Bridging heads, residential and business multiline distribution
boxes,line and trunk splitters, and other Bell system wire
terminations.

   - How to use, and/or abuse them -

(including a tutorial on basic telephone eavesdropping techniques.)

**********************************************************************
            Agent     07/29/84
                    04
**********************************************************************
	In this article, I will first bescribe the termination, wiring,
and terminal hardware most commonly used in the Bell System, and I
will include a section on methods of using them.
**********************************************************************
-------------
Local Network
-------------

	The local telephone network between the central office/exchange
and the telephone subscribers can be breifly described as follows:

	From the central office (or local exchange) of a certain prefix
(es), underground area trunks go to each area that has that prefix.
(usually more than one prefix per area) at every few streets or tract
areas, the underground cables surface. they then go to the telephone
pole (or back underground, depending on the area) and then to the
subsribers house (or in the case of an apartment building or
mutliline business, to a splitter or distribution box/panel).

	Now that we have the basics, I'll try and go in-depth on the
subject.

------------------
Underground cables
------------------

	These are sometimes interoffice trunks, but usually in a resid-
ential area they are trunk lines that go to bridging heads or
distribution cases. the cables are about 2-3 inches thick (varies),
and are either in a metal or pvc-type pipe (or similar). Rarely
(maybe not in some remote rural areas) are the cables just 'alone' in
the ground. Instead, they are usually in an underground cement tunnel
(resembles a small sewer or stormdrain) . The manholes are >heavy<
and will say 'bell system' on them. They can be opened with a 1/2
inch wide crowbar (hook side) inserted in the top rectangular hole.
If you get it open, go inside!! There are ladder rungs to help you
climb down. You will see the cable pipes on the wall, with the blue
and white striped one being the interoffice trunk (at least in my
area).  The others are local lines, and are usually marked or color
coded. There is almost always a posted color code chart on the wall,
not to mention telco manuals describing the cables and terminals, so
I need not get into detail. Again: >if you can get into a bell
manhole, do it!, It will pay off <. Also, there is usually some kind
of test equipment, and often bell test sets are left in there. So get
your crowbars!

--------------
Bridging Heads 
--------------

	The innocent-looking grayish-green boxes. These can be either
trunk bridges or bridging for residences. The major trunk bridging
heads are usually larger, and they have the 'western electric' logo
at the bottom, whereas the normal bridging heads (which may be
different in some areas- depending on the company you are served by.
Gte b.h.'s look slightly different. Also, do not be fooled by
sprinkler boxes!) can be found in just about every city. To open a
bridging head:

	If it is locked (and you're feeling destructive), put a hammer
or crowbar (the same one you used on the manhole) in the slot above
the top hinge of the right door. Pull hard, and the door will rip
off. Very effective!  If it isn't locked (as usual), take a 7/16 inch
hex socket and with it, turn the bolt about 1/8 of a turn to the
right (you should hear a spring release inside). holding the bolt,
turn the handle all the way to the left and pull out.

	Now inside, first check for a test-set (which are often left by
bell employees). There should be a panel of terminals and wires. Push
the panel back about an inch or so, and rotate the top latch (round
with a flat section) downward. Release the panel and it will fall all
the way forward. There is usually a large amount of wire and extra
terminals.  The test-sets are often hidden here, so dont overlook it
(manuals, as well, are sometimes placed in the head). On the right
door is a metal box of alligator clips. Take a few (compliments of
bell...). On each door is a useful little round metal device. (Says
'insert gently' or 'clamp gently - do not overtighten' etc..) On the
front of the disc, you should find two terminals. These are for your
test set. (If you dont have one, dont depair - I'll show you ways to
make basic test sets later in this article).  Hooking the ring (-)
wire to the 'r' terminal; and the tip (+) wire to the other. (By the
way, an easy way to determine the correct polarity is with a 1.5v
led. Tap it to the term. pair, if i doesnt light, switch the poles
until it does. When it lights, find the longer of the two led poles.
This one will be on the tip wire (+)). Behind the disc is a coiled up
cord.  This should have two alligator clips on it..its very useful,
because you dont have to keep connecting and disconnecting the fone
(test set) itself, and the clips work [DATA ERROR DATA LOST] e
terminal pair , and you're set! Dial out if you want,or just listen
(if someone's on the line). Later, I'll show you a way to set up a
true 'tap' that you can set up, and will let the person dial out on
his line and receive calls as normal, and you can listen in the whole
time. More about this later...

