Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Phreaking General Information :: bioc2.txt

BIOC Agent 003's Basic Telecom Tutorial 2 of 7

*******BIOC Agent 003's course in******
*                                     *
*      ==========================     *
*      ==========================     *
*               PART II               *


In part II, we will explore the various
special Bell #'s, such as:  CN/A, AT&T
Newslines, loops, 99XX #'s, ANI,
ringback, and a few others.


Newslines are recordings that Bell
employees call up to find out the
latest info on stock, technology, etc.
concerning the Bell System.

Here are the #'s that are currently
known to phreaks (at least me, anyway):

201-483-3800 NJ        513-421-9060 OH
203-771-4920 CT        516-234-9914 NY
212-393-2151 NY        518-471-2272 NY
213-621-4141 CA        617-955-1111 MA
213-829-0111 CA (GTE)  702-789-6711 NV
213-449-8830 CA        713-224-6116 TX
312-368-8000 IL        714-238-1111 CA
313-223-7223 MI        717-255-5555 PA
314-247-5511 MO        717-787-1031 PA
408-493-5000 CA        802-955-1111 VE
412-633-3333 PA        808-533-4426 HI
414-678-3511 WI        813-223-5666 FL
416-929-4323 ONT.      914-948-8100 NY
503-228-6271 OR        916-480-8000 CA


First of all, you must understand the
concept of loops.  I think that the
best way that this is understood is the
way that Phred Phreek explained it...

"No self-respecting Phone Phreak can go
through life without knowing what a
loop is, how to use one, and the types
that are available.  The loop is a
great alternative communication medium
that has many potential uses that
havent't even been tapped yet.  In
order to explain what a loop is, it
would be helpful to visualize two phone
numbers (lines) just floating around in
the Telco central office (CO).  Now, if
you (and a friend perhaps) were to call
these two numbers at the same time,
POOOOPFFF!!!, you are now connected
together.  I hear what you're saying
out there..., "Big deal" or "Why should
Ma Bell collect here two MSU'S (message
units) for one lousy phone call!?"
Well... think again.  Haven't you ever
wanted someone to call you back but,
were reluctant to give out your home
phone number (like the last time you
tried to get your  friend's unlisted #
from the business offfice)?  Or how
about a collect call to your friend
waiting on a loop, who will gladly
accept the charges?  Or better yet,
stumbling upon a loop that you discover
that has multi-user capability (for
those late-night conferences).  Best of
all is finding a non-supervised loop
that doesn't charge any MSU's or tolls
to one or both parties.  Example:  many
moons ago, a loop affectionately known
as 'the 332 Loop' was non-sup (ie, non-
supervised) on the tone side.  I had my
friend in California dial the free
(non-sup) side, (212) 332-9906 and I
dialed the side that charged, 332-9900.
As you can see, I was charged one MSU,
and my friend was charged zilch, for as
long as we wished to talk!!!"


Ahhh...have I perked your interest yet?
If so, here is how to find a loop of
you very own.  First, do all of you
loop searching at NIGHT!  This is
because the loops serve a genuine test
function which Telco uses during the
day.  (We don't want to run into an
irate lineman now, do we?)  To find
a loop, having 2 #'s is a definite
plus.  If not, have a friend to dial
#'s at his location.  Last resort, try
dialing from two adjacent pay phones.
Now get your trusty white pages (*),
and turn to the page where it lists
the # of MSU's from your exchange (or
exchanges in your primary calling area)
The idea is to find a loop that is
within your primary calling area or is
only 1 MSU in your area (call area A).
This is so you don't go bankrupt trying
to find a loop.  Write down all of
these exchanges and do a 99XX scan of
those exchanges (99XX scanning will be
discussed shortly).

