The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / lodhtj03.002 < prev next >

Wrap

Text File | 2003-06-11 | 20.5 KB | 377 lines

The LOD/H Technical Journal, Issue #3: File 02 of 11 $LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$ L L O AUTOMATIC MESSAGE ACCOUNTING O D D $ (AMA) $ L L O An overview O D D $ Written by Phantom Phreaker $ L L O Legion Of Doom! O D D $LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$LOD$ <part one of two> This article is meant to provide an explanation of Automatic Message Accounting (AMA) and how it was/is used in the past and present. All information included in this file is correct to my knowledge, however, if anyone notices any errors or has anything interesting to add, try to get in touch with me one way or another and let me know. Hopefully this article will clear up any misconceptions about AMA that have been circulating around on bulletin boards and by word of mouth. Keep in mind, however, that the information here may not be applicable to your specific area or telco. The information contained herein generally applies to the BOC's, and if you are served by an independent telco, your method of billing may differ. This article is aimed more towards the more experienced telecommunications enthusiast. People with limited knowledge may have a hard time understanding the information presented here. However, if you can contact me I will try to answer any questions or clarify anything included in this article that isn't understood. Information will be included in this article concerning the use of AMA in the past. This is being done for people in older areas or areas served by an independent telco that may still be using the old technology. HISTORY ------- In the past, Call Detail Record (CDR) information was collected and recorded by cordboard operators in a process known as manual ticketing. The operator recorded this information by writing it down manually upon a formatted record called a ticket. These tickets were sent to the appropriate office where billing was handled. This manual ticketing process was time-consuming, and was phased out with the introduction of electromechanical switching. Before the advent of AMA, a magnetically operated counter called a message register was associated with each subscribers line in a given central office. This counter was responsible for counting the number of calls that each subscriber made, for billing purposes. This message register was caused to operate one or more times when the called party answered the telephone. The way this works is when the called party answers, a reverse battery signal was sent back over the trunk circuit to activate a relay in the originating office which was responsible for the application of a 48-volt battery to advance the message register the appropriate number of units. A local call is/was usually one message unit, regardless of how long the call lasted. Local calls to further away areas were/are usually two message units. Long distance calls were handled either by cordboard operators, using manual ticketing, or by a method not involving operators known as zone registration. With zone registration, calls to different zones would cause the message register to operate two or more times per time period. This would make the cost higher for longer calls, and less for shorter calls. At the end of the billing period, each message register had to be manually photographed to keep track of the number of calls made by that specific subscriber. These photos were taken by a 35 millimeter camera that was known as a Traffic Usage Recorder, and then sent to the same place that manual tickets (prepared by operators) were. However, this method of billing soon grew costly and inefficient, so a new method, LAMA (Local Automatic Message Accounting) was developed. Additional and more specific information shall be included later in the article. In the late 1940's, the Bell System developed LAMA, which recorded the billing information in a much more efficient manner. However, some end offices did not have enough call traffic to warrant the installation of LAMA equipment. To solve this problem, CAMA (Centralized Automatic Message Accounting) was developed in the mid 1950's. CAMA was different from LAMA in that it was based in a toll or tandem office and could record the AMA information for every end office that it served. More on LAMA and CAMA will be included later in the article. Another development concerning AMA is the computerization of the system, named LAMA-C or CAMA-C, for 'LAMA-Computerized' or 'CAMA-Computerized'. CAMA had used paper tape perforators for a time before the magnetic tape method was introduced with CAMA-C. LAMA-C is a computerized version of LAMA which also uses magnetic tape (LAMA-C is still used today). LAMA and LAMA-A (previous versions) used paper tape, although LAMA-A was more efficient. LAMA, LAMA-A, CAMA, and CAMA-C were all part of the AMARS, the Automatic Message Accounting Recording System. However, a newer term for more