The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / lod5_08.txt < prev next >

Wrap

Text File | 2003-06-11 | 28.9 KB | 706 lines

The LOD Technical Journal: File #8 of 12 International Switching Systems by Mystik Freak LOD - LOD One of the goals behind phreaking has always been to delve into the deepest fathoms of the phone system. Since the barriers of expensive international calling are meaningless to the phreak, the exploration of various telephone systems is possible. This file will investigate some of the switching systems you are likely to encounter around the world. In other words non-ESS/DMS using nations outside the United States. Nothing has ever been said about these systems in "the underground" and what little information that exists publicly is skimpy, hard to find, badly translated or not translated at all and very outdated. The foundation of any telephone network is in its switching system so a whole new universe of different switching systems is out there waiting for you. ESS does get boring after a while and there is nothing really novel about if, after all nearly everyone lives under it and there isn't that much to discover about it. So branch out internationally to seek new telephone networks and boldly go where no phreak has gone before! I won't spoil the thrill of hearing new tones and discovering new things by giving out all the juicy things you're liable to find, instead this is going to be a broad based overview of 7 switching systems: Sweden - AXE 10 France - E 12 United Kingdom - DSS Netherlands - PRX-D Germany - EWS-D Italy - PROETEO Japan - NEAX 61 There are far more than just these systems out there as shown by this chart of systems indicates: System Country Type ~~~~~~ ~~~~~~~ ~~~~ AFDT1 Italy local/tandem AXE 10 Sweden local/toll D 1210 US local DCO US local/toll DMS 10 Canada/US local DMS 100 Canada/US local/toll DMS 200 Canada/US toll DMS 250 US tandem DMS 300 Canada tandem DS 1 Japan tandem DSC US local DSS 1210 US local/toll/operator DTN 1 Italy (Sudan) tandem DTS US tandem DTS 1 Japan toll DTS 2 Japan local DTS 500 Netherlands tandem DX 100 Finland local/tandem DX 200 Finland local EWS-D Germany local/toll E10 France local/tandem E10 B France local E10 S France local E12 France toll FETEX 150 Japan local FOCUS 5 US local GTD 5 EAX US local/toll HDX 10 Japan local IFS Switzerland local ITS 4/IMA2 US toll ITS 4/5 US local/toll ITS 5A US local I2000 Yugoslavia local LCS 4/5 US local MSU US local MT 20/25/35 France local/toll NEAX 61 Japan/US local/toll/operator No. 3 EAX US toll No. 4 ESS US toll No. 5 ESS US local PROTEO Italy local/toll PRX-D Netherlands local/toll SPC 2 India local SX8 France local SX 2000 Canada local SYSTEM 12 (1210) US local/toll/operator SYSTEM 12 (1240) Belgium/UK/Germany local TDDSS 1/2 China tandem TN 5 Italy tandem TROPICO Brazil local TSS 5 US local UT 10/3 Italy local UXD 5 UK local 1220/PCM-5 Belgium/France tandem Sweden - AXE-10 (+46) ~~~~~~~~~~~~~~~~ The Swedish AXE 10, was developed by Ericsson and in addition to being found in Sweden itself is also being used by over 30 countries. AXE 10 performs most of the basic functions of international switching, local tandems and offices, national transit etc. It covers everywhere from isolated rural areas with only a few hundred subscribers all the way up to huge transit exchanges of a million subscribers. AXE 10 has 3 main susbsystems: SSS - Subscriber and group (GSS) switching TSS - Trunk signalling and (TCS) traffic control CHS - Charging, OMS and Maintenance Other optional subsystems are: SUS - Subscriber faciltites (OPS) operator functions MTS - Mobile subscriber functions Functions that share the same purpose are allotted to one subsystem. A function block is a group of similar functions within the subsystem. For example the subsystem SSS has a function block called the time switch (TS). Hardware AXE 10 is a digital switching system. Interconnections between subsystems are called "internal digital trunks". To give an example of AXE 10's hardware consider the SSS subsystem. SSS is divided up into lots containing up to 2048 subscribers, up to 128 of these subscribers will then form a line switch module (LSM). Each subscriber has an individual line circuit (LIC) connecting them to the LSM. The LSMs themselves are interconnected by a TS bus (TSB). Each module has a TS that performs switching for the subscriber the TSB and a junctor terminal circuit (JTC). Traffic within subsystems is handled by internal diagnostic links. If the LSM lacks an