	On major prefix-area bridging heads, you can see 'local loops',
which are two cable pairs (cable pair = ring+tip, a fone line) that
are directly connected to each other on the terminal board. These
'cheap loops' as they are called, do not work nearly as well as the
existing ones set up in the switching hardware at the exchange
office. (Try scanning your prefixes' 00xx or 99xx #'s. The tone sides
will announce themselves with the 1000 hz loop tone, and the hang
side will give no response. The first person should dial the 'hang'
side, and the other person dial the tone side, and the tone should
stop if you have got the right loop)

	If you want to find the number of the line that you're on, you
can either try to decipher the 'bridging log' (or whatever), which is
on the left door. if that doesnt work, you can use the follwing:

---
ANI # (Automatic Number Indentication)
---

	This is a telco test number that reports to you the number that
youre calling from (it's the same, choppy 'bell bitch' voice that you
get when you reach a disconnected #)
 
For the 213 NPA - dial 1223
        408 NPA - dial 760
        914 NPA - dial 990
 
	These are extremely useful when messing with any kind of line
terminals, house boxes, etc.

	Now that we have bridging heads wired, we can go on... (dont
forget to close and latch the box after..wouldnt want to get and
telco people mad, now, would we?)

***************************************

------
"CANS" - Telephone pole distribution
------           boxes

Basically, two types:
 
1> Large, rectangular silver box at the end of each street.
 
2> Black, round or rectangular thing at every telephone pole.
 
Type 1 -   This is the case that takes the underground cable from the
bridger and runs it to the telephone pole cable (the lowest, largest
wire on the telephone pole). The box is always on the pole nearest
the briging head, where the line comes up. Look for the 'call before
you dig - Underground cable' stickers..

	The case box is hinged, so if you want to climb the pole, you
can open it with no problems. These usually have 2 rows of terminal
sets. These are all the cable pairs for your street. (Its similar to
a miniature bridging head). Use/abuse it in the same manner as we did
before. (Note: all the active lines carry from 15 to 48 vdc, and even
90vac (when ringing), so be careful - It's not going to hurt you, but
it can surprise you (and if you're hanging by one hand from a
telepole, it >can< be harmful!))

	Oh, by the way, if you use ANI on every pair and you find one
that isnt in use on your street, you can hook it up for yourself
(almost).  Also, you have to be able to impersonate a telco
technician and report the number as 'new active' (giving a fake name
and fake report, etc) I dont recommend this and it probably wont
(almost positively wont) work, but this is basically what telco
linemen do).
 
Type 2 - This is the splitter box for the group of houses around the
pole. (usually 4 or 5 houses). Use it like i mentioned before. The
terminals (8 or so) will be in 2 horizontal rows of sets. The extra
wires that are just 'hanging there' are provisions for extra lines to
residences (1 extra line per house, thats why the insane charge for
line #3!) If its the box for your house also, have fun and swap lines
with your neighbor! 'piggyback' them and wreak havoc on the neighborh
ood (it's eavesdropping time...) again, I dont recommend this, and
its difficult to do it correctly.

Moving right along..
***************************************

------------------------------
Apartment / Business Multiline
 Distribution Boxes
----------------------------

	Found outside the buliding (most often on the right side, but
not always..just follow the wire from the telephone pole) or in the
basement.  It has the terminals for all the lines in the building.
Use it just like any other termination box as before. Usually says
'bell system' or similar.  Has up to 20 terminals on it (usually) the
middle ones are grounds (forget these). The wires come from the cable
to one row (usually the left one) , with the other row of terminals
for the building fone wire pairs. The ring (-) wire is usually the
top terminal if the set in the row (1 of 10 or more), and the tip is
in the clampscrew below it. This can be reversed, but the cable pair
is always terminated one-on-top-of-each-other, not on the one next to
it. (Im not sure why the other one is there, probably as a provision
for extra lines) dont use it though, it is usually to close to the
other terminals, and in my experiences you get a noisy connection.
 