modern setups is the AMACS, for Automatic Message Accounting Collection System. The AMACS includes end office AMA systems, a recent introduction called the AMARC (AMA Recording Center), AMARC sensors from end offices to the AMARC, the data links used to transmit billing information, and data recievers located at the AMARC site. The AMARC is a product of the new age of computerized technology as it applies to the telecommunications systems used in our society. Still, LAMA and CAMA and their different versions shall be described and explained to help people understand how they were/are used. LAMA ---- LAMA is described by Notes on the Network (1983) as 'A process using equipment located in a local office for automatically recording billing data for message rate calls and for customer-dialed station to station toll calls'. What this is means is that if your CO uses LAMA, and you are on a single party line (most people are), all 1+ toll calls will be billable by LAMA equipment, and all calls coming from message rate lines. A message rate line, for those of you not familiar with the term, is a telephone line that has the ability to receive incoming calls, but all outgoing calls will cost the subscriber. The subscriber pays for basic service (the ability to receive calls) with the consideration that all other calls (even local ones) will cost a certain amount of money per call. Many subscribers in several major cities get this feature automatically, and thus phone bills are generally higher in these areas. LAMA originally recorded billing information on punched paper tape, in a version known as LAMA-A, but now magnetic tape is generally the format used in places where LAMA-C equipment is used. The paper tape perforators that recorded the CDR data in LAMA-A were noisy, and they needed maintenance due to their electromechanical construction. The magnetic tape method is much more reliable, and quieter as well. If a persons End Office uses LAMA, then all toll calls from all lines and all local calls from metered rate lines are recorded on the LAMA tape, with a few exceptions. LAMA can only be used to record AMA information for one and two party lines. On other party lines such as three and four party, the originating caller has his/her number identified by an operator via the ONI (Operator Number Identification) method. It is not been determined by the author if the BOC (Bell Operating Company) operators such as TOPS (Traffic Operator Position System, made by Northen Telecom Inc. of Canada) or MPOW (Multi-Purpose Operator Workstation, by US West) operators would be used for this ONI or not. I would guess that AT&T TSPS operators would handle an inter-LATA toll call, and that the BOC TOPS/MPOW operators would handle the ONI for an intra-LATA call (my reasoning behind this statement is the fact that whenever I have had an ONI due to equipment failure, which is similar to ONI needed, only the ANI outpulsing was garbled, the called number was still transmitted in the correct fashion. I am assuming that the end office switching system would route the call to the correct operator position by matching the NPA-NXX with some sort of internal table which makes a distinction between intra and inter-LATA calls). Anyway, these calls had their AMA information sent from the appropriate operator position to the toll office that served the 3+ party line, onto CAMA tape. Another instance in which a LAMA office may use CAMA instead is when an ANIF (ANI Failure) occurs. If the ANIF is sent to TSPS, then that TSPS will record billing information upon CAMA tape by using ONI. It seems that AMA information that has been recorded by an operator is buffered and stored until it is time to send the information to the appropriate places for processing. In the case of AT&T TSPS operators, the TSPS had it's own magnetic tape which was sent to the RAO (Regional Accounting Office, formerly called Revenue Accounting Office) on a regular basis. I am not sure if this method is still used or if TSPS AMA has been updated or enhanced in some way. EXAMPLES OF LAMA USAGE ---------------------- The following is the call flow procedure in a LAMA-A (paper tape) system. After a customer completes dialing, the dialed number (the called number), the originating class of service, Line Equipment Number (LEN), and call type are sent from the switch to the AMA equipment. Translations, such as figuring the billing telephone number from the Line Equipment Number, are done. The information that comes from the translations procedures determines which paper tape perforator shall be used to record the data for this specific call. A record of the initial information gathered is called the initial entry. The last line of the initial entry contains a two digit code called a Call Identity Index, which identifies telco equipment such as the trunk or district junctor that will be used for that call. When the call is answered, another entry is made, called the answer entry. This entry is a single line on the paper tape and has