TAP YIPL

home *** CD-ROM | disk | FTP | other *** search

/ TAP YIPL / TAP_and_YIPL_Collection_CD.iso / PHREAK / SYSINFO / ANALSS.TXT < prev next >

Wrap

Text File | 1998-07-04 | 10.3 KB | 258 lines

Analogue Signalling Systems - An overview by NeonDreamer ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Why only analogue? Why not digital? Well let me tell you now, the number of phreaks who know more than '.' about digital signalling over ISDN lines is next to nothing. I don't know much myself, let alone how to exploit it, so I'll restrict my ramblings to what can realistically be played with. Firstly a note on naming conventions. Most of us are used to dealing with American texts, and we are used to signalling systems be referred to in terms of their CCITT code. The UK has their own codes SSAC and SSMF for describing signalling. For ease of use I'll stick to what we are familiar with - CCITT conventions. If you need to know the equivalent UK code refer to the table below. CCITT UK 4 SSAC4 5 SSAC10/SSMF1 Non CCITT standards will be referred to in the UK style. OK, before the good days of auto switching and subscriber trunk dialling (STD) all trunk switching was performed by operators on Strowger or related equipment. Inter-exchange signalling was performed by the operators. Obviously an automatic network needs to perform a number of functions. 1) It needs to signal the exchange to connect caller A to recipient B 2) It needs to supervise the call 3) It needs to give caller A feedback (ringing tone / engaged tone) 4) It needs to bill the call Signalling data can be transmitted as pulse breaks, tones or binary. The following methods are still used today: 1) Level and direction of current (in 2 wire DC systems) 2) Pulse duration (DC) 3) Pulse combination (DC) 4) AC signal frequency 5) Frequency combination 6) Binary Signalling across local lines has evolved from two-wire DC systems - except ringing current and standard tones. Tones were initially produced electromechanically as follows: Ringing tone 133Hz interrupted Engaged tone 400Hz interrupted Out of order 400Hz continuous Ringing current 17Hz ( @ 75V ) Probably what we are all familiar with in the first instance is called loop disconnect calling. Anyone who ever used a rotary fone as a kid (and even on crappy payfones now) will remember the 'click click click' that signalled the numbers to the exchange. Remember when you first sussed that the number of clicks indicated the number you had dialled? Remember when you found out that by tapping the handset rest you could dial a number without using the dial? Did you ever wonder how it worked? For the sake of completeness - here is the answer. When a fone is off the hook, it allows DC current to flow through it. When you dial, you interrupt this DC current at 10 pulses / second (3 pulses for a 3, 10 for a 0 etc.) - hence the term loop disconnect calling - you dial by momentarily disrupting a DC current flow, only flowing off hook. When your call is answered the recipients exchange reverses the direction of current flow. Correct dialling using this method is achieved by disrupting the DC current for 66.7 ms with 33 ms between pulses indicating the same number, and a >400ms of DC flow between pulses indicating a different number. DC signalling is limited distance wise due to the resistance in copper wires. Consequently due to the relatively high power requirements other signalling systems have been developed. DTMF dialling and electronic exchanges give a greater signalling speed. The DTMF frequencies used are listed below : Digit Frequencies (Hz) ~~~~~ ~~~~~~~~~~~~~~~~ 1 697 1209 2 697 1336 3 697 1477 4 770 1209 5 770 1336 6 770 1477 7 852 1209 8 852 1336 9 852 1477 * 941 1209 0 941 1336 # 941 1447 In payfone systems the call charging signal is a 50 Hz common mode or longitudinal voltage in which both wires of a two wire pair are driven in phase. Blimey, we're only just on to analogue signalling. Hang on and bear with me.... Between network switching centres parallel signalling is used in the form of AC signals which may be single frequency (1VF), dual voice frequency (2VF) or multifrequency (MVF). The system has evolved from SSAC9 (1VF) in the 1950's the identically featured, but transistorised 1980's version. Part of the adaptation has been from 2-wire (metallic pair) to a 4-wire system. SSAC9 uses the 'magic' 2280Hz signal frequency. This was exploited by phreakers in the good old days and it is nothing more than a historical curiosity now... Multifrequency signalling is now the standard. In our system an out of band signal of 3825Hz is used for supervisory purposes - and enables continuous supervision. This is due to a CCITT recommendation (Q351) and is referred to as R2 signalling. This is the system of signalling that '3l33t3' phreaks have taken to playing with... So here are the signals used : | ______Direction______ Condition of circuit | Forward Return --------------------------------------------------- Idle | Tone on Tone on Seized | off on Answered | off off Clear back | off on Released | on on or off Blocked | on off CCITT4 is an end 2 end signalling system using 2VF and two tones : 2040Hz (from now on read 'x' [binary 0]) and 2400Hz (from now on read 'y' [binary 1]). It is used for line signalling and interregister signalling (with serial transmission in binary). Consequently a 4 element code in binary gives 16 characters. 10 of these are for digits and four are supervisory. These are given below... 1 2 3 4 1 y y y x 2 y y x y 3 y y x x 4 y x y y 5 y x y x 6 y x x y 7 y x x x 8 x y y y 9 x y y x 0 x y x y Call operator code 11 x y x x Call operator code 12 x x y y Spare code x x y x Incom. half echo sup. reqd. x x x y End of pulsing x x x x Spare y y y y OK - now each line signal is prefixed with a signal called 'P' followed by a control element ( x or y ). The prefix is a combination of both frequencies and the control element plays its constituent tones consecutively with the durations as follows : P = 150 +- 30ms (2040Hz/2400Hz) x and y = 100 +- 20ms There are more supervisory signals too which use X and Y which are 350ms +- 70ms. So signalling in the forward direction we have : Terminal seizing PX Transit seizing PY Digits Shown in above table (are you paying *no* attention?) Clear forward PXX Forward transfer PYY and in the backward direction we have : Proceed to send X International transit Y Engaged PX Answer PY Acknowledge P Phew (that's all for CCITT4). To find better explanations of the operator codes finish reading the next section (CCITT5) and then go and get some deeper articles on signalling (2600 have an excellent CCITT5 article - I'll Xerox a copy for anyone who is interested). CCITT5 is the system most abused by phreaks. This system is generally abused over international 'country direct' lines. 0800 numbers connecting you to a foreign operator - which gives you the chance to break their trunk, seize their line and control their system (yeah!). The definitive guide to BlueBoxing CCITT5 is on my (growing) list of projects, I have read the rest and will write the best both technically and practically ;-) CCITT5 is a 2VF system using 2400Hz / 2600Hz for line signalling on a link by link basis. Interregister signalling is 2MF (2 out of 6 frequency type). The 6 frequencies are spaced 200Hz apart from 700Hz to 1700Hz. In the USA a similar, but not identical, system is used (R-1). The CCITT5 code is : Digit Frequencies 1 700Hz 900Hz 2 700 1100 3 900 1100 4 700 1300 5 900 1300 6 1100 1300 7 700 1500 8 900 1500 9 1100 1500 0 1300 1500 The supervisory tones (ie the useful ones!) are: Prefix digit sequence 1100Hz 1700Hz End of digit sequence 1500 1700 Operator code 11 700 1700 Operator code 12 900 1700 700 1100 Payfone coin control 1100 1700 700 1700 Final point - there is a modified CCITT5 system floating around which uses a 2 out of 6 MF signal, but has two different sets of frequencies for forward and return signalling. The tones are spaced at 120Hz from 540Hz to 1980Hz. NeonDreamer '95 (just)