Before we get up to 99XX scanning, we
will look at some other loop info:

Loops are found pairs which are usually
close to each other.  For example, in
NPA 212, where the infamous loops are
found, there is a standard loop format:

Manhattan & Bronx-------NNX-9977/9979
Brooklyn & Queens-------NNX-9900/9906

NNX is the exchange to be scanned. Here
are some loops that have been found in
NYC.  These are used mostly by Phreaks
and call-in lines for pirate radio


The lower # is the tone side (singing
switch).  The higher # is always
silent.  The tone disappears on the
lower # when somebody dials in the
other side of the loop.  If you are on
the higher #, you'll have to listen to
the clicks to see if somebody
dialed-in.  The NYC 982 & 986 loops are
different from others. Usually when you
park on a loop, you will hear who ever
calls in on the other half.  When
they're done, the next caller (if any)
will be queued in, one after another.
On the NYC 982 & 986, you sometimes
can't get any more callers in after the
first. Furthermore, if you park one of
these loops and there is nobody on the
other end for more than 4 minutes, you
may be automatically disconnected.
These loops are good for back-up
purposes when all other loops are busy.

99XX Scanning:

Most every exchange in the Bell System
has a wide variety of test #'s and
other "goodies," such as loops.

These "goodies" are usually found
between 9900 and 9999 in your local
exchange.  If you have the time and
initiative, scan your exchange and you
may become lucky!

Here are my findings in the 914-268:

9901 - Verification (recording of a/c
       and exchange)
9936 - Voice # to the Telco CO
9937 - Voice # to the Telco CO
9941 - Carrier
9960 - Osc. Tone (tone side loop)
9963 - Tone (stops:  muted)
9966 - Carrier
9968 - Tone that disappears--responds
       to certain touch-tone keys

Most of the #'s between 9900 & 9999
will ring, be busy, go to a special
intercept operator ("what #, please?")
, or will go to a "the # you have
reached..." recording.  What you find
depends upon the switching equipment in
the exchange and the Telco operating

When searching for loops, you may find
one of the following possibilities when
you find one:

1.  You can hear through the loop (not
    muted), but there is a 1/2 second
    click every 10 seconds that
    interrupts the audio.  This type is
    good for back-up use but the %$#'&"
    click is super annoying.

2.  One side of the loop is busy; try
    it again later.

3.  The tone disappears, but you cannot
    hear through it (the loox is muted,
    try again in a month or so)

4.  You get "The # you have reached
    recording."  No loop there!

Most loops are muted (#3), but their
status does changes from time-to-time.
It all depends if the Telco maintenance
personnel remember to "throw the
switch", ie, turn off the loop.

