--------------------------------------    ___________________
       THE MARK TABAS ENCOUNTER           \ Dropped to lower/
          SERIES PRESENTS:                /case by your old \
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-     \ friend,         / 
     BETTER HOMES AND BLUE BOXING         /  -=+DarkStorm+=-\
           PART I                         \(Much easier to  /
       THEORY OF OPERATION                /   read now.)    \
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-    \_________________/

To quote KARL MARX, BLUE Boxing has ALWAYS been the most noble
form of Phreaking. As opposed to such things as using an MCI code
to make a free fone call, which is merely mindless pseudo-
phreaking, BLUE boxing is actual interaction with the BELL SYSTEM
TOLL NETWORK. it is like wise advisable to be more cautious when
BLUE boxing, but the careful phreak will NOT BE CAUGHT,
regardless of what type of switching system he is under.
 {{Perhaps not the Careful phreak, but it is hard to tell if you
are careful ENOUGH. If you get caught, you know you weren't
careful enough. Too bad there's such a penalty for it.... Good
luck my friends!}}
     In this part, I will explain how and why BLUE boxing works,
as well as where. In later parts, I will give more practical
information for BLUE boxing and routing information. ----
Communications with trunks.-----
     Trunks must NOT be confused with SUBSCRIBER LINES (or
"Customer Loops") which are standard telefone lines. Trunks are
those lines that connect central offices. Now, when trunks are
NOT in use (I.E., Idle or "ON-HOOK" state) They have 2600Hz
applied to them. If they are Two-way Trunks, there is 2600Hz in
both directions. When a trunk is in use (Busy or "OFF-HOOK"
state), The 2600Hz is removed from the side that is off-hook. the
2600Hz is therefore known as a Supervisory Signal, because it
indicated the status of a trunk; on hook (TONE) or off-hook (NO
TONE). NOTE also that 2600Hz is denoted SF (Single frequency)
signalling and is "IN-BAND." This is very important. "IN-BAND"
means that it is within the band of frequencies that may be
transmitted over normal telefone lines. Other SF Signals, such as
3700Hz are used also. However, they cannot be carried over the
telefone network normally (They are "OUT-OF-BAND" and are
therefore NOT able tobe taken advantage of as 2600Hz is.  Back to
trunks. Let's take a hypothetical phone call. You pick up your
fone and dial 1+806-258-1234(Your goof friend in Amarillo Texas).
For ease  we'll assume that you are  on #5 crossbar swithcing and
not in the 806 area. Your central office (CO) would recognize 
that 806 is a Foreign NPA, so it would route the call to the toll
centre that serves you. [For the sake of experienced reader, note
that the CO in question is a Class 5 with LAMA that uses
OUT-OF-BAND SF supervisory signalling]. Depending on where you
are in the country, the call would leave your toll centre(on more
trunks) to abother tollcenter, OR office of higher "RANK".Then it
would be routed to centraloffice 806-258 eventually and the call
would be completed. ILLUSTRATION:
     A---CO1-------TC1------TC2----CO2----BA=YOU  
                                      ___________
CO1=YOUR CENTRAL OFFICE              / Got bored \
TC1=YOUR TOLL OFFICE.                \ of trans- /
C2=TOLL OFFICE IN AMARILLO.          /lating all \
CO2=806-258 CENTRAL OFFICE.          \ this shit./
B=YOUR FRIEND (806-258-1234)         /___________\ 