	Final note: Almost every apartment, business, hotel, or anywhere
there is more than 2 lines this termination method is used. If you
can master this type, you can be in control of many things... Look
around in your area for a building that uses this type, and practice
hooking up to the line, etc.
 
	As an added help, here is the basic 'standard' color-code for
multiline terminals/wiring/etc...
 
Single line:    red = ring
              green = tip
             yellow = ground (connected to l1 ringer coil in individual and
                      bridged ringer phones (bell only)) usually connected
                      to the green (tip)
 
Ring (-) = red
           white/red stripe
           brown
           white/orange stripe
           black/yellow stripe
Tip (+)  = green (sometimes yellow, see above ^)
           white/green stripe
           white/blue stripe
           blue
           black/white stripe
Ground   = black
           yellow
***************************************

----------------------
Residence terminal box
----------------------

	Small, gray (can be either a rubber (pacific telephone) or hard
plastic (at & t) housing) deal that connects the cable pair from the
splitter box (see type 2, above) on the pole to your house wiring.
Only 2 (or 4, the 2 top terminals are hooked in parallel with the
same line) terminals , and is very easy to use. This can be used to
add more lines to your house or add an external line outside the
house.

***************************************

	Well, now you can consider yourself a minor expert on the
terminals and wiring of the local telephone network. Now you can
apply it to whatever you want to do.. heres another helpful item--
How to make a basic test-set and how to use it to dial out, eavsdrop,
or seriously tap and record line activity.
 
---------
TEST-SETS
---------
 
	These are the (usually) orange hand set fones used by telco
technicians to test lines. To make a very simple one, take any bell
(or other, but i recom- mend a good bell fone like a princess or a
trimline. GTE flip fones work excellently, though..) Fone and cut off
all the wires (including the modular jack , if any) except the red
(ring - ) and the green (tip +). If they arent color-coded, they are
usually the inner most two in the 4 con ductor cable (the fone cord).
Put alligator clips on it and use it as described earlier. This will
enable you to dial out and listen, but no extra abilities.( You are
in effect just an extension of their line).

	If you want to get more technical, or you just want to listen
without being heard (or detected in any normal way) you can use one
of the following test-set/tap fone designs, or make your own.

Test Set Version # 1
---------------- - -

	A 'black box' type fone mod will let you tap into their line,
and with the box on, it's as if youwerent there. They can recieve
calls and dial out, and you can be listening the whole time! very
useful. With the box off, you have a normal fone test set.

 Instructions:

	Basic black box. Works well with good results. Take the cover
off the fone to expose the network box (bell type fones only). The
<rr> terminal should have a green wire going to it (orange or
different if touch tone - doesnt matter, its the same thing).
Disconnect the wire and connect it to one pole of an spst switch.
Connect a piece of wire to the other pole of the switch and connect
it to the <rr> terminal. Now take a 10k ohm 1/2 watt 10% resistor and
put it between the <rr> terminal and the <f> terminal, which should
have a blue and a white wire going to it (different for touch tone).
It should look like this:
 

-----BLUE WIRE-----<F>
---WHITE WIRE-----/ !
                    !
               10K RESISTOR
                    !
--GREEN WIRE-     -<RR>
             !    !
             !    !
              SPST
 
	What this does in effect is keep the hookswitch / dial pulse
switch ( f to rr loop) open while holding the line high with the
resistor. This gives the same voltage effect as if the fone was
'on-hook', while the 10k ohms holds the voltage right above the 'off
hook' threshold (around 22 volts or so, as compared to 15-17 for
normal off hook, 48 volts for normal 'on-hook'), giving the best line
volume and signal strength attainable without an external amplifier.

Test-set version # 2
---------------- - -

	Another design (which I use on a GTE flip phone II with good
res- ults), is similar to the 'type 1' test set (above), but has some
added features:
 
FROM >-----------------TIP---<TO TEST
ALLIGATOR                     SET
CLIP >------ ----------RING--<PHONE 
            !              !
            X              ^
            !             ! !
            O             < !
            !             > !
            !             > !
            !             ! !
            !    X--------- !
            !    X          !
            !----X          !
                 X----0-----!
X= SPST SWITCH
O= RED LED            0=GREEN LED
\/\/\=1.8K 1/2 WATT   XXXX= DPST SWITCH
        RESISTOR
 
	When the spst switch in on, the led will light, and the fone
will become active. The green light should be on. If it isn't, switch
the dpst. If it still isnt, check the polarity of the line and the
leds. With both lights on, hang up the fone. They should all be off
now. Now flip the dpst and pick up the fone. The red should be on,
but the green shouldn't. If it is, something is wrong with the
circuit. You wont get a dial tone if all is correct.

	When you hook up to the line with the alligator clips (assuming
you have put this circuit inside your fone and have put alligator
clips on the ring and tip wires (as we did before)) you should have
the spst #1 in the off posistion. This will greaty reduce the static
noise involved in hooking up to a line. the red led can also be used
to check if you have the correct polarity.

	With this fone you will have the ability to listen in on >all<
audible line activity, and the people (the 'eavesdropees') can use
their fone as normal.

	Note that test sets #1 and #2 have true 'black boxes', and can
be used for free calls (see an article about black boxes).
 
Test Set version # 3
---------------- - -

        (Courtesy of> Lex Luthor <, Sysop of Plover Net)

	Using a trimline (or similar) phone, remove the base and cut all
of the wire leads off except for the red (ring -) and the green (tip
+).  Solder alligator clips to the lugs. The wire itself is 'tinsel'
wrapped on rayon, and doesnt solder well. Inside the fone handset,
remove the night light socket (if it has one) and install a small
slide or toggle switch (radio shack's microminiature spst works
well). Locate the connection of the ring and the tip wires on the pc
board near where the jack is located at the bottom of the handset.
(The wires are sometimes black or brown Instead of red and green,
respectively). Cut the foil and run 2 pieces of wire to your switch.
In parallel with the switch add a .25 mf 200 vdc capacitor (mylar,
silvered mica, ceramic, not an electrolytic). When the switch is
closed, the handset functions normally. With the switch in the other
position, you can listen with out being heard.  (I would, once again,
like to give credit to lex luthor for this simple and effective
design).
 
NOTE: To reduce the noise involved in connecting the clips to a line,
add a switch selectable 1000 ohm 1/2 watt resistor in series with the
tip wire.  Flip it in circuit when connecting, and once on the line,
flip it off again. (Or just use the 'line disconect' type switch as
in the type 2 test set (above)). Also avoid touching the alligator
clips to any metal parts or other terminals, for it causes static on
the line and raises poeple's suspicions.

Recording
---------
 
	If you would like to record any activity, use test set 1 or 2
above (for unattended recording of >all< line activity), or just any
test set if you are going to be there to monitor when they are
dialing, talking, etc. Place a telephone pickup coil (I recommend the
recoton t-5 tp coil or equivalent) onto the test set, and put the tp
plug into the mic. Jack of any standard tape recorder. Hit play, rec,
and pause. Alternate pause when you want to record (I dont think
anyone should have any difficulty with this at all...)
 
**************************************
 
	Well, if you still cant make a test set or you dont have the
parts, there's still hope. Alternate methods:
        
1> Find a bell test set in a manhole or a bridging head and
   'borrow it indefinately'...
 
2> According to Sir Francis Drake, Test sets can be purchased from:

     Techni-Tool
    5 APOLLO ROAD
       BOX 368
   Plymouth Meeting
      PA., 19462
 
  ASK FOR CATALOG #28
 
	They are usually $300 - $600, and are supposed to have mf
dialing capability as well as tt dialing. They are also of much
higher quality than the standard bell test sets.

***************************************

	If you would like to learn more about the subjects covered here,
I suggest:

1> Follow bell trucks and linemen or technicians and ask subtle quest-
   ions. Also try 611 (repair service) and ask questions.

2> Explore your area for any bell hardware, and experiment with it.
   Dont try something if you are not sure what youre doing, because you
   wouldnt want to cause problems, Would you?
 
	I hope the article was informative. Be looking for 'Invading the
Bell System - Part II'

***************************************
WRITTEN BY:
              PHUCKED
        ***     AGENT    ***
                   04
07-29-84
           A.K.A.
                   PHREAK ADVISOR
> THE                C.O.R.E. DELTA
> SPINOFF MASTER      PVPC INNER CORE
***************************************