Since I have done the above 914-268
99XX scan, Congers (268) has installed
new switching equipment (DMS100).  Some
of the numbers are the same, but I have
noticed that on the DMS100, the
recordings are also stored in this
area.  268-9903, 9906, 9909, & 9912 are
all different recordings.  Also, there
are 2 fortress fone recordings at 268-
9911 (deposit 5 cents or else) and 268-
9913 (deposit 10 cents).  None of these
recordings supe and alot of other 99XX
#'s don't supe either.
In some areas (like MD), 9906-7 is
ringback.  In Washington, there is a
sweep tone test at (202) 560-9944.  In
NYC (212), you'll find the infamous
loop lines (as mentioned above).
It will be easier to scan your exchange
if you make up a chart like the one
           NPA-NNX-99XX SCAN
!99X X>:0 :1 :2 :3 :4 :5 :6 :7 :8 :9 !
!990   :  :  :  :  :  :  :  :  :  :  !
!991   :  :  :  :  :  :  :  :  :  :  !
!992   :  :  :  :  :  :  :  :  :  :  !
!993   :  :  :  :  :  :  :  :  :  :  !
!994   :  :  :  :  :  :  :  :  :  :  !
!995   :  :  :  :  :  :  :  :  :  :  !
!996   :  :  :  :  :  :  :  :  :  :  !
!997   :  :  :  :  :  :  :  :  :  :  !
!998   :  :  :  :  :  :  :  :  :  :  !
!999   :  :  :  :  :  :  :  :  :  :  !
This leaves you with 100 boxes (1 for
each # between 9900 & 9999).  You
should make your boxes big enough so
you can write some sort of shorthand in
them.  For example:
B - busy   (try again at another time)
R - rings  (try again at ankther time)
O - intercept operator ("what # you
R1- recording 1 (make a margin note of
    the types of reordings you get)
T - tone   } tone at a lower # + ignore
I - ignore } at a higher # = loop
V - voice # to Telco CO - they usually
    answer with the city name or area.
C - carrier
There will be others and you should
use other characters that you can
Now, back to loops!  As you may have
noticed in my 914-268 scan, I found a
muted loop and a tone side.  914-268
failed to come up with the silent side
of a loop!  Therefore, there is no loop
in that exchange.  I then scanned
another exchange in my primary calling
area (914-634) and I found a loop!!
   0(914) 634-9923/9924
So, if at first you don't succeed, move
onto another exchange.
If you use the box method that I have
outlined above, you will see a T & I
next to each other for a loop.
Some exchanges are special.  For
example, 914-623 is a testing bureau.
In this exchange, not only did I find a
loop, but I also found several
interesting tones, noises, and other
test functions. Also, the more
important the exchange is, the more you
will find. For example, in 914-623, I
found well over 10 voice #'s!
Also, loops are usually, but not
exclusively, found in the 99XX series.
For example:
    (713) 324-1799/1499
is a loop.
The perfect loop?  Here is what I would
look for:
 1.  Non-sup on one or both sides.  To
     check for a non-sup loop, go to a
     tone-first fortress fone and dial
     the #.  If it asks for a dime, it
     is supervised.  If the call goes
     through, then it is non-suped!
 2.  800 loops would be a plus.  They
     are not necessarily found between
     9900 & 9999 though.  I would check
     the 1XXX series first.
 3.  Multi-user loops are also a plus
     for those late night conferences.
Finally, remember it is only a local
call to find out what you CO has in
store for you.  If you find anything
interesting, be sure to drop me a line.
NOTE:  Your local white pages can be a
       valuable asset.  You can also
       order other fone books from your
       business office (usually free
       for books within your operating
       company's district).  A large
       fone book, such as Manhattan,
       contains much more info in the
       first few pages than other
Automatic Number Identification (ANI),
is a number that you call up that will
tell you what # you are calling from.
This has a few uses.  First, were you
ever somewhere and the fone didn't have
a # printed on it?  Or perhaps you were
fooling around in some cans (those
large boxes on fone poles that contain
terminals for lineman use--to be
discusses in a future chapter.) and you
want to know what what the line # is.
In NPA 914, the ANI is 990.  In NPA's
212 & 516, ANI is 958.  This varies
from area to area.
Here are some other ANI's that I have
1-XXX-1111  (in some 914 areas, esp.
            under step-by-step
            switching equipment, you
            have to dial 1-990-1111)
To find ANI for other areas, check 3
digits #'s first, usually in the 9XX
series (excluding 911).  In areas under
step-by-step (to be discussed in the
next part), try 1-9XX-1111.
ANI may also be in 99XX.  Last resort,
try to get friendly with your neighbor
who works for the fone company.
Ringback, as its name implies, calls
back the # you are at when you dial the
ringback #.
Ringback, in NPA 914, is 660.  You dial
660+the last 4 digits of the fone.  You
will then get a tone, hang-up quickly
and pick-up in about 2 seconds.  You
will then get a second tone, hang-up
again and the fone will ring.
In NYC, it is also 660, but you may
have to press 6 or 7 before you hang up
for the first time (ie, at the first
Other ringback #'s that I have seen
26011 - This 5 digit format is used
        primarily on step-by-step.
        The last 2 digits (11) are
        dummy digits.
890-897-XXXX - XXXX are the last 4
               digits of the fone #.
119911/11911/1199911 - GTE
NNX-9906/9907 - NPA 301, NNX is the
The reason you get the tone when you
pick-up after it rings is because in
some areas, people were using ringback
as an in-house intercom.  They would
dial ringback, and when it stopped
ringing, they would pick-up & talk with
the person who picked up the other
extension.  Bell didn't like this since
there is usually only 1 piece of
equipment in each exchange that does
the ringback.  When people used this as
an intercom, linemen & repairmen
couln't get through!  In some areas,
especially those under step-by-step,
ringback can still be used as an
intercom.  Also, under step-by-step,
the ringback procedure it usually
simple.  For example, in one area you
would dial 26011 and hang-up; it would
then ringback.
Touch-Tone Test:
In areas that have a Touch-Tone test,
you dial the ringback #.  At the first
tone, you touch-tone digits 1-0.  If
they are correct it will beep twice.
I have also seen a TT test in some
areas at:  890-751-5191
Coming Soon:
In the ne

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH