456 lines
14 KiB
Plaintext
456 lines
14 KiB
Plaintext
==Phrack Magazine==
|
|
|
|
Volume Four, Issue Forty-Four, File 13 of 27
|
|
|
|
****************************************************************************
|
|
|
|
METRO P/H Presents
|
|
|
|
Northern Telecom's
|
|
FMT-150B/C/D
|
|
|
|
Optical Fiber Digital Transmission System
|
|
|
|
|
|
|
|
Intro
|
|
|
|
|
|
This file will cover the FMT-150, the equipment that sends info over
|
|
the digital trunks using lasers. It is an accompaniment to our guide
|
|
to remotes (COs). I will cover all the interesting and useful stuff.
|
|
This file is mostly for SERIOUS phreaks, we'll have more non-technical
|
|
cool stuff coming up.
|
|
|
|
|
|
|
|
System Description
|
|
|
|
|
|
The FMT-150 fiber optic transmission system combines DM-13
|
|
multiplexers and 150 Mb/s Fiber Transports in compact shelf
|
|
packages, I will refer to it as a shelf. The FMT-150 product
|
|
architecture supports subscriber loop and interoffice link
|
|
applications using hub, drop/insert, repeater and terminal
|
|
configurations. The following is what a FMT-150 shelf system
|
|
consists of.
|
|
|
|
|
|
|
|
FMT-150B 1 DM-13 multiplexer (multiplexes 3 signals
|
|
into one signal of 44.736 Mb/s.)
|
|
1 150 Mb/s fiber interface
|
|
1 maintenance control unit
|
|
1 service channel unit (optional)
|
|
2 (or 4) power supply units
|
|
|
|
FMT-150C 2 DM-13 multiplexers
|
|
2 (or 4) power supply units
|
|
|
|
FMT-150D 2 150 Mb/s fiber interfaces
|
|
2 service channel units (both optional)
|
|
2 maintenance control units
|
|
2 (or 4) power supply units
|
|
|
|
|
|
|
|
Maintenance
|
|
|
|
|
|
Service Channel Unit
|
|
|
|
Order-wire Facility
|
|
|
|
Two voice channels per DS-3 signal are provided for individual
|
|
addressing using DIP switches on the SCU. Dial over a 4 wire
|
|
headset/handset. (more in Order-Wire)
|
|
|
|
Interfaces
|
|
|
|
The CRT (good old Cathode Ray Tube) Interface is an important
|
|
system feature of the Maintenance Control Unit (MCU). You can
|
|
plug in to a RS-232 port directly (use a null-modem cable) on the
|
|
"shelf" or remotely via a modem (!). Also a Tandy 200 can be
|
|
interfaced with the Maintenance Control Unit. The network
|
|
configuration, the status of each node, and any alarm existing
|
|
can be viewed on the terminal. The interface goes from 300 to
|
|
9600 baud. The software already present on the MCU is all that
|
|
is needed, the interface need only support certain emulations
|
|
(see Operation Procedures.) (hmmm... Could Radio Shack and
|
|
Northern Telecom be butt buddies?) Also available is a
|
|
RS-422 interface which provides a large number of alarm status
|
|
and control points through the MCU. The port is labeled
|
|
"Customer E2A" on the shelf. CAMMS is an extended feature
|
|
of the FMT-150. It stands for Central Access Maintenance and
|
|
Monitoring System which can also take advantage of the
|
|
Maintenance features (see Operation Procedures). All this is,
|
|
is a mini-terminal, that can be installed and act like a CRT
|
|
interface.
|
|
|
|
|
|
Specifications
|
|
|
|
When interfacing the CRT with a null modem cable, your cable
|
|
should fit the diagram below.
|
|
|
|
Ŀ Ŀ
|
|
1 OO 1
|
|
2 OO 3
|
|
3 OO 2
|
|
4 OO 8
|
|
5 O O 20
|
|
6 O O 7
|
|
7 O O 4
|
|
8 OO 5
|
|
20 OO 6
|
|
|
|
|
|
Pin Definitions
|
|
1. Ground 6. Data Set Ready
|
|
2. Transmit Data 7. Ground
|
|
3. Receive Data 8. Data Carrier Detect
|
|
4. Request to Send 9. Data Terminal Ready
|
|
5. Clear to Send
|
|
|
|
|
|
|
|
When interfacing your Hayes compatible (telephone connection)
|
|
configure the DIP switches in this manner.
