💾 Archived View for aphrack.org › issues › phrack40 › 7.gmi captured on 2021-12-04 at 18:04:22. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
==Phrack Inc.==
Volume Four, Issue Forty, File 7 of 14
=/=/=/=/=/=/=/=^=\=\=\=\=\=\=\=
= =
= The Fine Art of Telephony =
= =
= by Crimson Flash =
= =
=\=\=\=\=\=\=\=!=/=/=/=/=/=/=/=
Bell! Bell! Bell! Your reign of tyranny is threatened, your secrets will
be exposed. The hackers have come to stake their claim and punch holes in your
monopolistic control. The 1990s began with an attack on us, but will end with
our victory of exposing the secret government and corruption that lies behind
your walls and screens. Oppose us with all your might, with all your lies,
with all your accountants and bogus security "professionals." You can stop the
one, but you'll never stop the many.
A. Introduction
B. Basic Switching
C. RCMAC
1. Office Equipment
2. How Does All This Fit Into RCMAC
3. Function of RCMAC
a. Coordination of Recent Change Source Documentation
b. Processing of Recent Change Requests
c. Administrative Responsibilities and Interface Groups
D. The FACS Environment
E. Getting Ready For Recent Change Message
1. When MARCH Receives A Translation Packet (TP)
2. When MARCH Receives A Service Order Image
F. MARCH Background Processing
G. User Transaction in MARCH
H. Service Order Forms
I. COSMOS Service Order From The SOI Command
J. MSR - MARCH Status Report (MARCH)
K. Other Notes
L. Recommended Reading
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
A. Introduction
~~~~~~~~~~~~~~~
Bell. Bell Bell Bell! What is it about Bell? I am not sure what my
fascination is with them, but it never ceases nor does it ever diminish. Maybe
its because they are so private. Maybe its because they find it possible to
rip millions of people off daily and they do it with such great ease. Or
perhaps its just that they do not want anyone to know what they are doing.
Around my area down here in Texas (512), the Central Office buildings have
large brick walls, cameras at each door, bright lights, and every piece of
paper says in big block letters: "PROPRIETARY INFORMATION -- NOT FOR USE OR
DISCLOSURE OUTSIDE OF SOUTHWESTERN BELL." This message can be found on
everything, but their phone books! Why?
This files are about RCMAC and FACS/MARCH. The information presented here
is largely from memory. If you think the information is wrong, then get the
information yourself! One thing to keep in mind is that nothing is in stone!
Different BOCs (Bell Operating Companies) use different systems and have
different ways of doing the same thing. Like in some areas RCMAC is the CIC,
the MLAC may not exist, so on and so forth. So nothing is ever fully true with
Bell, but then why should things like their systems differ from their policies
and promises. There is a Bellcore standard and then there is the real way it
is done by your local BOC.
B. Basic Switching
~~~~~~~~~~~~~~~~~~
A switching system (a switch) allows connect between two (or more) phone
lines, or two trunks. A basic T1 trunk is 24 lines on a 22 gauge, 4-wire
twisted pair. Not only does it allow connect, it also controls connection,
where you call, and when someone calls you. In short it controls everything
about your phone! From a large AT&T 5ESS switching 150,000+ line to a small 24
line PABX (Private Automatic Branch Exchange, a switch), they control your
phone service.
What's the big deal about telephone switches? Telephony is the largest
form of communications for just about everyone in the world! Just try life
without a phone line to your house. I have four phone lines and sometimes that
is still not enough.
Today's switches are digital. This means that when you talk on the phone,
your voice is converted to 1s and 0s (on or off, true or false). This works in
several steps:
[0] You call someone.
[1] Sampling -- The analog signal (your voice) is sampled at certain parts.
The output is called Pulse Amplitude Modulation (PAM) signal.
[2] Quantize -- The PAM signal is now measured for wave length high (or
amplitude) where numbers are given to the signal.
[3] Encoding -- In this step, the Quantized signal (with the numbers for the
height of the wavelength (amplitude)) is converted to an 8-bit binary
number. The output of the 8-bit "word" may be either a "1" (a pulse) or
a "0" (no pulse).
[4] Encoding -- Produces a signal called a Pulse-Code Modulation (PCM)
signal. PCM just means that the signal is modulating pulses (digital).
From this point, the signal is switched to where it needs to go.
[5] The PCM signal is where it needs to go. The signal is now converted
back to analog.
[6] Decoding -- The 8-bit PCM signal is sent to the decoder to get the
number that measured the amplitude of the wave.