IN THIS SITUATION IT WOULD BEREALISTIC TO SAY THAT CO2 USES
SFIN-BAND (2600HZ) SIGNALLING, WHILEALL THE OTHERS USE
OUT-OF-BANDSIGNALLING (3700HZ). IF YOU DON'TUNDERSTAND THIS,
DON'T WORRY TOO MUCH.I AM POINTING THIS OUT MERELY FOR THESAKE OF
ACCURACY. THE POINT IS THATWHILE YOU ARE CONNECTED TO
806-258-1234, ALL THOSE TRUNKS FROM YOURCENTRAL OFFICE (CO1) TO
THE 806-258CENTRAL OFFICE (CO2) DO *NOT* HAVE2600HZ ON THEM,
INDICATING TO THEBELL EQUIPMENT THAT A CALL IS INPROGRESS AND THE
TRUNKS ARE IN USE.  NOW LET'S SAY YOU'RE TIRED OFTALKING TO YOUR
FRIEND IN AMARILLO(806-258-1234) SO YOU SEND A 2600HZDOWN THE
LINE. THIS TONE TRAVELS DOWNOFFICE (CO2) WHERE IT IS
DETECTED.HOWEVER, THAT CO THINKS THAT THE2600HZ IS ORIGINATING
FROM BELLEQUIPMENT, INDICATING TO IT THATYOU'VE HUNG UP, AND THUS
THE TRUNKSARE ONCE AGAIN IDLE (WITH 2600HZPRESENT ON THEM). 
     BUT ACTUALLY, YOUHAVE NOT HUNG UP, YOU HAVE FOOLED
THEEQUIPMENT AT YOUR FRIEND'S CO INTOTHINKING YOU HAVE. THUS,IT
DISCONNECTSHIM AND RESETS THE EQUIPMENT TOPREPARE FOR THE NEXT
CALL. ALL THISHAPPENS VERY QUICKLY (300-800MS FORSTEP-BY-STEP
EQUIPMENT AND 150-400MSFOR OTHER EQUIPMENT).  WHEN YOU STOP
SENDING 2600HZ (AFTERABOUT A SECOND), THE EQUIPMENT THINKSTHAT
ANOTHER CALL IS COMING TOWARDSIT (I.E., IT THINKS THE FAR END
HASCOME "OFF-HOOK" SINCE THE TONE HASSTOPPED). IT COULD BE
THOUGHT OF AS ATOGGLE SWITCH: TONE --> ON HOOK, NOTONE -->OFF
HOOK.
     NOW THAT YOU'VESTOPPED SENDING 2600HZ, SEVERAL THINGSHAPPEN:
     1) A TRUNK IS SEIZED.
     2) A "WINK" IS SENT TO THE CALLING ENDFROM THE CALLED END
INDICATING THATTHE CALLED END (TRUNK) IS NOT READY TORECEIVE
DIGITS YET.
     3) A REGISTER IS FOUND AND ATTACHEDTO THE CALLED END OF THE
TRUNK WITHINABOUT TWO SECONDS (MAX).
     4) A START-DIAL SIGNAL IS SENT TO THECALLING END FROM THE
CALLED ENDINDICATING THAT THE CALLED END ISNOW, ALL OF THIS IS
PRETTY MUCHTRANSPARENT TO THE BLUE BOXER. ALL HEREALLY HEARS WHEN

THESE FOUR THINGSHAPPEN IS A <BEEP><KERCHUNK>. 
     SO,SEIZURE OF A TRUNK WOULD GO SOMETHINGLIKE THIS:  
1> SEND A 2600HZ  
2> TERMINATE 2600HZ AFTER 1-2 SECS.  
3> [BEEP][KERCHUNK]  

     ONCE THIS HAPPENS, YOU ARE CONNECTEDTO A TANDEM THAT IS
READY TO OBEY YOUREVERY COMMAND. THE NEXT STEP IS TOSEND
SIGNALLING INFORMATION IN ORDERTO PLACE YOUR CALL. FOR THIS YOU
MUSTSIMULATE THE SIGNALLING USED BYOPERATORS AND AUTOMATIC
TOLL-DIALINGEQUIPMENT FOR USE ON TRUNKS. 
     THEREARE MAINLY TWO SYSTEMS, DP AND MF.HOWEVER, DP WENT OUT
WITH THE DINOSAUR, SO I'LL ONLY DISCUSS MF SIGNALLING.MF
(MULTI-FREQUENCY) SIGNALLING IS THESIGNALLING USED BY THE
MAJORITY OF THEINTER- AND INTRA-LATA NETWORK. IT ISALSO USED IN
INTERNATIONAL DIALINGKNOWN AS THE CCITT NO.5 SYSTEM.  MF
SIGNALLING CONSISTS OF 7 FREQUEN-CIES, BEGINNING WITH 700HZ
ANDSEPARATED BY 200HZ. A DIFFERENT SET OFTWO OF THE 7 FREQUENCIES
REPRESENT THEDIGITS 0 THRU 9, PLUS AN ADDITIONAL 5SPECIAL KEYS.
THE FREQUENCIES AND USESARE AS FOLLOWS:

FREQUENCIES (HZ) | DOMESTIC    |      INT'L  |
-----------------|-------------|-------------|  ______________
700+900          |    1        |        1    | / I don't know \
900+1100         |    3        |        3    | \about you, but/
700+1300         |    4        |        4    | /sometimes I   \
900+1300         |    5        |        5    | \ actually dial/
1100+1300        |    6        |        6    | /the number 2. \
700+1500         |    7        |        7    | \   SEE THE    / 
900+1500         |    8        |        8    | /FILE ON LIKE  \
1100+1500        |    9        |        9    | \PAGE 3 FOR THE/
1300+1500        |    0        |        0    | / TONES FOR #2 \
700+1700         |  ST3P       |     CODE 11 | \______________/
900+1700         |   STP       |     CODE 12 |
1100+1700        |   KP        |       KP1   |
1300+1700        |  ST2P       |       KP2   |
1500+1700        |   ST        |       ST    |


 THE TIMING OF ALL THE MF SIGNALS IS A NOMINAL 
     60MS
 EXCEPT FOR KP, [which is]   120MS