|
|
|
|
X=empty space O X O X X O X O
|
|
O=the switch's position X O X O O X O X
|
|
1 2 3 4 5 6 7 8
|
|
|
|
|
|
|
|
Alarms and Buttons
|
|
|
|
|
|
Listed below are some LED descriptions and button meanings that a
|
|
phreak will find on the shelf.
|
|
|
|
LEDs Description
|
|
-----------------------------------------------------------------
|
|
|
|
MAJOR RED - Service affecting failure
|
|
(run, they'll be there soon!)
|
|
MINOR YELLOW - Non-service affecting
|
|
failure.
|
|
FUSE ALARM RED - A fuse blew
|
|
REM YELLOW - An alarm has occurred at
|
|
a remote site.
|
|
Order-wire Left GREEN - Solid, Left order wire is
|
|
active, if flashing, incoming
|
|
call on left.
|
|
Order-wire Right Same as above, but for Right
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
BUTTONS Description
|
|
_________________________________________________________________
|
|
|
|
LP TEST Lights up all LEDs
|
|
ACO Turns off existing audible alarm
|
|
LOC 1, 2, 3 (OW) Rings every site common to STX
|
|
signal 1, 2, and 3
|
|
EXP 1, 2, 3 (OW) Same as above
|
|
-----------------------------------------------------------------
|
|
|
|
Power Supply Unit
|
|
|
|
This is a seemingly 5V output power supply, which has a simple
|
|
ON/OFF switch which is housed under a protective latch, pull this
|
|
and have an instant phreak marathon (see REDUNDANCY at end of
|
|
file.)
|
|
|
|
|
|
|
|
Equipment Configuration
|
|
|
|
|
|
The FMT-150 system is suitable for a wide variety of
|
|
applications, as follows:
|
|
|
|
* Access Networks
|
|
CO to Customer Serving Areas
|
|
CO to Digital Loop Carrier
|
|
CO to Switch Remote
|
|
CO to Customer Premises.
|
|
* Inter-Office Trunk routes
|
|
* Broadband Applications such as Video
|
|
* Entrance Links to Radio Systems
|
|
* Dynamic Network Routing
|
|
* Stand-Alone Multiplexer Applications with Radio
|
|
* Route Diversity
|
|
* Wide Area Network (WAN) Application
|
|
|
|
|
|
Order-Wire
|
|
|
|
|
|
Order Wire
|
|
|
|
A buzzer is heard and a flashing LED is seen if a call is
|
|
coming in, plug in a handset/headset connector into the jack on
|
|
the shelf. To terminate the call pull the plug out or hit #. To
|
|
dial, just plug in and dial four digits, wildcards are also
|
|
allowed by use of the * key. The handset described is a
|
|
Contempra Handset (NT2E36AA). A test set could also be used but
|
|
the plug would have to be altered, its 4 wire, remember. Order Wire
|
|
is only CO-to-CO communication. The jack can be plugged into the
|
|
front of the FMT-150 shelf. The dialing format is described below.
|
|
|
|
|
|
-----------------------------------------------------------------
|
|
First digit: Indicates the type of call being made
|
|
|
|
Second, Third, and Indicated which site will be dialed.
|
|
Fourth digits Address of the site is set via rotary
|
|
switches located on the front edge of
|
|
the SCU module.
|
|
-----------------------------------------------------------------
|
|
|
|
|
|
First digit significance
|
|
|
|
1 = local call for STX ({Pseudo} Synchronous Transport Signal:
|
|
First Level at 49.92 Mb/s [NT]) signal 2
|
|
2 = local call for STX signal 2
|
|
3 = local call for STX signal 3
|
|
(where'd 4 go?)