[7] Filtering -- This takes the PAM signal (the decoding produced) and it
reproduces the analog signal just as it was.
___
[1] [2] [3] [4] | S | [5] [6] [7]
________ _________ ______ | w | ________ ______
| | | | | | __ | i | __ | | | |
\/\/|Sampling|-|Quantize|-|Encode|__| |__| t |__| |__|Decoding|-|Filter|/\/
|________| |________| |______| | c | |________| |______|
| | | |_h_| |
| PAM PCM PCM |
Analog Signal (You Talking) / \ Analog Signal__|
/ \
/ \
/ \
/ \
Blow Up / of the Switch \
/ \
/ \
___________________________
_____ | | _____
1 T | | T 1 | | 1 T | | 1
-------| T |------| |------| T |-----
|_____| | | |_____|
_____ | | _____
2 T | | T 2 | S | 2 T | | 2
-------| T |------| mxn |------| T |-----
|_____| o | | o |_____|
_____ o | | o _____
m T | | T m | | n T | | n
-------| T |------| |------| T |-----
|_____| | | |_____|
|___________________________|
The basic design of most of the switches today is a Time-Space-Time (TST)
topology. In the Time-Space-Time in the arrangement shown, time slot
interchangers will interchange information between external channels and
internal (space array) channels.
This is just a quick run through to gives you a general idea about
switches without going into math and more technical ideas. For a better
understanding, get "Fundamentals of Digital Switching" by John C. McDonald.
This book is well written and describes ideas that I cannot get into.
C. RCMAC
~~~~~~~~
The Recent Change Memory Administration Center's (RCMAC) purpose is to
make changes to the software in various Electronic Switching Systems (ESS). An
ESS uses a Stored Program Control (SPC) to provide telephone service. Since
people with phones and their services change often, the ESS uses a memory
called Recent Change. This Recent Change area of memory is used on a standby
basis until the information can be updated into the semipermanent memory area
of the ESS. It is in the templar area that changes (or Recent Change Messages)
are typed and held for updating into the semipermanent memory area (Recent
Change Memory).
The following Switching Systems (switches for short) that have Recent
Change:
- 1/1AESS
- 2/2BESS
- 3ESS
- 5ESS
- Remote Switching System (RSS)
- #5ETS
- DMS100/200/250/300
Here is a typical hookup. As you follow the diagram below, you will see:
[1] Telephone subscriber connected to the Central Office by cables.
[2] At the Central Office, each subscriber is connected to the Main
Distributing Frame.
[3] The Cable and Pair is now connected to the Office Equipment (OE) at
another location on the MDF.
_______________
(Home Phone Lines) M.D.F. | |
|--(Home Phone) ___________ | |
|--(Home Phone) /__/| /__ /| | D.S.S. |
|--(Home Phone) |\ ||__|/ | |-----| |
| | _|_/_|__| |-----| Equipment |
| | /|/ \| | |-----| |
| | /||__| \| |-----| |
|_________________|/_|/ |__|/ |_______________|
/ |
Cables Cross-Connects
[1] [2] [3]
1. Office Equipment
~~~~~~~~~~~~~~~~~~~
The Office Equipment (OE) is identified by a unique numbering plan. The
equipment numbers identify the equipment location within the system. The
Equipment Numbers also vary from one type of equipment to another.
You also may find the OE (Office Equipment) referred to as the LEN (Line
Equipment Number). It is called a REN (Remote Equipment Number) in a case of
RSS (Remote Switching System).
Each telephone number is assigned to a specific equipment location where
they bid for dial tone.
Here is an example of different types of Office Equipment:
1/1AESS #2ESS
~~~~~~~ ~~~~~
OE 0 0 4 - 1 0 1 - 3 1 2 OE 0 1 1 - 2 1 4 0
| |/ | | | | |/ | |/ | | |/
| | | | | | | | | | | |
| | | | | | Level | | | | Switch and Level
| | | | | Switch | | | Concentrator
| | | | Concentrator | | Concentrator Group
| | | Bay | Link Trunk Network
| | Line Switch Frame Control Group
| Line Link
Control Group
#3ESS Others
~~~~~ ~~~~~~
OE 0 0 1 - 2 1 4 0 1XB = XXXX-XXX-XX
| |/ | | | | 1XB = XXXX-XXXX-XX
| | | | | Level 5XB = XXX-XX-XX
| | | | Switch SXS = XXXX-XXX
| | | Switch Group DMS-10 = XXX-X-XX-X
| | Concentrator 5ESS = XXXX-XXX-XX
| Concentrator Group 5ESS = XXXX-XX-XX
Control Group RSS = XXXX-X-XXXX
DMS-1/200 = XXX-X-XX-XX
2. How Does All This Fit Into RCMAC?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
RCMAC (Recent Change Memory Administration Center) is responsible for updating
any Service Order activity. This action will change a customer line or service
in the Recent Change memory of the SPC switches.
