___.___ _______ _______ . _____ _______ _,___ _ . _______ _______ _____ __ \\ | // \\---// \\ // ^ \\__/_ \\---// (_____/ ^ \\____/ \\___// (____// The Analogue T.X.E Switch - a Debriefing ^ iNFERNO/MED T.X.E stands for Telephone eXchange Electronic, it is a vast step down from it`s bigger (but younger) brother, the T.X.D (Sys X, AXE10, etc..). Its call processes are all handled electronically, yet it is an analogue exchange (the wave form that carries the speech and data signals is not converted into digital format). Due to its inherent lack of digital quality, the lines can get bad quality, high speed fax cannot be used and high speed modems have problems. They cannot support ISDN facilites, or, in most cases, star services. Tracing operations are not fully robust here, but that does not imply the common delusion that you cannot be traced from a TXE, you can. The TXE switch breaks down into several formats: TXE - Telephone eXchange Electronic TXE2 - Telephone eXchange Electronic (v2) TXE4 - Telephone eXchange Electronic (v4) TXE4A - TXE4, cost-reduced. TXEE - Telephone eXchange Electronic Enhanced. Electronic exchanges may be upgraded to offer the sort of facilites that Digital exchanges have, such as star services, but these are not inherent facilites and will not be operative in all TXE areas. The TXE is dying, and rapidly. Even as we speak (or read?!) the TXE switches are being replaced by the new TXD switches (so stand up, vote for, and support your local TXE! :)), something BT should have done a long time ago. Having said all this, most would be surprised that one of my favorite types of switch is the TXE. This is because it is fairly phreak/hacker friendly. For a start, BT claim that their digital exchanges are paperless (bullshit i know, but more so than TXEs), this sort of misfortune does not pay off on trash visits (or however far you choose to go into your local TXD). TXEs produced enough paper to be a threat to nature conservation.. most of this comes in the form of DWI printouts (Display Work Intructions) - which list an engineers jobs for the day, or software reports.. if you`ve trashed many TXEs, you should be able to recognise the software reports instantly, they normally go something like this.. SOFTWARE REPORT (x) ALIGNER NNI (yeh rite) xx/xx xx:xx:xx SOURCE CCFxB STATUS CATEGORY 013 ALARM NO ALARM SYMPTOM ID 328 IDR from SHC timed out - overload/terminal congestion message 00 00 04 12 FF FF EF 23 00 04 05 02 04 07 03 03 01 EE EE EE EE EE EE EE EE EE END DATA FOR SYMPTOM 328 00 00 04 12 FF FF EF 23 00 04 05 02 04 07 03 03 01 EE EE EE EE EE EE EE EE EE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00.. The above sequence is an example of what might happen if a TXE4 was to experience a flood of incoming C7 calls (CCITT7) as a result of, for example, a radio phone-in. Another type of printout may be the DN printouts, these are possibly the best print you will ever find.. if you get a full set, it will list every single DN, xxx 0000 - xxx 9999 in your exchange, along with any other prefixes the exchange manages. Various numbers may have comments next to them (some printouts only contain numbers with these comments), these range from misc crap to BT dial-in ports for that exchange. The types of dial-in you may find range quite a lot, but one you will probably find in any printout from a TE is the number for its EBP (exchange based processor) or, if you're lucky, CSP (Central Site Procsessor). The EBP & CSP - These are both run off a DRS300 level 70 Microcomputer which runs UNIX, they are the brains of the electronic switch and contain all sorts of crap, including customer infomation. Together they are known as the CMA - Coordinated Management Approach. In normal circumstances, the CSP is expected to look after around thirty EBPs. The processors communicate on an X.25 network. CMA works in conjunction with equiptment from other sources: o The ECTE interface unit : The interface retained from the superseeded ECTE (Exchange Computer Terminal Equiptment) system houses the Meter & Alarm Interface Unit (MAIU) and the modems used for communication over the Public Switched Telephone Network and the X.25 network. o Gateway : The gateway system consists of two types of unit: the Gateway G and the Gateway ARU (Alarm Reporting Unit) at the central site. The alarm relays at the exchange can be connected to alarm leads on the Gateway G unit. Any lead detecting an alarm will cause the Gateway G to send this over the PSTN to the central site, each Gateway G consists of up to 128 alarm leads. The signals coming in or going out of the central site over the PSTN are handled by the Gateway ARU. The alarms can them be monitored by the CSP. o ARAB : The ARAB (Alarm Reset And Busy) system is used to place MCUs (Main Control Units) and Markers OOS (out of service), or busied whilst other equipment in the exchange can reset. ARAB can control up to 130 reset relays and 70 busy relays. In conjunction with the Gateway system, ARAB is used to reset, busy and unbusy equipment under control of the central site. Four gateway ARUs are used at the CS, two for receiving Gateway G alarms (nominated as Incoming ARUS) and the other two for PSTN communications with the ARAB units (nominated as outgoing ARUs). o SADIE : SADIE (Subscriber Automatic Disconnect Equipment) is used on TXE4RD (TXE4 Rectory Design Exchange) to place subscribers Temporarlily Out Of Service (TOS) and to restore them. It resides in and receives commands from ARAB. (which, is accessed via PSTN..) CMA maintains a database of