internal digital link the call is carried by a TSB to another module. Because SSS uses TSS and TSBs the network runs smoothly as a balance is kept between the subscriber nodes and the internal digital links in use. Subscriber information can be kept either centrally or remotely. TS 16 in a PCM is used to control a remote exchange. If the SSS is remotely located an exchange terminal circuit (ETC) is used. The PCM will then signal between the remote SSS and the ETC. The signalling is controlled by a signalling terminal (ST) on the SSS and ETC ends of the circuit. The trunk signalling system (TSS) interfaces external signals into the AXE 10 signalling scheme. One of the benefits to AXE is that any signalling scheme can be interfaced without impacting on other subsystems. Thus AXE is highly adaptable to network conditions. In cases where analogue lines are connected by either incoming trunk (IT) and outgoing trunk (OT) circuits conversion to digital takes place. Tone signalling is conducted by code receivers (CRD) or code senders (CSD). France - E 12 (+47) ~~~~~~~~~~~~~ CIT-Alcatel and Telic (CIT-ALCATEL) developed the E 12 system bases on the earlier E 10 system to handle the functions of: - international gateway - inter-city transit - medium to large urban area transit - subscriber line switching Capacity The capacity of E 12 depends on call duration, signalling etc. The maximum capacity is currently 1536 digital PCM systems of the 30 + 2 type equalling over 40,000 circuits. Processing up to 110 calls a second. Architecture E 12 is based on the architecture of its predecessor - E 10B. The three main components are: - subscriber and circuit connection units - the central switching system and common control - computerized supervisory and maintenance centre (CTI) The CTI is the second control level supervises several exchanges and handles: - line circuit management - traffic load data logging - maintenance and alarms - billing Three subassemblies allow speech transmission. The TST switching network, the subscriber connection units (URA) and the circuit connection units (URM). System Control Is made up of three levels: - a processing level in the line and circuit connection units, where subscriber circuits are controlled - central common switching control - CTI First Level Control Is conducted by: - 2 markers (MQ) - 2 translators (TR) - 2 incurred fee metering units (TX) - 2-6 multiregisters All of these units are related to a single switch and communicate on a bus LM. MQ - interfaces common control to the central switch and subscriber and circuit connection units MR - receives and retransmits information and adjudicates the opening and closing of connections. TR - stores subscriber and circuit data TX - free metering units OC - control interface unit connects the CTI to other subassemblies. Subscriber Connection Unit Because traffic is concentrated on a small number of digital PCM systems, the subscriber connection unit is needed to provide analog to digital conversation. It also handles remote subscribers. The unit connects thousands of lines to a central TS on PCM channels. Software switching programs - perform loop status sensing, condition detection, connection and disconnection, switch identification. maintenance subscriber status memories etc. monitoring programs - monitor the core of CSE, test and fault tracing routines etc. All programs are written in Assembly. Functions E 12 provides: - CCS7 - traffic observation - automatic fault tracing - remote fault tracing - service grade measurement - operator assistance position - automatic call back etc. Organization E 12 is organized into three areas: - the switching network which handles signalling channels and incoming/outgoing multiplexes - the signalling units which handle channel allocation, CMF, CCS, DTF etc. - a main SPC computer All of which are connected to connection units (see the subscriber connection unit). Programs The main programs used are: - program execution system, interfaces with the rest of the systems program - exchange interface IOP (SEST) - data interface IOP (SESI) - signalling processor (SIG) - common programs (PCO) for data - call processor (TAP) Service Management Unit (GES) does man/machine transactions, routing tables and prefixes, signalling type allocations, traffic observation and logs traffic data. Fault Recovery System (DEF) will reconfigure after a detection of a system failure, providing efficient recovery. Tracing and fault isolation (TED) will isolate a fault down to the