3. Function of RCMAC
~~~~~~~~~~~~~~~~~~~~
The three basic functions performed in RCMAC are:
a. Coordination of Recent Change Source Documentation
b. Processing of Recent Change Requests
c. Administrative Responsibilities and Interface Groups
In more detail:
- Coordination of Recent Change Source Documentation
The first function is the coordination of Source Documents. The main
source of RC (Recent Change) is the Service Orders. Service Orders are changes
in a subscriber's service. RCMAC, in addition to the input of the service
order in the switches, is responsible for other activities such as:
- Simulated Facilities (SFG)
- Route Indexes
- Traffic Registers (TR)
- Subscriber Line Usages (SLU)
- Service Observing Assignment (SOB)
- MARCH (MIZAR) RPM Updates
Terminal Communications to the switches and/or MARCH (MIZAR) typically use
the AT&T Datakit. RCMAC also is responsible for "HOT" requests from the I.C.
(Installation Center) and other transmissions from the I.C.
- Processing of Recent Change Requests
The second function of RCMAC is processing of RC messages. This involves
inputting and editing RC messages in the switches. When RCMAC inputs messages,
they are making a change to their customer's service. The customers service is
dependent on the prompt, accurate processing of RC source documents (Service
Orders).
The due date (sometimes referred to as the Frame Due Date) remarks and
time interval assigned to the order will govern the release of RC input to ESS.
Due date is important because this is the date that the Service Order has to be
completed (going through the FACS system, frame work done, and RC message
inputted into the switch).
Recent Change Requests
The RCMAC receives documentation for changes to the temporary memory areas
of the various types of ESS equipment. These changes may come in many forms
and from many different sources.
_________ _____
| | | |
Service Orders---------------->| R |--------->| ESS | _____
Line Station Transfer--------->| C | |_____| | |
Service Observing------------->| M |---------------------->| ESS |
Special Studies--------------->| A | ______ |_____|
Trouble Reports--------------->| C | | |
Verifications----------------->| |--------->| ESS |
|_________| |_____|
Some Recent Changes requests are Service Orders, Line Equipment Transfers
(LET), Service Observing Requests (SOB), Special Studies (SLU), Trouble Reports
and Verification (follow local procedure). In short, it is taking this
information and making the correct changes into the SPC switches.
- Administrative Responsibilities and Interface Groups
- Control of errors.
- Monitor activity.
- Prepare administrative reports.
- Coordination of RCMAC operations and interface with other departments.
- Restore RC area of the switches in the event that RC memory is damaged
due to machine failure.
Operational Interface
RCMAC must coordinate activities with many work groups to achieve accurate
and quick RC for the ESSes.
BSC/RSC & MKTG
|
|
SCC | RSB
\ | /
\ | /
\ | /
NAC ---------- RCMAC ---------- IC
/ \
/ \
/ \
Frame MLAC
To help understand this better, here is a short description of each group
that interfaces with RCMAC:
SCC (Switching Control Center)
- Technical assistance to RCMAC
- Provide emergency coverage (off hours) for RCMAC. This includes
service affecting problems. They also coordinate any updates in
the ESS programs with RCMAC.
NAC (Network Administration Center) provides RCMAC with:
- Line Class Codes (LCC) like 1FR (1-party Flat Rate).
- List of numbers that must be changed (in ESS memory) from one intercept
route index to another, prior to reassignment.
- Translation Assignments; Example: Simulated Facilities Group (SFG).
- Area Transfer/Dial for Dial Assignment.
- Service Observing assignment.
- Subscriber Line Usages (SLU) study assignment.
- Customer Line Overflow study assignment.
- RPM updates for DMS 100 change in COSMOS tables USOC/NXX/Ltg.
Frame (Frame Jeopardy Reports) Central Office (FCC) will interface with RCMAC
for Line Equipment transfers.
- Problems encountered by the frame group when completing Service Orders
may be coordinated with the MLAC (Loop Assignment Center), or when
appropriate will be called directly to RCMAC (i.e. No Dial Tone on a new
connect).
