number of data words to follow.

Data Words

The data words are encoded in ASCII and represent the following information:

If the calling party's directory number is not available to the terminating central office, the data word field contains an ASCII "O". If the calling party invokes the privacy capability, the data word field contains an ASCII "P".

Checksum Word

The Checksum Word contains the twos complement of the modulo 256 sum of the other words in the data message (i.e., message type, message length, and data words). The receiving equipment may calculate the modulo 256 sum of the received words and add this sum to the received checksum word. A result of zero generally indicates that the message was correctly received. Message retransmission is not supported.

Example CND Single Data Message

An example of a received CND message, beginning with the message type word, follows:

04 12 30 39 33 30 31 32 32 34 36 30 39 35 35 35 31 32 31 32 51

04h Calling number delivery information code (message type word)
12h 18 decimal; Number of data words (date,time, and directory number words)
30,39 09; September
33,30 30; 30th day
31,32 12; 12:00 PM
32,34 24; 24 minutes (i.e., 12:24 PM)
36,30,39,35,35,35,31,32,31,32 (609) 555-1212; calling party's directory number

51h Checksum Word

Data Access Arrangement (DAA) Requirements

To receive CND information, the modem monitors the phone line between the first and second ring bursts without causing the DAA to go off hook in the conventional sense, which would inhibit the transmission of CND by the local central office. A simple modification to an existing DAA circuit easily accomplishes the task.

Modem Requirements

Although the data signalling interface parameters match those of a Bell 202 modem, the receiving CPE need not be a Bell 202 modem. A V.23 1200 bps modem receiver may be used to demodulate the Bell 202 signal. The ring indicate bit (RI) may be used on a modem to indicate when to monitor the phone line for CND information. After the RI bit sets, indicating the first ring burst, the host waits for the RI bit to reset. The host then configures the modem to monitor the phone line for CND information.


According to Bellcore specifications, CND signalling starts as early as 300 mS after the first ring burst and ends at least 475 mS before the second ring burst


Once CND information is received the user may process the information in a number of ways.

  1. The date, time, and calling party's directory number can be displayed.

  2. Using a look-up table, the calling party's directory number can be correlated with his or her name and the name displayed.

  3. CND information can also be used in additional ways such as for:

    1. Bulletin board applications
    2. Black-listing applications
    3. Keeping logs of system user calls, or
    4. Implementing a telemarketing data base


For more information on Calling Number Delivery (CND), refer to Bellcore publications TR-TSY-000030 and TR-TSY-000031.

To obtain Bellcore documents contact:

Bellcore Customer Service
60 New England Avenue, Room 1B252 Piscataway, NJ 08834-4196
(908) 699-5800

D-32. How do I block Caller-ID?

Always test as much as possible before relying on any method of blocking Caller-ID. Some of these methods work in some areas, but not in others.

  • Dial *67 before you dial the number. (141 in the United Kingdom)
  • Dial your local TelCo and have them add Caller-ID block to your line.
  • Dial the 0 Operator and have him or her place the call for you.
  • Dial the call using a pre-paid phone card.
  • Dial through Security Consultants at (900)PREVENT for U.S. calls ($1.99/minute) or (900)STONEWALL for international calls ($3.99/minute).
  • Dial from a pay phone. :-)

    D-33. How do I defeat Caller-ID blocking?

    Forward your phone line to a friend who lives in another LATA. When he receives the anonymous phone call, have him use *69 Call Return to dial to offending party back. As he is now placing a long distance phone call, the telephone number of the anonymous caller will show up on your friends phone bill at the end of the month.

    A variation of this system is available in areas where the local phone company offers per-call billing (as opposed to unlimited flat rate local calling) and where the local phone company issues itemized bills on those local phone calls. In those areas, you can switch your phone line to itemized local calling, *69 Call Return the anonymous telephone call, and read the anonymous callers telephone number at the end of the month.

    If you are particularly anxious, you can often request your toll records from your local telephone company without waiting for your final bill.

    D-34. What is a PBX?

    A PBX (Private Branch Exchange) is a small telephone switch owned by a company or organization. These organizations purchase PBX's to reduce the total number of telephone lines they need to lease from the telephone company. Without a PBX, a company will need to lease one telephone line for every employee with a telephone.

    With a PBX, every employees telephone line is wired to the PBX. When an employee takes the receiver off hook (i.e. picks up the telephone) and dials the outside access code (usually 9), the PBX connect the employee to an outside line (often, though somewhat incorrectly, referred to as a trunk). With a PBX, the company only needs to lease as many lines from the telephone company as the maximum number of employees that will be making outside calls at one time. This is usually around 10% of the number of extensions.

    Two common PBX systems are AT&T's Definity series (also known as the System 75 and Sytem 85) and Northern Telecom's Meridian series. Other manufacturers include ROLM, Siemens, NEC, and Mitel.

    D-35. What is a VMB?