PCB level and carry out CRCs for fault prevention. Digital Switching Subsystem (DSS) - United Kingdom (+44) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ DSS was created by the British Post Office (BPO) to serve as the nations first digital switch. Subsystems DSS uses specific hardware and software functions to interface subsystems. The main DSS interfaces are located at the following subsystems: - call processing system (CPS) - maintenance control subsystem (MCS) - analogue line termination system (ALTS) - network synchronization system (NSS) - management statistics subsystem (MSS) The main connecting interface in DSS is a 2048 kbit/s, 32 channel multiplex. Which is used for example to connect the switchblock and auxiliary units. Trunking DSS is capable of handling international switching centres of up to 20,000 erlangs and over 400 switch requests a second. To meet this the switch must be multistage. The DSS switchblock has identical originating and terminating circuits. A four-wire multiplex has a transit and receive pair on both ends of the circuit. So information on the busy/free state of both is available from one. To achieve spatial routing which is necessary for two channels to be connected, DSS uses integrated circuit multiplexers (encoders). DSS's time dividing in trunking allows single switches to carry large amounts of traffic. The drawback to this is that should a fault occur on this switch, thousands of calls could be disrupted. To ease this risk, synchronous duplication of the TST setup with data comparison and parity checking is done. Subsystem Functions - digital line termination unit (DLT) interfaces the four-wire, 32 time-slot 2048 kbit/s multiplexers with the switchblock - the TS transfers input time slots to output times slots - space switch (SS) is an integrated circuit set for devices that connect links with the trunk - alarm monitor unit (AMU) - relieves the main cpu's load by handling alarm data - primary waveform generator (PWFG) is the clock with DSS is based on. By sending 8 Khz tone start signals and 2048 Khz bit streams, operations are directed - local synchronization utility (LSU) uses incoming PCM links for timing and maintains the frequency of its oscillators using phase locked loop techniques - input/output buffer (IOB) stores messages from the software to the CLU The Time Switch Buffers the time reception with the time allocated from cross-office switching with the space switch and the actual time of transmission. It also does alarm interfacing between monitoring equipment and trunking. The TS is composed of: - speech stores (including DLT interfaces and store refining registers) - control stores - alarm interface unit (AIU) (including DLT and AMU interfaces) - TS racks - a complete send and receive switch within DSS. The two TSs are used in trunking are in 1 rack with 32 DLT units. - space switch - a set of buffer and crosspoint units. Using the 2048 Khz clock, the transmission of traffic is done on the TS interface buffer. Hardware The processor utility (PU) IOB is interfaced with the CCU by the PSS IOB. The IOB communicates with the following: - command field - ordering operations such as measure, trace, opening or the removing of TSs. - address fields - set network termination numbers (NTNs) that define TSs, circuits etc. - message identity field - cross office slot field - makes sure that traces don't duplicate their efforts by setting the points to start from during fault location. AMU AMU handles DSS's specific functions such as the collection and persistence checking of status info and diagnostic hardware. AMU interfaces to the PU and thus advises the DSS maintenance software on fault areas. AMU receives time and fault switchblock indicators from DLT using AIU in the TS. Persistence checks are done to label the alarm as hard or transient. DLT DLT conducts the line associated functions of monitoring, installation etc. DLT also performs switch-related operations. Several are for simple backup duplications of such functions as trunking and switch fault detections. DLT Related Functions The line processor encodes or decodes HDB3 signals and recovers the received clock. The clock is recovered by using a ringing circuit. The clock synchronizes the switching centre by providing a network frequency reference. DLT will identify remote alarm information if the distant alarm bit (usually bit 3 in channel 0 of odd frames) shows a problem. DSS will, using AMU instruct MCS to locate the fault. An alarm indications signal (AIS) shows a transmission equipment failure by tossing out a load of "1s" in the frame. Line errors can be detected locally if HDB3 input goes or if synchronization is off. If this occurs MCS is informed and DSS transmits a distant alarm unit signal. Switch-related DLT functions are usually involved in duplicated trunking, fault location or switching channel 0 spare-bits. The most interesting function is fault location. DLT works with maintenance software to locate and diagnose switchblock faults. By using path checks or loop backs, results are sent via AIU to DLT. Paths are tested using check patterns at both ends of a trunk. They can be sent in and monitored on any channel after switching. Registers are used to store the check patterns and they are controlled by the "central office". Or the DLT will "loop back" its transmit channels to the receive input of trunking. Loop back is sometimes combined with a path check. By changing the switch connections a closed loop can be implemented throughout the trunk. Closed loops are very effective in determining hard faults from transient ones. Netherlands - PRX-D (+31) ~~~~~~~~~~~~~~~~~~~ The Processor Controlled Exchange-Digital (PRX-D) builds upon the PRX system with digital-time division multiplexing (TDM) and with other enhancements. PRX-D was developed by Philips Telecommunication as an intelligent SPC system. The three main areas of PRXs are: - the switching network (SWN) - central control complex (CCC) - operator services (OPS) Two different versions of trunk lines are used. An analog version - PRX-A has six linked stages and reed-relay crosspoints of two or four wires or a digital version of the TST type. Local or remote usage is possible by sending traffic to the trunks. The CCC has two types of telecom processors (TCP) to deal with different size exchanges. TCP 18 covers small-medium exchanges and TCP 36 medium-large exchanges using multiprocessing with synchronized pairs. OPS is controlled by a mini-processor called TCP 7. OPS deals with OA&M and AMA. Architecture PRX-D is made of two layers: - the main layer with the CCC, TCP XX and the control channel processor terminals (CPT), connecting this layer to the control channel (CCH) - another layer of SWN modules and the sub-channel controller (SCC) The digital switching network (DSWN) passes voice and data traffic on 64 kbit/s, 32 channel PCMs. The PSWN has block terminals (TER) which interface to other circuits and allow services and signals to be interconnected by a digital trunk link network (DTN). DTN DTN is a one-way only transmission on a 4 wire connection. The highway-to- group (HGD) and group-to-highway multiplexer (GHM) are 16 inlet ports in 4 X 4 groups. A highway switch (HWS) is a group of up to 128 X 128 highways whose crosspoints can switch from one highway to the next under the control of a highway switch address generator (HSA). A highway-to-group demultiplexer (HGD) does the opposite of the GHM. A digital trunk-line block (DTB) carries a single highway and is controlled by a DTB marker (DTM). DTN utilizes 7 varieties of customized low current- mode logic (CCL) ICs. CCL The central clock (CCL) is made up of the synchronized mode clock generators (CLG), the clock measuring unit (CMU) and sometimes a clock reference unit (CRU). The DTN is sent timing information on 4096 Khz sine waves and 8 Khz alignment pulses. Terminals The 4 main TERs are: - interfacing analog circuits (ACT) - subscriber lines - digital circuits (DLT) - signalling and services (SST) - ACT has a peripheral module controller (AMC), a power supply unit (PSU) and possibly a DTN interface board (DIB). The DIB performs the transmission of timing signals and assigns time slots. - SST handles 2048 kbit/s groups by using DTN for signalling ie. MFC, keytones etc. for services such as voice response systems. Software The operational program for TCP 18 is made up of: - master control program (MCP) - call processing - error management - configuration management The MCP handles the central control unit (CCU), I/O operations and other misc. services. Communication between the main control unit (MCU) and the PMC is done by transport handlers such as the digital trunk marker (DTM), analog circuit terminal (ACT), digital circuit terminal (DCT) and the signalling and service terminal (SST). Call Handling One part of the Telephony Operating System (TOS) is call processing modules. Which distribute calls to an open CCU depending on network conditions. If a secondary control unit (SCU) is available it will receive the calls. If niether is available then the MCU will receive them. Error Maintenance Error detecting hardware does diagnostics such as checking parity, comparing timeout circuits etc. By using hardware to perform tests, checking is done every time the hardware runs and processing time needn't be wasted running testprograms. When the hardware equipment itself needs testing, testprograms are then used. Germany - EWS-D (+49) ~~~~~~~~~~~~~~~ Manufactured by Siemens Telecom, EWS-D is a complete digital switching system, capable of serving from 200 lines to 60,000 trunks. Architecture Subscriber line terminations and interchange trunks are used with trunk/line groups (LTGs) where digital tone generators and digit receivers are located. A TS performs connections inside of the LTG. Digital switching connects the groups to a central processor (CP). Functions carried out by the CP include overall switching, data storage and remote operation of the system. Here's a quick example of how a call would be processed under EWS-D: - the group processor (GP) sense that the phone is off-hook and gives the caller a tone generator and a digit receiver on the LTG using the group switch (GS). - the GP sends the service requested and the dialled digits to the CP. - CP checks the callers COS, locates a path and informs GP of the caller - the callee's GP finishes the connection with its LTG, sends a ringing and places the callee off-hook. LTG Signals from an analog subscriber's line are converted into PCM signals on the line circuit. Up to four interexchange trunk terminations comprise one module. Four modules make up one highway and up to 128 interexchange trunks can be on one LTG. A basic subscriber line circuit interfaces with any signalling system. Notable functions of the subscriber line circuit are the 50/16 kHz call charge meters on the subscriber's premises, access circuitry for testing and paystation signalling. The PCM 30 transmission system has its synchronization, signalling channel and alarm signal on one module. 2.048 Mbit/s highways are connected to the GS. For a connection to the central network, 4 2.048's become one 8.192 Mbit/s signal. Because the network is duplicated, the identical modules can easily be used for testing. Tones such as MFC frequencies are generated digitally on a LTG and sent to the GS. One change here can effect the entire network. Central Switching Network By using a central switching network up to 504 trunk groups, equivalent to 100,000 subscriber lines or 604 trunks can be attained. 8.192 Mbit/s interfaces are used between the network and the LTG. As mentioned before the entire network is duplicated. In case of a fault, the network will switch over to its other half. Control and Common Signalling Channels Control channels are grouped into units of 128 for distribution on the 8.192 Mbit/s network. The channels in time lot 0 are switched to the LTG only on transmission links. Only half - 64 of 128 control channels are used. The other half are for future uses. With SS7 the procedure for switching signalling channels though the LTG is identical to that of the control channels. OA&M Digital systems such as this have far fewer errors than analog SPC systems do due to the smaller number of modules. EWS-D is expected to have fewer than 12 hardware faults per 1000 LTGs with less than 2 hours per fault. Both hardware and test programs are used to diagnose both subscriber line and trunk faults. When testing is done on long distance trunks the equipment on the distant exchange and on the transmission system is done. Measuring equipment such as ATME2 look at the director and responder operations. Most local trunks are still copper and EWSD has contacts on the incoming and outgoing circuits for testing. The monitoring of PCM transmission links is integrated into EWS-D. System status is given by an operating terminal indicating system traffic, the failure/active status of redundant central units, LTGs and equipment inside LTGs, the number of removed from active LTGs, subscriber lines and the number of non-switchable call requests. Remote operations can be done via this terminal. Administration tasks are also performed at the operating terminal. When a remote operator is needed, communication equipment such as Transdata is used to connect to the exchanges over the data transmission channel. Italy - PROTEO (+39) ~~~~~~~~~~~~~~ PROTEO was designed by Societa Italiana Telecomunicazioni SpA (SITS). Architecture It is a fully integrated, digital