Business/Residence Service Center (BSC/RSC) and Marketing (MKTG)
- The BSC/RSC and MKTG determine what kind of service the customer wants,
generates Service Orders, and coordinates with RCMAC regarding special
services to customers.
Repair Service Bureau (RSB) or Single Point of Contact (SPOC)
- Customer trouble reports may involve RC inputs; the RCMAC would work
closely with RSB or SPOC to clear such troubles.
- RCMAC is responsible for analyzing, investigating and resolving customer
trouble caused by RC input.
Installation Center (IC) and/or Maintenance Center (MC)
- The IC/MC group is responsible for the administration function
associated with the completion and control of Service Order load. This
invokes all orders whether they require field work or no field work.
- This Group is responsible for ensuring all service orders are taken care
of on the proper due date.
Mechanized Loop Assignment Center (MLAC) or LAC
- Assigns Service Orders for RCMAC.
- Assigns customers loops (this group is not in all BOCs).
D. The FACS Environment
~~~~~~~~~~~~~~~~~~~~~~~
To better understand RCMAC, Source Document flow, and a typical BOC as a
whole, the FACS (Facility Administration Control System) is an important part
of this.
Systems in a FACS environment
PREMIS - PREMises Information System
This system is divided into three parts: the main PREMIS database,
PREMLAC (Loop Assignment) and PREMLAS (Loop Assignment Special
circuit). This contains customer and address inventory and assigns
numbers.
SOAC - Service Order Analysis and Control
This system receives Service Orders from SORD and interprets and
determines facility requirements. The system requests and receives
assignments from LFACS and COSMOS and forwards orders to MARCH,
forwards assignments to SORD, and also maintains Service Order history
and manages changes.
LFACS - Loop FACS contains all loop facilities inventory and responds to
requests for assignment.
COSMOS - COmputer System for Mainframe OperationS contains all the OE inventory
and responds for OE request.
SORD - Service ORder and Distribution distributes Service Orders throughout
the system.
MARCH - MARCH is the Mizar upgrade which will come into play when the
Stromberg-Carlson (SxS and XBAR) is upgraded to Generic 17.1 (the
software interface is called NAC). Though there is a problem with the
interface between MARCH and COSMOS (because the Generic Interface is
not supported by COSMOS), templates are used for MAN, AGE, LETS, etc.
Anyway, MARCH plays a big part in this system. MARCH, aside from what
was talked about above, has a basic function of keeping RCMAC up to
date on the switches (MSR user transaction). It is an RC message
manager which will allow one to modify messages (ORE), show usages
(MAR) and logs all transmissions.
BASIC ORDER FLOW
~~~~~~~~~~~~~~~~
PHASE I - COSMOS/MIZAR
__________
| |
| Customer |
| Request |
|__________|
|
V
_________
| |
| SORD |
|_________|
|
V _________
__________ | |
| | | Work |
| SOAC | ----------> | Manager |
|__________| | (WM) |
|_________|
|
|
V
* * * * * * _________
* * | |
* COSMOS * -------> | MIZAR |
* * |_________|
* * * * * * |
|
V
_________
| |
| SPCS/ |
| DIGITAL |
| SWITCH |
|_________|
===============================================================================
PHASE II - SOAC/MARCH
__________
| |
| CUSTOMER |
| REQUEST |
|__________|
|
|
V
__________
| |
| SORD |
|__________|
|
|
V ___________ _________
__________ | | _________ | |
| | | WORK | | | | SPCS/ |
| SOAC | ------> | MANAGER | ------> | MARCH | ---> | DIGITAL |
|__________| | (WM) | |_________| | SWITCH |
|___________| |_________|
===============================================================================
... Then There Was MLAC
With conversion to FACS, a shift in the service order provisioning process
was made from manual input by the LAC and NAC to mechanized data flow from SOAC
to COSMOS (via Work Manager). Tables used for Recent Change (CFINIT, USL, and
CXM) and spare OE assignments reside in COSMOS, along with the Recent Change
Message Generator (RCMG). The LAC and NAC are now involved only on an
exception basis (This will be explained in more detail later on).
