==Phrack Inc.== Volume Two, Issue 19, Phile #3 of 8 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_| |_| |_| |_| Understanding the Digital Multiplexing System |_| |_| (Part2) |_| |_| |_| |_| by |_| |_| |_| |_| Control C |_| |_| |_| |_| & |_| |_| |_| |_| The Tribunal Of Knowledge |_| |_|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_| |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_| Well some of you may recall my file on Digital Multiplexing in Phrack 10. Well this is part 2 that was promised about a year and a half ago. I was finished with this file in May of 87 and I just decided to release it now. Here it is! DMS switches were first introduced in 1979, since then it has been modified to interface numerous types of switches. DMS has the ability to interface with SP-1, #5 XBar, 1ESS, 2ESS, 3ESS, 4ESS, NX1D, NX1E, TSD, SXS, ETS4, NO. 1 EAC, NO. 2 EAX, NO. 3 EAX, TSPS, CAMA/3CL boards, Stromberg Carlson Turret of ONI and Visual Indicators, Modified North Electric TSD for ONI, Stomberg Carlson (CAMA operator Position - ONI/ANI), AE #31 Switchboard, Co-located NT/AE switchboard I/C, O/G, UDC data poller of OM, DACS (Directory Assistance Charging System), NT #144 LTD, WECO #14 LTD, WECO #16 LTD, CALRS (Centralized Automated Loop Reporting System), Badger 612A, AE #1 and #21 LTD, AE #30, SC #14 LTD, Lordel MITS70 line Test System, Porta System Line Test Unit, Pulsar II IMTS, Teradyne loop test unit, and the WECO MLT 1 (Mechanized Loop Testing System). Common Channel Interoffice Signaling Common Channel Interoffice Signaling (CCIS) is a way of signaling and a way of implementing network level services. CCIS provides reliable, crystal clear data signaling links between the network and the switching offices. The CCIS signaling method uses transmission equipment that is separate from voice trunks. Common Channel Interoffice Signaling No. 6 The basis for the CCIS system is the International Consultative Committee on Telephone and Telegraph (CCITT) No. 6 international standard, which is brought to it's fullest capacity for use in the Stored Program Control (SPC) network of AT&T. The CCIS6 network contains a bunch of signaling regions, each having a pair of interconnected Signal Transfer Points (STP). The switching systems put into CCIS6 then connecting to STPs are called Serving Offices (SO). Band Signaling (CCIS-BS) is used on trunk signaling for intertoll-type trunks using the CCIS network. Direct Signaling (CCIS-DS) is used for signaling between SPC switching machines and a Network Control Point (NCP). At the present time CCIS6 can handle Enhanced INWATS Originating Screening Office (OSO), Calling Card Validation (CCV), Mechanized Calling Card Service (MCCS), and Billed Number Screening (BNS). CCIS6 is available with DMS-100/200, DMS-200, and DMS-100/200 or DMS-200 with TOPS. CCIS6 Diagram: NSB ST ------------ - - - - - - - - - - - DTC | | | ------- | - - - DS30 | IPML | DS30 | - - - | || | | --------| |------|- - - - - - |------|-| |---| || | | Digital - - - | | | - - - | || | | Trunks | | | | || | | | | | ------- | | | - - - - - - -|- - - - DTC | | TM | DIG - - - DS30 | NUC | DS30 - - - ----- --------| |------|- - - - - - |--------| |----| | ^ - - - |Network | - - - ----- CCIS \ ------------ Modem Signaling \ | - - - ----- AN Links--| | | CCC | - - - ----- Channel Bank Acronyms: DIG - Digital AN - Analog DTC - Digital Trunk Controller MSB - Message Switch Buffer ST - Signaling Terminal TM - Trunk Module NUC - Nailed-Up Connection IPML - Inter-Peripheral Message Link Common Channel Interoffice Signaling No. 7 Common Channel Signaling (CCS) No. 7 or CCIS7 is a CCS system bases on CCITT No. 7. CCIS7/CCS7 on the DMS switch consists of two parts the Message Transfer Part (MTP) and the Interim Telephone user Part. They are compatible with DMS-100, DMS-200, DMS-100/200, and DMS-100/DMS-100/200 with TOPS. CCIS7 can't tell the difference between banded and direct signaling. CCIS7 uses Destination/Origination Point Codes (DPC/OPC) to rout back to the switch. CCIS7 can handle Automatic Calling Card Service (ACCS), Enhanced INWATS, Local Area Signaling Services, and Direct Service Dialing Capabilities. Equal Access The DMS-200 Access Tandem (AT) gives a traffic concentration and distribution function for interLATA traffic originating and a distribution function for interLATA traffic origination or terminating inside a Local Access and Transport Area (LATA). This gives the interLATA Carrier (IC) access to more that one end office inside the LATA. It can handle InterLata Carrier access codes (10xxx), 10xxx and 950-yxxx dialing, Automatic Number Identification (ANI) on all calls, answer supervision, equal access Automatic Message Accounting (AMA) for both originating and terminating calls, and operator service signaling. The DMS-100 EA gives direct and tandem switched access service inside