Guide To Identifying North American Telephone Switches- A Friend Wrote this

[Hill Haven Telephone Company]

A friend put this together.  Thought everyone would enjoy it

The Super Happy ThoughtPhreaker Guide to Identifying North American Phone Switches! [don't laugh! It's a working title! xD]

Whether you're just bored and looking for some trivia, want to learn how to identify a switch from a mile away, or just want to obsess and compulse over tiny details, get comfortable! One of the things that makes phreaking way more fun is being able to know exactly what equipment you're hitting, and this textfile is stuffed to the brim with plenty of crap to let you do just that. So, er, enjoy!

****************************************
A note about the numbers that just ring:
****************************************

One of the best kept, hiding in plain view secrets of the modern phone switch is that no two models types ring alike. The difference is pretty simple; when the ring is generated, something (probably a DSP chip) is looping a pre-rendered waveform with ringback on it. These loops are all slightly different in tiny little ways; some are shorter, some are smoother sounding, and so on. So while it might sound absolutely insane, with a little practice you can be the guy who squeezes blood from rocks at a party! Er, well, if you go to the sort of parties where people talk about phone switches.

Before we start, just make sure you're using a decent phone. If you're using something like a DECT phone that compresses the call as ADPCM, that's fine. A basic WECo desk phone on a POTS line in a quiet room or something that sounds equally good is probably the best starting point, though. Linear predictive codecs, such as the ones cell phones/Skype/etc use take out way too much data to be useful. Things like Google Voice like to superimpose fake ring over unsupervised audio (though JCSwishman has noticed the mobile Hangouts dialer doesn't do this. The drawback though, is they use some weird codec to compress the call with this client), and since most rings don't go offhook, obviously that's out for this sort of technique as well.

With that out of the way, let's start with an example that you'll probably come across a lot; 5ESSes and DMS-100s. These are actually two of the easiest to tell apart, coincidentally. Nice how these things work out. So go ahead and call 202-986-9992. If you're like the other phreak I gave this to, your first question is probably "Uhh, is this a queue recording or a porno?". By the time you're done asking yourself that, the recording will probably have stopped, and you'll be sitting on a trunk that just plays ring forever. Get a good sense for what it sounds like; 5ESS ring is really smooth sounding - there's no clear noise it makes when it loops, but the phase of the ring slowly changes, like a warbly tape. If it helps, don't just hold the receiver flush against your ear; with one end of the earpiece resting against your ear, let the other end fall (the left part if you were to hold it straight up, facing you) ever so slightly so there's a gap shaped like this between your ear and the receiver: |/ . Or if you're a little fuzzy on what I mean, just pull it half an inch away from your ear or something.

Sounds good? Great! Now try calling one of the DMS-100 ringout numbers. If it's sometime after 7 PM Pacific, you could always stop by the 510 one and talk with people on the conf, but anyway, unlike the 5ESS, whenever the sample loops, you can very clearly hear it repeating over and over. I don't think there's a lot of ways to describe different rings, but the audible looping gives it a very rough sound when you're comparing it.

Some rings, like the AXE-10's, are so distinct sounding that it's almost cheating to compare it to anything. Then there's the Redcoms, the DMS-10, and type two EWSD. Actually, try calling them right now. Really tough to tell apart, aren't they? Don't feel too bad - I have trouble with these too sometimes. If you're ever in a position to call them frequently (I'd say scan, but they typically don't ring to error recordings. Maybe pick an exchange with weird stuff on a lot of analog lines if you know of one), it'll make it much easier.