exchange performance, and history, updates subscribers lines, etc... The DRS300 consists of, an A4 Processor Module, a D9 Disk Module, an S1 Tape Streamer and a K3 Power module. An X.25 modem is used by the DRS to communicate with other processors on the CMA system via PSN (packet-switched network) and an autodialling modem allows communication over the PSTN. The EBP features a Newbury 8000 terminal emulation allowing the user to log on to a remote ECTE system from an EBP workstation. The connection is made over the PSTN, the system also allows connection to other systems on the PSTN. Being a UNIX, all logon attempts are recorded, and some programs carried out from within the system will require extra passwords to be entered. The sysadm will have full access to the Shell and can enable a Shutdown command from the logon prompt the will shutdown the processor to run level 0. Once inside it is possible to jump to other EBPs on the network, via option 81 on its COMFORTE (COMputers FOR Telephone Exchanges) menu system. You may also find numbers for communications with other parts of the TXE, such as the 4-Tel modules (i have one such data number), or, in special cases, remote meter reading or electronic monitoring, but the two latter are normally only available on ATEs (Automatic Telephone Exchanges), that may remain unmanned for some period (i suggest you go for some of these, they DO exist and I cannot stress their usefulness enough!!).. another system goes by the name of MIRACLE which is used for Call Logging Purposes. This too, is accessed via PSTN and only requires a single password to gain entry (the default is `MIRACLE'!!).. logging on is as follows: BRITISH TELECOM BIRMINGHAM PLEASE ENTER PASSWORD>xxxxxx PRESS `Q' TO ABANDON A FUNCTION AT ANY TIME. RESPONDING TO A MULTIPLE CHOICE WITH `?' WILL LIST ALTERNATIVES. SYSTEM WAS LAST CALLED AT... 10:56:24 (GMT) ON THURDAY DECEMBER 30TH SYSTEM CLOCK NOW READS ... 09:43:12 (GMT) ON FRIDAY DECEMBER 31TH. MEMORY STATUS : MAXIMUM CAPACITY __ 8191 : ENTRIES IN MEMORY __ 290 : PERCENTAGE USED __ 3 SELECT REQUIRED FUNCTION>V GIVE INITAL EXCHANGE METER READING. OR JUST PRESS RETURN TO AVOID COMPARISON. ? GIVE START DATE IN FORM DD/MM OR `_' TO LIST FROM START ?05/06 GIVE LAST DATE IN FORM DD/MM OR `_' TO LIST UNTIL END OF FILE ?09/06 DATE RANGE COMPLETELY OUTPUT FROM (05/06 TO 09/06) METERING TOTAL: 100 METER UNITS, COSTING 4.5 PENCE EACH TOTALLING. 4 POUNDS 50 PENCE. PRESS RETURN TO CONTINUE? SELECT REQUIRED FUNCTION>P GIVE INITAL EXCHANGE METER READING. OR JUST PRESS RETURN TO AVOID COMPARISON. ? GIVE START DATE IN FORM DD/MM OR `_' TO LIST FROM START ?05/06 GIVE LAST DATE IN FORM DD/MM OR `_' TO LIST UNTIL END OF FILE ?09/06 LISTING FROM 05/06 TO 06/06 BIRMINGHAM xxxxxxx 5TH JUNE START DIALLED METER CALL ANS FINISH COST/ TIME DATE/MTH DIGITS PULSES 1ST M/P TIME DURATION PENCE ---------------------------------------------------------------------------- 15:03:49 05/06 6442371 0005 15:03:57 15:15:32 000:11:55 22 15:06:22 05/06 INCOMING 0000 15:06:29 15:11:57 000:05:18 19:06:12 05/06 5542399 0002 19:06:36 19:09:42 000:03:06 9 TOTAL COST FOR ONE DAY, 5TH JUNE = 31 PENCE 09:23:54 06/06 2334157 0001 09:24:16 09:25:42 000:01:26 4 20:32:52 06/06 INCOMING 0000 20:33:12 000:03:06 9 TOTAL COST FOR ONE DAY, 6TH JUNE = 4 PENCE SELECT REQUIRED FUNCTION>9 SESSION COMPLETED ... GOODBYE I think you get the picture, it's also possible to choose lines to be monitored etc.. I expect this is the system BT use on TXEs to catch people carding and PBXing as it records EVERY number you dial. Check this, Live Monitor Facility... FUNCTION 4 ... LIVE MONITOR ENTER PORT IDENTIFICATION LETTER>A MONITOR ACTIVE ... BIRMINGHAM xxxxxxx 15:03:32 *LINE IS FREE* 15:03:49 SEIZED OUTGOING 15:03:55 DIGIT 1 15:03:57 DIGIT 2 15:03:59 DIGIT 3 15:04:09 METER PULSE 15:06:32 LINE CLEAR (the port is simply a database reference of numbers to act on).. this is also available as infomation recovery so BT can do it whilst they're not there. (it records all the shit), also, as you can see, it records the line status, seized etc.. I mentioned previously ISDN problems, here is a quick insight into them: In the early stages of TXE4 introduction into the digital network ISDN customers were trying to make data calls to TXE4 customers. TXE4s do not support ISDN functions and the calls resulted in the generation of error symptoms. If an ISDN call is recieved by a TXE, the Calling Path Indicator contained in the C7 Address Message will have a value of 01. This indicates that the calling customer requires a full 64KBit path which the TXE cannot supply. This generates an error message, service not available. BT introduced the Group 4 Fax Machine a while ago. It attempts to send a call requiring a 64Kbit path, i.e CPI=01. It then reattempts the call on the above received error message.. this means it continually reattempts the call when the message is given.. the problem was fixed to allow the correct message to be sent back so the fax could try again at a lower speed. If a TXE subscriber moves to a TXD they can have an overlay option, where they keep their existing telephone number, but still have all the benefits of a TXD exchange.. all his local calls however, are still handled as if he were still in the TXE area, the same stands for ISDN calls. The general tone of this phile is go and trash your local TXE, because the sort of things you may find could be really useful, and if you can - go in! (heh, more about that later..) Actual numbers may also be released at a later date... iNFERNO, 06/01/96