the LATA for originating and terminating to interLATA Carriers. It is available in the following three ways: Equal Access End Office (EAEO) DMS-100 Equal Access End Office (EAEO) gives a direct interconnection to interLATA Carriers (IC) and international Carriers (INCs) Point of Presence (POP) inside the LATA. Access Tandem with Equal Access End Office The DMS-200 Access Tandem (AT) when used with equal access end office (EAEO) lets trunk tandem interconnect to ICs/INCs POP inside the LATA. The connection of the Equal Access End Office (EAEO) to an IC/INC through the DMS-200 Access Tandem (AT) uses what is called two-stage overlap output pulsing which makes the time it takes to set up a call quicker. The AT uses the digits OZZ + XXX out pulsed in the first stage to identify the IC/INC dialed and to pick and outgoing trunk. Then a connection is established from the IC/INC to the EAEO through the AT. The second stage digits, consist of ANI and the called numbers are passed through the DMS- 200 AT at the IC/INC. A AMA terminating record in AT&T format is produced by the DMS-200 for all the EAEOs. A per call terminating AMA record is made for calls that get to the stage where the trunk from the IC/INC has been seized and a "wink" has been returned by the DMS-200 AT. Access Tandem with a Non-Equal Access End Office DMS-200 AT using a non-equal access end office gives trunk tandem connection to an IC/INC POP within the LATA. To set up a call, connection of Feature Group B (FGB) or Feature Group C (FGC) End Office to an IC/INC through the DMS-200 AT, uses the standard Bell Central Automatic Message Accounting (CAMA) signaling. The Access Tandem uses the XXX digits of the access code 950-YXXX out pulsed from the FGB end office to identify the IC/INC and to connect to a outgoing trunk. Mechanized Calling Card Service (MCCS) The fraudulent use of calling cards, third number and collect calls and the increasing movement to automate current operator services has directly led to the implantation of the Mechanized Calling Card Service (MCCS) to DMS-200/TOPS and to the remote and host Operator Centralization (OC). MCCS uses CCIS to relay queries and responses to and from the DMS-200/TOPS. Operator handled calling card calls and the direct entry by subscribers of Calling Cards by DTMF (Touch-Tones) telephones are given special provisions by the MCCS. Both, the operator handling and the direct entry of calling card calls, are decreasing the size operators. Billed Number Screening (BNS) gives an enhancement to the operator-handled collect and third-number billing by using CCIS to screen a number at the billing validation data base for billing restrictions (i.e. the third number is a fortress). This feature naturally will reduce fraudulent use of the collect call feature. Common Channel Interoffice Signalling-Direct Signalling (CCIS-DS), which is the feature that the MCCS is designed around, is used to transmit messages to and from many possible Billing Validation Centers (BVCs). Messages transmitted to the BVC about MCCS include the billing number and the Personal Identification Number (PIN). In BNS the messages have the special billing number (collect or third number). The return messages from the BVC include validity (of the number), billing restrictions (if any), and the Revenue Accounting Office (RAO) code. Auxiliary Operator Services System The DMS-200 Auxiliary Operator Services System (AOSS) is used primarily for Directory Assistance and the intercept needs that are not included in the TOPS package. The AOSS is similar to TOPS and co-exist with TOPS on the DMS-200 Toll system. Major benefits of the AOSS include Directory Assistance is provided with a modern environment, AOSS position administrative activities are performed by the DMS-200 toll maintenance system, trunking savings are achieved by combining trunking for 1+ and 0+, and Directory Assistance traffic, DA services are managed by using TOPS methods, Creation of a built-in training system, which does not require additional training equipment and reduces training costs. Integrated Business Network The Integrated Business Network (IBN) is a revenue-producing concept designed for small and big businesses to offer modernized PBX and Centrex features. The Operating Company can use the IBN to maintain and enhance its competitive position on a operational DMS-100 and DMS 100/200 switches. While using the DMS-100 switch, the Operating Company can support varying business features along with existing local/toll traffic. IBN services can be introduced to a Centrex-Central Office (CO) or a Centrex-Customer Unit (CCU) by additional software modules and minor hardware enhancements. Current IBN features include: A growing system that can handle 30,000 lines, networking capabilities, city wide service for DMS- 100 switch and remotes for any one customer station