switching system with SPC. Signals are converted from analog to digital and transmitted over a PCM. Capacity is 30,000 subscribers in 32 peripheral exchanges (CTs) hooked up to a transit network (RT) using 32, 2 channel PCMs. Overall control is by a central computer (CC). A lone CT can handle 2,304 subscriber lines with 18 PCMs, 270 LF trunks and possess 2 line control units (UCL) on a connecting network (RC). Subscribers and trunks are connected through a time division multiplex (TDM) and can go directly to PAM without the analog to digital conversion using voice scanners if need be. The CT, can act as a switch if internal subscribers are being switched to RTs. CT is commonly connected to the RT for interconnections with external switches. The CT has a codecom unit to convert analog to digital or digital to analog for PCM bundle generation or insertion into PAM. A TST connection network is inside the RT and is controlled by the CC using the transit control unit (UCT). The RC switches 64 kbit/s data channels on 2 Mbit/s PCM bundles towards UCS when exchange signalling exists and to UCM when remote signalling comes in on a common channel. If CCS isn't present, then signalling control units (UCS) are used to process signalling codes. Maintenance CC uses LEONE processors in SPC for maintenance and has a BHCA capacity of 150,000. PROTEO handles rural areas quite well as CTs can be located at great distances from the RT. If less than 250 subscribers exist, concentrators will be used to connect them to a CT. Flexibility The modularity of PROTEO is its ability to adapt to different network conditions. By having functions act independently of others, upgrades and maintenance is simplified. Japan - NEAX 61 (+81) ~~~~~~~~~~~~~~~ The NEAX 61 was designed by Nippon Electric Co. and was first installed in the US. But due to its origin it is being included as a Japanese system. It has SPC, PCM TDM and uses a four stage TSST switching network. Specifications circuit capacity: local switching - 100,000 lines, 13,000 trunks toll switching - 60,000 trunks international switching - 30,000 international circuits network capacity - 22,000 erlangs call handling capacity - 700,000 BHCA Architecture NEAX 61 is comprised of 4 subsystems: - application subsystem - several service interface modules each having line and trunk circuits, interface circuits, multiplexers and a controller. This subsystem gives a standard interface to the other subsystems. It controls the terminal circuits and interfaces them with the switching subsystem. Service modules receive information from the processor to establish paths and other actions. Each service module has a terminal and interface circuit, a duplicated controller and primary multiplexer (PMUX) and demultiplexer. The controllers collect terminal circuit scanning data, control the terminal and interface circuits and communicate with the processor. The modules each have their own terminal and interface circuits: - analog trunk interface module - Both the terminal and interface circuits are codecs. Any analog trunk can be used by the module and each trunk has its own codec channel. - analog line interface module - The terminal circuit is an analog line circuit that conducts two to four wire conversion, ringing application, protects against overvoltage and other testing procedures. By using one of four switch selectable balancing networks an insertion loss less than 0.5 dB is possible. - digital line interface module - Connects PCM analog and digital subscriber carrier lines. The interface circuit is a digital line switch that concentrates digital lines by assigning time slots and putting each time slot on a serial bit stream to the PMUX. - operator position interface module - connects the different operator positions such as toll and directory assistance. Operators converse with callers over position trunk circuits. The controller has a capacity of up to 64 operator positions and the PMUX can have up to 120 operators on a position trunk. - processor subsystem - Maintenance and Administration subsystem - Alarm information is shown on the maintenance frame or at a supervisory test desk. The line test desk platforms subscriber line testing. NEC has a technical assistance center where NEC personnel provide support on a subscription basis. --------------------------------------------------------------------------- Sources Various IEEE Documents Helpful International Operators ---------------------------------------------------------------------------