the CII and the exact time that the call was answered on it. The last entry on the paper tape is known as the disconnect entry. This entry contains the CII and the exact time that the call ended. The CII is important because it is what the RAO used to group together all the data about a given call. Entries are recorded at different times in a LAMA system, they are not in sequential order, so the CII makes it easier to find all three entries for a specific call. This method of recording AMA information required the RAO to 'unshuffle the deck' when it came time to organize the AMA information. The variations in the AMA recording formats used by different switching systems eventually led Bellcore to develop a standard AMA format, named the Bellcore AMA Format (BAF). More information will be included about this format later in the article. In a No. 5 Crossbar switching system, the AMA setup used special purpose 3 inch wide paper tape on which AMA records were recorded by CO equipment. This method of recording is for the stone ages, as it has been phased out by almost every BOC. Similar to the LAMA-A call flow, this method of AMA used three AMA entries. The first one was the customers service information, which included the calling and called telephone numbers, the second one was recorded when the telephone was answered, and the third one was recorded at disconnect. This also made the job at the RAO a bit harder, as again, they had to 'unshuffle the deck'. The No. 2 ESS introduced the latest magnetic tape recording technology that was available at that time. The 2E used 200 BPI, 7 track mag tapes, and it introduced special data coding conventions. It's technology and conventions are still in use today, but I think that the BPI and number of tracks have been increased. The 2E mimics the No. 5 Crossbar AMA method by recording three entries and interleaving them on the magnetic tape. Data common to all calls on a tape (such as date, CO info, etc.) are recorded in special tape headers. The No. 2B ESS was introduced with the same AMA technology as the 2E, but a 2B that provides equal access capabilities for interexchange carriers adds a new data entry to the three used by the 2E. This new entry reports the time of connection of a carrier to the local network, which is needed for carrier access billing. The No. 1 ESS modernized the AMA process even more. The 1E used 200 BPI, nine track tape. The 1E provides data collection memory registers for AMA information on applicable calls. A register is assigned to an AMA call and kept open for the call's duration. This register collected most of the billing data that was needed. The AMA information was then written to magtape at the time of disconnect. This made it easier for the RAO to process. The AMA format used by the 1E uses variable length records whose fields occur for the most part in a general, preset pattern. Eventually, though, even the 1E AMA method was found to be slightly faulty. This was due to high processing costs at the RAO and the problem of tape headers getting erased from the tape. The BAF was made to solve the problems that are associated with other AMA setups. An update to the BAF is called the EBAF, or Extended Bellcore AMA Format. The main difference between the BAF and EBAF is that EBAF is more flexible and can be used easier, as the BAF uses a defined structure for storing data. The EBAF can append other information to the end of an AMA record, and this makes it more flexible. ANI FORMATS ----------- The ANI formats outpulsed in a LAMA arrangement are as follows (assume that the call being shown for an example is being dialed from a home telephone, as dialing from coinphones would cause different ST signals to be sent; also the type of signaling in this case is SF in-band): CALLED number:KP+(NPA)+NXX+XXXX+ST CALLING number:KP+I+NXX+XXXX+ST The second format is the ANI associated with LAMA and is sent to the LAMA equipment after the ANI receiving trunk winks. The NPA included in this example is optional and only needed if the subscriber is making a call to a Foreign NPA (FNPA). The complete called number is not included in all cases, as when an AMA setup is configured for bulk-billing. In bulk-billing, the entire called number is not recorded, but just enough for billing purposes. The CALLING number is the number that the subscriber is dialing from. These two numbers are sent in Multi Frequency (MF) tones to MF receivers located within a CO. The I in the ANI is an information digit, and these shall be explained later in the article. One may wonder how a CO knows which lines it serves are message rate lines and which are flat rate. On electromechanical switches such as Step by Step, No. 1 and No. 5 Crossbar (it should be noted that there are no remaining panel switches within the Bell System), there is an electronic line card associated with each Directory Number which holds information relevant to that line. These cards have to have any type of change hardwired into them. However, in digital/ electronic