________
| |
| SORD |
|________|
|
|
V ____________
_________ | |
| | ---------> | FACS |---
| SOAC | | COMPONENTS | |
|_________| <--------- | FOR ASGNS. |---
| |____________|
|
V * * * * * * * * * * * * * * * * * *
_________ * ___________ *
| | * | | ________ * _______
| WM |---> * | o SP OE | | | * RC | |
|_________| * | o CFINIT |----> | RCMG | * ----->| MARCH |
* | o USL | |________| * MSG |_______|
* | o CMX | * |
* |___________| * |
* * V
* C O S M O S * _________
* * * * * * * * * * * * * * * * * * | |
| SPCS/ |
| DIGITAL |
| SWITCH |
|_________|
. . . NOW THERE IS SOAC/MARCH
With the SOAC/MARCH application (FACS/MARCH configuration), the primary
source of service order data continues to be SOAC. COSMOS is taken out of the
Recent Change business with this application (except, like the LAC and NAC, on
an exception basis) and becomes just another FACS Component. The tables that
resided in COSMOS or Recent Change are now duplicated in MARCH.
Instead of retrieving, storing, and passing on already-formatted Recent
Change messages, MARCH now generates the Recent Change from the data passed
from SOAC, as did COSMOS previously.
________
| |
| SORD |
|________|
|
|
V ____________
_________ | |
| | ---------> | FACS |---
| SOAC | | COMPONENTS | |
|_________| <--------- | FOR ASGNS. |---
| |____________|
|
V * * * * * * * * * * * * * * * * * *
_________ * ___________ *
| | * | | ________ * _________
| WM |---> * | o RPM | | | * RC | |
|_________| * | o CFINIT |----> | RCMG | * -----> | SPCS/ |
* | o USL | |________| * MSG | DIGITAL |
* |___________| * | SWITCH |
* * |_________|
* M A R C H *
* * * * * * * * * * * * * * * * * *
E. Getting Ready For Recent Change Message
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
STARTING WITH SORD
Service Orders (SORD) contain FIDs and USOCs (Universal Service Order
Codes [these codes tell the type of service the customer may have or get])
followed by data specific to a customer's service request (SORD accesses PREMIS
for telephone number and address data; other entries are made by the Service
Representative). The order is then passed to SOAC.
THEN TO SOAC
SOAC uses internal tables to read the FIDs and USOCs passed by SORD to
determine what information is required from the various components of FACS.
SOAC then accesses the appropriate FACS components (LFACS for Cable Pair
assignment; COSMOS for OE assignment) and gathers the required data.
Once all the data has been collected, SOAC passes the information to the
Work Manager. Data is either passed as is or translated by SOAC (again using
internal tables) into language acceptable to the receiving systems (i.e.,
COSMOS and MARCH).
SOAC passes information intended for MARCH in one of two ways:
TP-Flow-Through Translation Packets
Translation Packets (TPs) contain fully translatable data from which
MARCH can generate a Recent Change message. Determination is made by
SOAC based on the interface capabilities and its ability to read,
translate as required, and pass data.
Service Order Image
Service Order Images are sent to MARCH if SOAC is not able to pass
all required data. Images require additional information, either
input manually or retrieved from COSMOS before Recent Change messages
are generated.
WORK MANAGER - THE TRAFFIC COP
The primary function of Work Manager is to read the service order and
determine where the data must be sent. Decisions include:
COSMOS System MARCH System
COSMOS Wire Center MARCH Switch
COSMOS Control Group Serving RCMA
Work Manager passes the service order data to MARCH on a real time basis
(orders that were previously held in COSMOS until requested by Frame Due Date
[FDD] are now held in MARCH), either as a TP or an Image.
1. When MARCH Receives A Translation Packet (TP)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(1) A Translation Packet, passed from SOAC via Work Manager is received in
MARCH by the CIP, Communication Interface Program.
(2) When data is received by the CIP, it calls up the CTI or Job Control
Module. The Job Control Module or CTI writes the data that is received to
a temporary file and informs TP Trans (Translation Translator) that an
order has been received. It also controls the number of simultaneous jobs
submitted to TPTrans.
(3) TPTrans analyzes the order in the temporary file, does appropriate FID
conversion (such as stripping out dashes), reformats the order, and passes
it to the Recent Change Message Generator (RCMG).
(4) RCMG performs all Recent Change message generation and, upon completion,
writes the order into a MARCH pending file (Pending Header or Review
file).
In addition to the data passed from SOAC, RCMG uses the following data in
MARCH to translate into switch-acceptable messages:
NXX Switch Specific Parameters (RPM)
USOC (RPM) CCF Keywords (CFINIT)
USOC/NXX (RPM) Review Triggers (RVT)
Release Times (SRM)
________
| |
| SOAC |
|________|
|
|
V
______
| |
| WM |
|______|
|
|