|
|
5 = express call for STX signal 1
|
|
6 = express call for STX signal 2
|
|
7 = express call for STX signal 3
|
|
|
|
|
|
The three following digits are not standard, so if you want to
|
|
experiment with this hit a first digit and then three *'s
|
|
|
|
On the shelf there are buttons which act like speed dialing, the
|
|
first three letters stand for LOCal or EXPress and the number is
|
|
the signal, so EXP 2 would be broadcast call on STX signal 2,
|
|
express channel.
|
|
|
|
|
|
|
|
Installation
|
|
|
|
A typical FMT-150 Setup
|
|
Ŀ
|
|
Ground Bar
|
|
Ĵ
|
|
Fuse & Alarm Panel A
|
|
Ĵ |
|
|
FMT-150 Shelf |
|
|
Ĵ 7ft
|
|
FMT-150 Shelf |
|
|
Ĵ |
|
|
Fiber Splice/Storage Panel or CAMMS V
|
|
Ĵ <----25.94in---->
|
|
FMT-150 Shelf
|
|
Ĵ
|
|
FMT-150 Shelf
|
|
Ĵ
|
|
FMT-150 Shelf
|
|
Ĵ
|
|
FMT-150 Shelf
|
|
Ĵ
|
|
FMT-150 or Rectifier Shelf
|
|
Ĵ
|
|
FMT-150 or Standby Batt. Shelf
|
|
Ĵ
|
|
AC outlet Assy
|
|
|
|
|
|
|
|
|
|
Operation Procedures
|
|
|
|
|
|
Specifics on Interfacing
|
|
|
|
The RS-232 serial interface supports the following terminals.
|
|
|
|
* DEC VT 100
|
|
* DEC VT 102
|
|
* DEC VT 220
|
|
* DEC VT 320
|
|
* FALCO
|
|
* IBM 3162 with VT 220 cartridge
|
|
* Wyse WY85 with VT100 Emulation
|
|
* Ramodom VT200 portable terminal
|
|
* Televideo 922
|
|
* Televideo 9220
|
|
* Tandy 200 (only with Multipoint Plus MCU:NT7H90CA/XC)
|
|
* CAMMS (only with Multipoint Plus: NT7H90CA/XC/FA)
|
|
* Cybernex (in 8-bit mode only)
|
|
|
|
|
|
(Ok bros this is the part we are interested in so sit back)
|
|
|
|
Login Procedures
|
|
|
|
|
|
If you approach the FMT-150 shelf and have a previously described
|
|
interface, then you can login. Also if you are scanning (GTE
|
|
(Northern Telecom) areas only) and come across a "sitting system"
|
|
that displays a message (below) after hitting 3 returns, you are in!
|
|
|
|
1 - DEC VT100
|
|
2 - NT Meridian 6000
|
|
(Crosstalks or Procom with VT100
|
|
emulation)
|
|
3 - Tandy 200 (running Telecom)
|
|
F4- NTCAMMS MDU
|
|
Enter Terminal Type:
|
|
|
|
Choose your terminal type, usually 2 (use VT100) if you are calling in,
|
|
and it will prompt you with a "Login: " prompt, this is a trick, there
|
|
are no user levels, the "Login:" simply means enter the password, and
|
|
the default is to hit return, so always try that first. If a password
|
|
is installed then try something like FMT-150 or something that you would
|
|
think they would use. You should get a screen like this one after
|
|
choosing the terminal type:
|
|
|
|
|
|
FMT-150 Transmission System
|
|
|
|
Northern Telecom
|
|
|
|
|
|
|
|
|
|
|
|
Firmware Copyright Northern Telecom 1988
|
|
|
|
|
|
- - Node Id.: 123456789012345- - - - Last Update 87/03/06 11:07-
|
|
Login: (remember, enter a password here, no user levels!)
|
|
|
|
- - Syst Id.: 123456789012345- - - - Time: 87/03/06 11:07- - -
|
|
|
|
|
|
|
|
|
|
After Logging In
|
|
|
|
(commands are presented in an outline configuration, you should
|
|
be getting screens of output, but this outline will show you what
|
|
to input. # = number, not pound, <sp> = spacebar.)