switching systems, there are Line Class Codes which reflect information about each subscribers line. There are many, many of these codes. Some of the more common and interesting ones are listed below: LCC EXPLANATION --- ----------- 1FR Single party Flat rate Residential line 1MR Single party Metered rate residential line 1CF Single party Coin First coin telephone 1OF Single party Official (telco) line 1FB Single party Flat rate Business line 1MB Single party Metered rate Business line These codes can be found for a line in several places, such as certain fields in telco computer output reports. COSMOS and LMOS are two such computers that hold this information. If you find COSMOS printouts or have access to COSMOS, these Line Class Codes will be listed under the 'LCC' field in an ISH, INQ, or other inquiry. Sometimes the data in the LCC field will match or be similar to the data in the US field, which is a USOC (Universal Service Order Code). A USOC and an LCC aren't the same thing though. CAMA ---- CAMA operates along the same basic principle that LAMA does, except that CAMA is based in a toll or tandem office (class 4). CAMA is made to be used in areas where it would be costly to implement a LAMA arrangement for each and every class 5 office. This is because some end offices did not have enough traffic to warrant the cost and work required to install LAMA equipment. LAMA setups can/could be found in abundance in rural areas near large cities. The first letter in each of the acronyms (L)AMA and (C)AMA describes the usage of each. (L)AMA, for Localized, in a local central office, and (C)AMA for Centralized, in a toll office. The outpulsing formats to CAMA are similar to the LAMA ANI outpulsing. The outgoing trunk to the serving CAMA office from the end office sends the called DN in the format of KP+(NPA)+NXX+XXXX+ST. Next, the incoming CAMA trunk requests the end office to send the calling number. This is sent as KP+I+(NPA)+NXX+XXXX+ST, where the I is an information digit which gives information about the status of the process, and the NPA may or may not be needed, depending upon the setup. The information digits that follow are used in ANI outpulsing to Local and Centralized AMA. They are: 0-Automatic Identification (a normal call, with no special treatment); 1-Operator Identification (ONI-call is sent to an operator who requests the customer to give the number they are calling from); 2-Identification Failure (ANI Failure, handled the same way as ONI). The ONI due to ANIF and normal ONI which is used on certain party lines are kept track of. If too many ANI Failures happen, then a report will be generated indicating this fact. ONI needed is more standard and ordinary, and thus safer for the telecommunications enthusiast. This information can be put to a good use, as if you find an outgoing CAMA trunk when you are boxing, you can place calls over it by using the above CAMA formats. The only limiting factor is that the NXX of the calling number that you sent for ANI must be an office that is served by the particular CAMA offices trunk that you are using. Note that CAMA is not used much anymore, it was mainly used with Electro- Mechanical toll switches such as the No. 4A Crossbar, and the Crossbar Tandem (XBT). I don't think there are any XBTs or 4As in operation in the AT&T toll network, but CAMA may be used by independent telcos, or by telcos in rural areas that serve only a small number of central offices. In an independent telco setup, a CAMA arrangement may be used, but not in the same way as AT&T has used it. The centralized location may not be a toll office, it may just be the largest CO in that companies network. There can be several variations. CAMA was originally introduced to work with and in conjunction with ANI, thus the original term for the process, CAMA/ANI. For a complete description of ANI in electromechanical switching systems, see one of the older issues of Phrack Inc. newsletter for a file written by Doom Prophet and myself, titled 'Automatic Number Identification'. I have seen CAMA mentioned in recent telco information, so I assume that CAMA is still in use, at least in some places. Supposedly a way to determine if you are on CAMA is to dial local numbers, and send 2600Hz. If you can seize a trunk, then it is likely that you are served by CAMA. You can then pick local exchange codes, (NXX), dial them, seize a trunk, and then MF using the CAMA format included above, sending a false ANI for one of the local exchanges. If you do this, I suggest that you don't send the ANI of a resident. Use non-working numbers, disconnected numbers, payphone numbers. I am not sure if there is any check done upon the number sent in ANI by the toll office or not, but it is probable that the local switch is responsible for screening out invalid numbers and such. So if you can get on a CAMA trunk then you have the power to bill calls to anyone else who is served by a CO that homes in on the same toll office and uses the same CAMA equipment. <end of part one>