Message Detail Recording (SMDR), which gives IBN customers call records. The records can be used for system analysis and control and station charge-back. SMDR can use LAMA records, if the IBN host has LAMA equipment, Centralized attendant maintenance and administration functions and Direct Inward Dialing (DID). Electronic Switched Network (ESN) The Electronic Switched Network is designed to meet the telecommunication needs of large multi-location corporations. The ESN is made up of a SL-1 or SL-100 Digital Business Communications System with networking features or a DMS-100 IBN host. The SL-1 can handle from 30-5000 lines. The SL-100 and the DMS-100 IBN hosts can hold from a few thousands to 30,000 lines. A DMS-100 IBN or SL-100 can remotely serve many locations from the host site. This is done by a connection through digital transmission facilities which are set up at remote modules at the subscriber's premises. Specialized Common Carrier Service (SCCS) The DMS-250 Specialized Common Carrier Service (SCCS) provides the capability of Analog to Digital (A/D) and Digital to Analog (A/D) conversions which are necessary with analog circuits. The DMS-250 can also switch voice and data circuits. The DMS-250 takes either analog or digitally encoded info and by using time slot interchange, switches it from any input port to a temporary addressed and connected exit port. The info may or may not be converted back to analog. Normal Private Telecommunications Network Diagram: ----- ------ [Phone]--| SnS | | SL-1 |-[Phone] | PBX | | PBX | ----- ------ | |DOD/DID DOD/DID| | | ------- ------- | |Tie | | Tie| |Trunk --------- Trunk| ------| Class-5 |------ ----| Centrex |---- | --------- | | | | | | | ----- Tie Trunk --------- | SnS | ----------| Class-5 | | PBX | | Centrex | ----- --------- | | | | | | | | ------- ------ [Phone]-| Small | | SL-1 |-[Phone] | PBX | | | ------- ------ Cellular Mobile Radio Service A cellular system consists of two main parts a cellular switch and cell site equipment. Cellular Switching Systems A cellular switch performs three main functions audio switching, cell site control, and system administration. The DMS switches provide three basic implementations for cellular switching Stand-alone, Combined, and Remote. Stand-alone switching is done by a Mobile Telephone Exchange (MTX) which is interfaced with one or more class 5 end offices. The connection is made by DID/DOD trunks. Depending on the needs of the area, the MTX can be divided as follows: MTX which serves urban areas, MTXC which handles suburban areas, and MTXM which is used for rural areas. Combined switching is incorporated into a DMS-100 by some hardware additions and cellular software. Combined switching is designed to give a easy, cost-effective way to install cellular services to an existing host. Remote Switching is done by combining Remote Switching Center (RSC) with a Cell Site Controller (CSC). This combination is hosted by either a stand-alone or a combined switch. Remote Switching is designed for serving suburban centers, remote areas, or a small community and it gives extra flexibility for a growing system. All of these cellular switches have the ability to balance the workload among various cell sites. For example, if one site's workload reaches the programmable level of congestion, calls would be routed to nearby sites that can handle the extra calls. Cell Site Equipment Cell site equipment consists of a CSC and radio equipment. The CSC is controlled by the cellular switch and it controls radio equipment and maintenance tasks. The CSC will work on any MTX cellular switch because of the Remote Cluster Controller (RCC). The radio equipment consists of self-contained Radio Channel Units (RCU), antennas, transmitter multi-couplers and receiver combiners. By different program software a RCU can perform voice, control locating, and test functions. The self contained nature allows the RCU be remotely located to the CSC. A RCU has built-in circuitry for extended testing of the radio part of the system. -------- ---------- [phone]--| Remote | | SL-1 PBX |--[phone] | Module | | ESN Main | -------- ---------- | | | DS-1 Facility | DS-1 Facility | -------------- | --------> | Local Class 5| <--------- [phone]---------| DMS-100 | ----| IBN/ESN |------------- 2W Loop MFIDP | -------------- | ESN Trunk Group or DS-1 | | | or DS-1 | ----- --------------- | | CSC | | Local Class 5 | -------- ----- | DMS-100 | | SL-100 | <--- DS-1 ----> | IBN/ESN | -------- Facility Ph --------------- | | | | | DS-1 Facility | DS-1 Facility | | -------- ---------- [phone]--| Remote | | SL-1 PBX |--[phone] | Module | | ESN Main | -------- ---------- <End of File> <5-23-87> If you have any questions contact me or any other member of the T0K! Control C !T0K! (1987) ==============================================================================