******
5ESS
******

The result of twenty years and 100 million lines of source code, the 5ESS is Western Electric's take on a digital switch. Though it wasn't always this way, the 5ESS in it's current state seems to have an answer for everything; most of my experiences trying to give the 5ESS some form of unorthodox input seem to end with it giving the most normal possible responses. [continue this later]

* 5ESS line cards are pretty distinct sounding. They'll make weird noises whenever you go offhook, have a slightly higher noise floor then most line cards, and a very strange frequency response. This doesn't necessarily apply if you're using a line served out of a channel bank or something, but the line cards can give a very different experience on the phone network sometimes. According to Aloha, the noises are a result of the 5ESS setting up a link through an analog switching fabric. Though the 5ESS is a digital switch, an analog cross point switch is used to connect your line to a codec instead of having one permanently associated with your line.

Distinguishing features:

* Supports revertive pulse trunks
* Supports both drum and AIS-style announcements, but the vast majority use drum-style. For that reason, you'll see some very strange arrangements sometimes. AT&T CLEC/Teleport for example, rolled out APMaxes for their 5Es, but configured them in drum mode(they also have Cognitronics MCIASes in AIS mode, so they definitely know how to do it). This is the only place in the network where you'll hear error messages ring for an absurdly long time (with TTYs, the recording is pretty long) before starting up.
* If you make a large number of unsuccessful call attempts (can be something as simple as just picking up and hanging up, but partial dial works too), it'll pull your line out of service for 100 seconds, and if you're not on loop carrier, remove power from your line as well. Assuming you don't have voicemail, the 5ESS will spit back an unusual SS7 cause code at anybody calling you under this condition. Use your best judgement with this; the switch will print a message on the console saying your line is having trouble if you do it. Probably not an issue, but a responsible operating company (read: none of them) might call you and ask if everything is okay if it happens multiple times.

Quirks:

* Some 5ESSes will terminate a call immediately if it sees the slightest blip of on-hook supervision - like for example, the Redcom supe test later in this article. Strangely, using a vertical service code like *67 will make it wait a bit longer for off-hook supervision before deciding it should tear down the call.
* Known to, at least in one specific instance, drop you directly onto the trunk to an ANAC with nothing dialed! You can feed it MFs. Try KP + 3 (other digits get more interesting behavior) + 7 digits + ST. I don't have the number that did this anymore, but I've seen another 5ESS (the Teleport one in Omaha, specifically) exhibit this behavior too.
* Was known in early generics to have some very amusing bugs; one allowed you to cause an ANI fail on outgoing calls, another let you "service observe" someone's line by creating a notest trunk via a management terminal, and forwarding it to a victim.
* Allows you to mix touchtone and rotary dialing on the same call, but once you start rotary dialing it'll lose it's ability to hear * and #. For example, if you dial 1167 with mixed tone/pulse, they won't even break the new dialtone.
* Gives short burst of dialtone after dialing a rotary digit, but ONLY after dialing a vertical service code. Straight from the dialtone, there's no burst.
* Some RBOC 5ESSes (mostly non-ex-US West ones) allow you to originate calls onto the 0110 carrier access code, a workaround code that places calls onto the trunk group for local calls. RBOC DMS-100s on the other hand, never, ever do this.

Remote call forwarding prompt: 661-716-9999
Ringout via some sort of call queue script: 202-986-9992
ANAC trunk, goes offhook and waits for MFs: 503-697-0053
Something to do with ANAC? Gives high tone if call comes in via external trunk, quickly heads to reorder: 813-386-9170

*************************
DMS-100/200/250/300/500
*************************

One of the most popular switches in the US and Canada, this thing was Nortel's love child for pretty much the company's entire existence. As a consequence, it holds the title of being not just one of the most feature packed, but one of the funnest to play with - or maybe just the most explored.

Though it's been around for decades, the DMS-100 hardware has evolved considerably since it was first made. For example, the original processor was something Nortel (Northern Electric at the time) concocted themselves; an NT-40 core made out of discrete logic chips, also used in their SP-1 processor controlled crossbar switch. In the 1980s, they ported the software to a redundant pair of 68000s. By the next decade, that became a pair of 88000s. Finally, around 2000, the new processor cards began operating with three PowerPC 604s (XA-Core as they call it for some reason), and only contain a single spare.

So why all the different names, you might ask? Marketing mostly; they're all DMS-100 family switches with software to do different things. 100 is an end office, 200 is a local tandem, 250 a toll tandem, 300 an international gateway, and 500 combination end office/toll tandem.

Distinguishing characteristics:

* Supports revertive pulse trunks
* EDRAM announcement machine
* Ringout conference bridges (internally called MMCONF)
* DISA dialtone via software
** In cases where the switch is bridging together multiple calls, such as three-way or an MMCONF, the DMS-100 uses some sort of secondary, different sounding source for all it's tones. It's still not known why this is, or where the primary or secondary tone sources are coming from. The DRAM/EDRAM cards are capable of generating some of them however, such as milliwatt and off-hook. The off-hook tone's susceptibility to this has been confirmed, but other DRAM generated tones such as SITs don't seem to be affected by this. Maybe the DRAM is the secondary source?
* Some offices will occasionally have very strange sounding reorders
* Some lines on some switches will make a soft tick sound when the switch stops waiting for digits, and starts processing a call. No correlation is known yet, but I think this may only be done on lines using loop carrier, or anything else with the GR-303 standard. Newer generation DMSes possibly don't do this altogether?
* Late in it's development life, Nortel wound up porting the Linux kernel to the DMS-100
* Internally, the system likes to send data in a format called DS-30 and DS-512. Basically, just a lopsided E-carrier format (E1 and E3) that uses 10-bit frames instead of the traditional 8-bit ones. The first and 16th channel of a DS-30, like an E1, are reserved for signaling purposes.

At this point you might be wondering, what the hell is an EDRAM? The EDRAM is Nortel's crazy announcement machine, or Enhanced Digital Recorded Announcement Machine as they call it. As far as underground (or just plain questionable) telephone scientists can determine, Nortel went out of their way to make their own ADPCM format for these things. Information, as well as the stock announcement set (complete with Nortel's weird container format) are available in random places on the internet. These are an evolution of the DRAM, which perform more or less the same function, but have lower capacity and took up a whole shelf instead of an FPGA on a single card.

Quirks:
* On analog E&M trunks (namely the one your ANAC is on if it doesn't just read off digits with the EDRAM), you can flash at just the right time, flash back, and hold the unit up indefinitely
* As a consequence of possibly the exact same bug, you can stop another caller from flashing on intra-office calls by flashing; the other line won't be able to use it until you return to it's call. Great for centrex auto-attendants?
* Some (most notably, historically independent DMS-100s, like the ones operated by United Telephone, Alltel, GTE, etcetera. Ex-Bell switches typically won't do this) have dialplan errors; they'll let you dial 0xx and 1xx codes, nine digit numbers and other weird things if a CAC is put in front of the destination. For example, 101-0333-1-214-040-1152 will go through, but 1-214-040-1152 gets an error recording.
* Pacific Bell, and possibly Nevada Bell DMSes are setup in a particularly funny way; if you dial * as one of the last three digits, it'll stop in the middle of the intercept recording, and give you reorder. Alternatively, if it's generating SIT tones (the EDRAM units loop uLaw PCM samples to do this instead of play ADPCM) or a reorder when it stops, you'll just go to dead silence.
* Always has a burst of dialtone after dialing the first pulse digit
* Some SS7 cause codes will make most DMS-100s reset back to dialtone when a call is terminated with them. If it doesn't work for you on the first time though, try it again; on some offices, the likelyhood of working is less than others. Possibly related to the hardware processing the call?
* Standard busy/reorder always go for exactly 30/60 impulses
* Occasionally you'll run across a DMS that for whatever reason, has a different pitch in it's reorder tone, but also weird timing.
* Will often, but not always send back an all circuits busy SS7 cause code after a recording. Some long distance carriers respond to this by assuming the route is busy, and if there are any, cycling through to the next route in the least cost routing list. Though it isn't the same cause code, a switch in Washington, DC will do this after playing three bursts of dialtone.
* Like the CS-2000, has I/O processors capable of encapsulating data over ATM delivered via OC-3 links


DMS-500 with 480 hertz reorder: 702-310-0012
DMS-100 with weird reorder timing: 303-781-0008, 336-789-0000
MMCONF bridge/ringing number: 510-940-0102, 505-338-1155
Remote call forwarding prompt: 505-338-1111
Pilot directory number prompt: 641-269-1222
Custom IVR: 414-227-0033 (if you press nothing, it'll give you an electromechanical low tone recording)
Unknown, but consistently on DMS-100s: 415-622-0000
Unknown: 386-364-1103
No audio, immediately sends dialtone resettable SS7 cause code back: 866-202-9985
DISA dialtone: 212-889-9998 (NY Metro centrex)
EDRAM annoucement, terminates w/all circuits busy cause code: 434-975-9999
EDRAM generated milliwatt: 801-578-0012 (normally milliwatts are as interesting as dry paint, but one of the EDRAM cards on this switch mixed up it's offhook and milliwatt tone samples. Give it a call a few times for ear-piercing lulz)
Three bursts of dialtone, plus SS7 cause code: 202-484-0000


*****
DCO
*****
* The red headed step child of the switching world; there's really no other way to put it. Siemens bought it, discontinued it in the early nineties as an end office (it survived a little longer in production as a long distance switch), and gave the EWSD the capability to interface with DCO line frames and remotes. Genband bought the DCO and EWSD designs, and made their softswitches do the same thing!

Random facts:

* Won't support digital loop carrier standards without a third party add-on
* Early incarnations supported the strange coin detect feature the ESC used without pulling line current. For whatever reason, this was dropped later in it's life.
* Commonly (if not exclusively) does AIS-style announcements.
* There's two different models of DCO; CS (toll tandem) and SE (Small Exchange). Both are relatively low capacity switches, so for that reason, you'll most likely find the DCO-SE when you're wandering around the very rural parts of ex-Contel/GTE territory. As for the CS, a lot of small long distance carriers bought these in the nineties. If you can dig up some small toll providers, they might still be using them.
* Old GTE/Contel territory, one of the easiest places to find DCOs lurking around, has a stutter dialtone with six bursts of dialtone instead of three.
* Has a tone used for confirmation/partyline ringback/etc consisting of short, 100 millisecond pulses of high tone. No other switch type seems to use this.
* When pulsing your first rotary digit, there's no burst of dialtone when you're done.

Ringing number: 337-666-9009

******
EWSD
******
* Outside the US, the EWSD, Siemens' pride and joy, is everywhere - from Germany to Argentina to Iran. Inside the US? It just comes up here and there. What it's like depends pretty heavily on who runs it, though. AT&T has trouble understanding how to run it, and it's occasionally poked at by their techs for that reason. In any case, their dialplans aren't exactly bulletproof. Verizon tends to be a little better about dialplans (some of them even have custom prompts on their Cognitronics machines!), but they have their own weirdness; in this case, a CAC - 0110. Instead of sending you to a long distance carrier, it originates whatever you put next locally.

** The 0110 CAC seems to be a thing on all North American EWSDs, even the independent ones.

* The EWSD stands as one of the only switches (the DMS-100 being the other) to have two different types of ringback tones. As far as I can tell, this has to do with the generation of hardware. Paul Timmins, the guy who runs Telcodata, was nice enough to post the install dates for most of the Ameritech EWSDs in Michigan. On that list, one clear pattern starts to come up; all the Type 1s were installed sometime before 1995 with the first Type 2 showing up in 1993. Unlike some of the more common switches, the EWSD never really became popular until the mid nineties, so the vast majority, partly thanks to DCO conversions and CLECs, are Type 2s. Type 1s only seem to occasionally up in RBOC exchanges near the midwest and eastern parts of the US.

* While EWSDs seem perfectly capable of generating milliwatts (they can all do more complex 105-type tests), almost none of them do. Instead, they have a test set that sits on an analog line, and answers with a 102-type milliwatt. In between the silence, if you send it touchtones, you'll get all sorts of weird tones.

* When getting an error recording, the default behavior is to let an announcement play once, and quickly hang up

Quirks:

* In a strange gesture of switch apathy, AT&T's EWSDs do pretty much no checking of your destination numbers. As a result, you can route calls to almost anything of your choosing [check this. It works with 0xx codes, but I haven't looked at anything else], and it'll put it right through! No weird routings, no CACs, no crap. Let it be known that nothing good ever came from talking #### about your phone switches.
* The digit 'D', typically rejected by most switches in one way or another, will translate to 0 on an EWSD
* Like the DMS, some EWSDs have been noted to make soft clicking noises as calls progress. In this case, they tend to be less subtle than the DMS's. While nobody seems to know for sure what causes this, I have a pretty strong suspicion it's caused by how the EWSD handles lines on loop carrier systems.
* Our resident EWSD resident, JmanA9, was kind enough to get some information on the EWSD's test functions. The ringback circuit, surprisingly, is an actual, physical test device that physically removes you from the line card, and takes over the function of running your phone line. This function is used very rarely, but is especially unusual on a switch that's preferred for all-ISDN networks, like some in Europe.
* Since the EWSD ringback circuit is less than intuitive, Jman was nice enough to record what each button does:

   - 1 returns dialtone burst, DTMF test, dial 1-0, two high pitched beeps if successful, one long high pitched beep if unsuccessful
   - 2 returns dialtone burst, you hang up, Ringback test
   - 3 returns dialtone burst, Rotary Test, dial 0
   - 4 returns dialtone burst, clicks then beeps twice
   - 5 returns dialtone burst, you hang up, it does things, it rings you back, beeps twice
   - 6 returns dialtone burst, you hang up, it does things, it rings you back, beeps twice
   - 7 returns dialtone burst, flash, clicks and whines, drops battery, you hang up for a while, then pick up, beeps twice
   - 7 returns dialtone burst, you hang up, it does things, it rings you back, beeps twice
   - 8 nothing
   - 9 returns dialtone burst, you hang up, it does things, it rings you back, beeps twice
   - 0 nothing
   - * nothing
   - # nothing
   - If you flash, it clicks, you hang up, it does things, it rings you back, beeps twice
   - MF 4, clicks, returns dialtone burst, you hang up, it immediately rings you back
   - MF 7, clicks, returns dialtone burst, you hang up, it drops

(Type 1)
Ringback tone: 203-453-0994

(Type 2)
EWSD Milliwatt: 541-384-0101
Ringback tone: 608-663-0126
Busy tone: 608-663-0101
Reorder tone: 608-663-0130
Remote call forwarding prompt: 888-345-8672, pick any switch from the IVR

********
AXE-10
********

* Quite a few of the ones in the US are near the Mexican border. This may be because Mexico uses so much Ericsson gear; AT&T will occasionally call on Mexican switch techs to help them fix stuff.
* Like the DMS-100, it seems to be married to an announcement machine. As far as most non-softswitch designs are concerned though, they stick out like a sore thumb; unlike a lot of the non-AIS announcements, they never, ever ring, and they're always very clean sounding; Ericsson made it fairly easy to let you directly upload recordings.
* Impatient! Only has a five second waiting time for partial dial conditions.
* Reorder timing is slightly faster than most American switches, but not as fast as a DEX-450/600, toll switches occasionally found in ex-MCI (0222; the non-Worldcom one) and Global Crossing networks.
** When dialing, the digits A, B, and C seem to give the same reaction as * depending on where you dial them. D however, seems to simply go to
** Can drop you to an announcement FAST; in the fraction of a second that most switches can bring you to reorder, the AXE-10 can start up a recording. Is this noteworthy enough to keep?
** Typically is filled with a bunch of strange tones in it's test ranges.
** Add to description: Literally the most popular switch in the world
** AT&T AXE-10s allow NPA-0xx-xxxx

Ringback tone: 254-582-7988
Busy tone: 405-382-9154
Announcement: 405-382-9137
Weird tone: 325-235-0500
Off frequency milliwatt?: 325-235-0514

********
DMS-10
********
* A direct descendant of the SL-1 PBX; some of the cards are even interchangable.
* Can support drum and AIS-style announcements. Older installations tend to have a Cook Digital Announcer stashed in them somewhere. They record in CVSD, and have a very distinctive feedback noise to them. A lot of these switches have since been fitted with some form of AIS, so it may take some hunting around to find it.
* One of the few switches to support looparound test lines in software. Possibly for this reason, most of those in service today will be on DMS-10s.
* Occasionally has test numbers for all of it's call progress tones
* Starting in the 500 series of releases, Nortel began porting the DMS-10 software to ChorusOS 3.2.1. Most switches (even the CS-1500s) in service today run a generic with this OS.
* DMS-10 offhook tone has a strange, modulated sound to it
* Stutter dialtone from the switch is considerably slower than other models. See the remote call forwarding number for an example.
* Like the DMS-100, uses DS-30/DS-512 internally
* Licensing for the switch is based on thousand blocks. For example, a rural phone company serving a town of 500 people might've bought a software license that lets them assign 311-555-0xxx and 1xxx numbers, but nothing else. Because independent telcos can be slippery, unpredictable bastards, this can save you a lot of trouble. If a thousand block is locked, you'll typically get a cannot be completed as dialed recording (or sometimes a reorder) on literally every number in the block instead of the standard not in service one.


Loop line: 904-845-1104/1106. 1106 is reorder via the DMS-10 until 1104 is called. Hanging up on 1106 when on 1104 will get rid of the tone for the duration of your call, but still accept new callers on 1106.
Remote call forwarding prompt: 207-657-9999
Cook Digital Announcer: 641-394-1255
High tone: 303-652-0020
Low tone: 303-652-0080
Dial tone: 303-652-0035
Offhook tone: 303-652-0039
Double ringback: 303-652-0042
Solid ringback: 303-652-0043

*************
CS-1500/C15
*************

What do you get when you put a DMS-10 CPU in a 2U rackmount box and slap some ethernet interfaces on it? A CS-1500! Not much more to say really.

* There appears to be various DMS-10 cards the CS-1500 can't support. Those'll be covered as more information comes out.
* Like the GTD-5 and the EWSD, this switch is married to an AIS; pretty much all installs come with an Innovative Systems APMax. The increasing number of APMaxes being paired with DMS-10s has made telling the two apart has made an already tough exercise even harder.
* Telling a DMS-10 and a CS-1500/C15 apart can be really hard; they use very similar software, CPUs, and even the same line frames. As far as I know, the only way to tell them apart is to try finding a 105 type test, or possibly a loop; independents, where you'll most likely run into this scenario, will likely put a 105-type test in a place like 9105 or 1105. 9108/9109+1108/1109 is a good place for loops.
* The stutter dialtone you get on a CS-1500 when dialing *67, *82, etc will be normal speed; the DMS-10's is noticeably slower than the speed most switches play it at
* Does not have the offhook tone with the weird modulation sound in it like the DMS-10's
* Cannot support dialpulse trunks, among a few other trunking arrangements the DMS-10 does

Remote call forwarding prompt: 828-297-9999
?Reorder tone: 906-524-9966

*************
CS-2000/C20
*************

The CS-2000, as Nortel's internal hardware guide puts it, isn't a new product, but effectively a new hardware revision for the DMS-100. The software was ported from SOS (Switch Operating System; Nortel's proprietary RTOS) to Linux, and a virtual machine layer took the place of some of the hardware. The CS-2000 also runs on PowerPC 750 and 7410 CPUs, instead of the PPC 604-based processor cards for the DMS.

* In ATM mode, this switch is quite literally indistinguishable sounding from a DMS-100. Supports many of the line frames and peripherals of the switch as well. Despite being ATM, internal signalling channels will still be done via IPoATM cells.
* In IP mode, the CS-2000 uses the same tone set as the DMS-100 in three-way mode. While it still supports DMS-100 hardware, some installations will do weird things, like fade out as it disconnects - as if there was some sort of packet loss concealment. Other installations have a subtle, but still noticeable level of latency.

Remote call forwarding prompt: 610-799-9900 (this isn't the best reference; the exchange itself is a DMS-100, the CS-2000 seems to be for an affiliated cable company)
Non-working number recording: 620-371-6111 (uses DMS-100 EDRAM circuit pack, stock annouecment)
Non-working number recording: 702-722-6222 (uses CS exclusive Audio Server, stock announcement)

***********
Safari C3
***********
* This switch pops up occasionally in small patches. Some Comcast, some Charter, some IDT, and at least in Indiana, some AT&T Uverse. The switch is optimized for voice over packetcable networks, and can be identified by a fairly distinct ring, and it's breathy voiced stock announcements.

* Comcast seems to be migrating their subscribers off of these, and onto their own platform.

Remote call forwarding prompt: 757-809-0010

*******
T7000
*******
Remote call forwarding prompt: 760-928-5900

* This sounds very close to the DMS-10 and CS-1500 call forward dialtone, but listen closely to the way it comes on. There's two bursts of stutter dialtone, a (relatively) long pause, and another of those two bursts. There's also a few other differences, like stock recordings and it's reaction to keys like *.
** Stock recordings sound weird and fucked up for some reason. 907-426-9998 is a good example of this, but a less rural exchange might be better. Some of the grey routes (see https://en.wikipedia.org/wiki/International_telecommunications_routes ) to Alaska are all kinds of messed up to begin with.

************
MDX384/IGX (also add HDX and SLICE description?)
************
* Both switches are built to be very modular, and because of their unusual design, wind up in very strange places. Their very low capacity (IGX supports 96 lines per unit, MDX-384 supports 384 lines) is ideal for places like ghost towns, and fanless operation makes them ideal for extreme parts of Alaska and the Yukon. They're popular as military PBXes as well.
* The SLICE, seemingly a 1U version of the IGX/HDX - or at least running the same software, has gotten it's rite of passage into the US military. In some places where HDXes have historically been used, they've been swapped out with SLICEs for portability reasons.
** Aside from MDX, SLICE/IGX/HDX all run same OS? Also, HDX has been described as softswitch and circuit switch before. Redcom's marketing tards need to make up their darn minds. Both generations work on circuit packs, the 90's generation of which look like they're using *very* old designs. Perfect for a government contractors. Take a look on eBay if you want to see them.
* Has a BASIC interpreter on it! No, seriously xD .
** The integrated AIS sounds like the voiceover person had a stroke. This tends to be used more by newer Redcom switches than the older units, but isn't always.

Distinguishing features:

Supports magneto phones!
Comes with integrated, WEIRD sounding AIS
DISA dialtone via software

Supervision test: 831-389-9103
AIS report: 831-389-9108
Loop: 907-293-1108/1109

*******
GTD-5
*******

What do you get when an obscure phone company designs obscure hardware? The GTD-5 EAX! That's a "General Telephone Digital #5 Electronic Automatic Exchange" for those of you who actually pay attention to acronyms. There's a certain saying in telecom; "one is good, two is great". Just to show they really were a phone company, GTE duplicated *everything* in the processor complex not just once, but twice. A single card has two processors running the exact same instructions and comparing them, while an identical card does the exact same thing. All the digital trunk cards on the system are likewise duplicated. Internally, the system communicates using 12-bit PCM words over a parallel bus, and runs on software written in a custom version of Pascal. Like some of the other designs like the EWSD, the system has no announcement cards, and leans entirely on external equipment to generate any recordings. For that reason, most of these were sold with units from the Cognitronics company to make this happen.

Random facts:

* Around 2000, Lucent completely redesigned the GTD-5 switching network. Little is known about it other then, well, it exists and it's different.
* Like any good obscure switch, the GTD-5 will almost always let you dial 0xx codes. You'll need to put a CAC in front like on a DMS-100, but probably won't be able to dial nine digit numbers.
* The GTD-5 is more or less married to an AIS to provide any recordings. Typically, these are run of the mill Cognitronics machines, but occasionally will be an ETC Digicept, a really old Cognitronics machine, or in some really recent cases, an Innovative Systems AP or APMax.
** In Logan, Iowa (712-644), there seems to be some recent AIS retrofit to one of Windstream's GTD-5s. what the heck is this thing? Definitely not a switch cutover; some sort of new AIS marriage. I'm sure there's a widow joke in there somewhere. More importantly though, is it a one-off thing, or will we see more of these if the original Cognitronics units fail?
** Sometimes, this switch will have a noticeable pause between certain tones, like offhook or stutter dialtone, even during off-peak times like 4 in the morning. Maybe some processor that does switch maintenance is responsible for quickly pulling you off and on otherwise constant tone sources? Most switches do backups and test hardware for failures during that time.
* Has a strange way of handling permanent signal (not dialing anything at the dialtone) conditions. Some have the announcement machine play something, some just give reorder, others a solid high (480) or low (480+620) tone, or even just silence. Sometimes you'll get a combination of all four. Always stay on after the reorder to be sure.
* According to Chuck, a seasoned GTD-5 tech, it may be possible to gain some insight into what software version a GTD-5 is running by the way it handles someone leaving their phone off the hook. It can be any combination of reorder, high tone, low tone, offhook tone, or all of the above. Supposedly though, there is no way to change what combination of these it uses in software. The most common way of doing things currently is to use all four (reorder -> low tone -> high tone -> offhook tone)
* Outgoing voicemail system trunks, some of the most locked down outgoing trunks you'll find, tend to get ANAC, directory assistance, and other things most switches never, ever allow. This switch is *not* good at toll restricting xD . One switch will throw you onto a permanent signal tone after reorder when dialing 800-877-0900 (immediately ends call with SS7 cause code indicating all circuits are busy)
** # doesn't mean you've finished dialing like on other switches; it seems to count as an actual digit. Investigate further, expand on what it actually does
** *Possibly* has more than one ring depending on the hardware revision, like the EWSD. To be investigated.
** Note the difference between the 813 and 503 dialtones. 503 seems to be more common. Equipment generation (or number function) related?
* One of the few large CO switches to be designed (at least originally) for fanless operation. Newer hardware doesn't necessarily follow this trend.


Cognitronics unit generating offhook tone for a GTD-5: 712-374-1256
Remote call forwarding prompt via ETC Digicept: 906-341-9983
Remote dialtone. For unknown purpose; doesn't look for destination number: 503-667-0000? 813-224-9999

4ESS [Not sure what I'm going to say about this, but I'll cover as much as I can]

[Mix & Match softswitches I know nothing about, but will give remote call forwarding numbers to]

Unknown Comcast platform: 520-395-0997
Unknown Charter platform: 608-230-6099

Special thanks to:
Scott from the Socal bridge
The people who wrote the Wikipedia switch articles
dmine45, maintainer of phworld.org
Evan Doorbell
Paul Timmins
JmanA9
Jim Somerville's LinkedIn profile
Ramsaso
Lucky225

You guys seriously know your stuff! This file would've been a lot less interesting without your bits of wisdom to stick in here.