|
|
|
|
Example: If I wanted to set the system's date to 1/4/1943 (heh)
|
|
then after logging in I would press, "c" then "d", then
|
|
"43", then "1" and finally "4".
|
|
|
|
|
|
-----------------------------------------------------------------
|
|
a Alarms (once again, lame stuff)
|
|
o Optical Tx/Rx unit-level alarm
|
|
screen.
|
|
t Translator module-level alarm
|
|
screen.
|
|
m DM-13 multiplexer-level alarm
|
|
screen.
|
|
c Common equipment-level and customer
|
|
input/output points alarm screen.
|
|
|
|
c Configuration (!)
|
|
a alarm logger
|
|
e enable alarm logger
|
|
d disable alarm logger
|
|
i
|
|
# <sp> "name" Name a customer input point
|
|
o
|
|
# <sp> "name" Name a customer output point
|
|
d
|
|
#1 <sp> #2 <sp> #3 <sp> Set date: #1 is year, #2 is month
|
|
#3 is day.
|
|
t
|
|
#1 <sp> #2 <sp> #3 <sp> Set time: #1 is hour, #2 is
|
|
minute.
|
|
p
|
|
"oldpass" "newpass" Change password from "oldpass" to
|
|
"newpass".
|
|
s
|
|
"system ID name" Name System ID
|
|
|
|
s Switching commands (extremely extensive,
|
|
so I will include a small portion)
|
|
# <sp>
|
|
m
|
|
# <sp>
|
|
<return> Display DM-13 Switch Screen
|
|
t
|
|
<return> Display translator/optics
|
|
switch status for node #.
|
|
<return> Display translator/optics switch
|
|
status for local node or node last
|
|
displayed.
|
|
m Maintenance Commands
|
|
r (see note)
|
|
* Reset all nodes
|
|
# <sp> Reset node #
|
|
t
|
|
# <sp>
|
|
o Operate test of customer
|
|
input/output points and E2A
|
|
ports.
|
|
r Release test of customer
|
|
input/output points and E2A
|
|
ports.
|
|
l Logout of the FMT-150 system.
|
|
|
|
n Network Status
|
|
<return> Display network status screen.
|
|
|
|
|
|
NOTE: After executing a local or global MCU reset, the message
|
|
"PROCESSOR CRASH" will appear on the bottom of the CRT's screen.
|
|
As a result, the user will have to log back into the system. In
|
|
addition, a global MCU reset will clear all "names" and
|
|
"settings" previously defined (that is, system ID, node, customer
|
|
inputs/outputs, time and date).
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
|
|
Many other commands are listed but they are extremely numerous
|
|
and useless to the average phreak.
|
|
|
|
If a "terminal" that is 4.4 inches tall with a center screen and
|
|
2 12 key keypads on either side is seen on the shelf, this will
|
|
be a CAMMS terminal, all functions above can be performed with
|
|
this unit, its menu driven.
|
|
|
|
|
|
Troubleshooting
|
|
|
|
|
|
This section is the manual is devoted to fixing problems in the
|
|
FMT-150, aimed at the average see-my-crack-of-the-ass telco
|
|
maintenance man.
|
|
|
|
Basically, if you see any red LEDs, inspect them and judge if you
|
|
should get the hell out of the CO or not, usually red LEDs mean
|
|
trouble.
|
|
|
|
|
|
REDUNDANCY
|
|
|
|
When doing anything of this nature to a fone company, you must
|
|
remember, they are not stupid, everything has something to
|
|
fall back on, if you were to cut a trunk line, there would be
|
|
another to take its place. Usually there will be only one
|
|
backup, so be meticulous and find both.
|
|
|
|
|
|
Outro
|
|
|
|
|
|
Hope this file was worth something to somebody, it applies mostly
|
|
to those in a GTE area, since GTE uses Northern Telecom equipment
|
|
and most everyone else uses AT&T stuff.
|
|
|
|
|
|
-FyberLyte 9-93
|