    A VMB (Voice Mail Box) is a computer that acts as an answering machine for hundreds or thousands of users. Each user will have their own Voice Mail Box on the system. Each mail box will have a box number and a pass code.

    Without a passcode, you will usually be able to leave messages to users on the VMB system. With a passcode, you can read messages and administer a mailbox. Often, mailboxes will exist that were created by default or are no longer used. These mailboxes may be taken over by guessing their passcode. Often the passcode will be the mailbox number or a common number such as 1234.

    Two common VMB systems are AT&T's Audix system and Northern Telecom's Meridian Mail.

    D-36. What are the ABCD tones for?

    The ABCD tones are simply additional DTFM tones that may be used in any way the standard (0-9) tones are used. The ABCD tones are used in the U.S. military telephone network (AutoVon), in some Automatic Call Distributor (ACD) systems, for control messages in some PBX systems, and in some amateur radio auto-patches.

    In the AutoVon network, special telephones are equipped with ABCD keys. The ABCD keys are defined as such:

    A - Flash B - Flash override priority C - Priority communication D - Priority override

    Using a built-in maintenance mode of the Automatic Call Distributor (ACD) systems once used by Directory Assistance operators, you could connect two callers together.

    The purpose of the Silver Box is to create the ABCD tones.

    See also "What are the DTMF Frequencies?"

    D-37. What are the International Direct Numbers?

    The numbers are used so that you may connect to an operator from a foreign telephone network, without incurring long distance charges. These numbers may be useful in blue boxing, as many countries still have older switching equipment in use.

    Australia (800)682-2878
    Austria (800)624-0043
    Belgium (800)472-0032
    Belize (800)235-1154
    Bermuda (800)232-2067
    Brazil (800)344-1055
    British VI (800)278-6585
    Cayman (800)852-3653
    Chile (800)552-0056
    China (Shanghai) (800)532-4462
    Costa Rica (800)252-5114
    Denmark (800)762-0045
    El Salvador (800)422-2425
    Finland (800)232-0358
    France (800)537-2623
    Germany (800)292-0049
    Greece (800)443-5527
    Guam (800)367-4826
    HK (800)992-2323
    Hungary (800)352-9469
    Indonesia (800)242-4757
    Ireland (800)562-6262
    Italy (800)543-7662
    Japan (800)543-0051
    Korea (800)822-8256
    Macau (800)622-2821
    Malaysia (800)772-7369
    Netherlands (800)432-0031
    Norway (800)292-0047
    New Zealand (800)248-0064
    Panama (800)872-6106
    Portugal (800)822-2776
    Philippines (800)336-7445
    Singapore (800)822-6588
    Spain (800)247-7246
    Sweden (800)345-0046
    Taiwan (800)626-0979
    Thailand (800)342-0066
    Turkey (800)828-2646
    UK (800)445-5667
    Uruguay (800)245-8411
    Yugoslavia (800)367-9842 (Belgrade)
    367-9841 (Zagreb)
    USA from outside (800)874-4000 Ext. 107

    D-38. What are some telephone switches?

    1AES AT&T Analog No. 1A ESS
    1ES AT&T Analog No. 1 ESS
    2BES AT&T Analog No. 2B ESS
    2ES AT&T Analog No. 2 ESS
    3ES AT&T Analog No. 3 ESS
    3XB AT&T E/M No. 3 Cross-Bar
    4ES AT&T Digital No. 4 ESS
    5AXB AT&T E/M No. 5A Cross-Bar
    5ES AT&T Digital No. 5 ESS
    5ORM AT&T Digital Optical Remote Module
    5RSM AT&T Digital Remote Switching Module
    5XB AT&T E/M No. 5 Cross-Bar
    AXE10 Ericsson Digital Stand Alone or Host
    AXRSS Ericsson Digital Remote
    DGTL   Digital Generic Digital Switch
    DMS1/200 NTI Digital DMS 100/200
    DMS10 NTI Digital DMS 10
    DMS100 NTI Digital DMS 100
    DMS200 NTI Digital DMS 200
    DPN NTI Packet Packet Switch
    EDX Siemens Packet Packet Switch
    NC23 NEC E/M NEC Cross-Bar
    NEAX61E NEC Digital NEC switch
    RLCM NTI Digital Remote Line Conc Module
    RLCM-10 NTI Digital Remote Line Conc Module
    RLM NTI Digital Remote Line Module
    RSC NTI Digital Remote Switching Center
    RSLE NTI Digital Remote Subscr Line Equip
    RSM AT&T Digital Remote Switching System
    RSS AT&T Analog Remote Switching System
    RSU   Digital Generic Remote Switching Unit
    SXS AT&T E/M Step by Step

    #hack FAQ Home | Computers | Data Networks | Wireless Networks | Telephony | Mobile Telephony
    Radio | Television | Resources | 2600 | Smart Cards and Magnetic Cards | Miscellaneous