A trip down phone-phreak memory lane

Just What Is This ProjectMF Thing Anyway?

Project MF is a living, working simulation of analog SF/MF signaling just as it was used as the standard in the public switched telephone network up until the early 90's, when most everything was cut-over by the regional Bells to the fully-digital SS7/ISDN network as it continues today.

This allows a user to "blue box" telephone calls, like the phone phreaks of yesterday.

ProjectMF was first presented to the world at the sixth HOPE conference in 2006 by Mark Abene (A.K.A. Phiber Optik). After the well-received presentation, Mark went on to establish the www.projectmf.com discussion board as a way to promote further development and experimentation and as a way of preserving an important part of telco history.

So What's a Blue Box?

The blue box is an electronic device that simulates a telephone operator's dialing console. It functions by replicating the tones used to switch long-distance calls and using them to route the user's own call, bypassing the normal switching mechanism. The most typical use of a blue box was to place free telephone calls. The blue box no longer works in most western nations, as modern switching systems are now digital and no longer use the in-band signaling which the blue box emulates. Instead, signaling occurs on an out-of-band channel which cannot be accessed from the line the caller is using (called Common Channel Interoffice Signaling (CCIS)).

The blue box got its name because the first such device confiscated in 1961 by Bell System security was in a blue chassis.

If you are perplexed at this point, for a primer on what this is all about a must-read is the article that was published in the October, 1971 Esquire magazine article "Secrets of the Little Blue Box" by Ron Rosenbaum.

Exploding the Phone

Phil Lapsley colaborator on this web site and the original PIC blue box hardware, has written a fantastic book on the history of phone phreaking, "Exploding the Phone". There are loads of historical information on his site.

From there, peruse the files on textfiles.com to read some of the actual texts that were circulated by phone phreaks "back in the day".

To hear some of this stuff in action, head over to the PhoneTrips web site and listen to the tapes phone phreaks made of their activities. For particularly good examples of blue box usage, I recommend listening to the "Classic Tandem Stacking", "A HiFi 914 Routings tape, part 1", and "A HiFi 914 Routings tape, part 2".

Ok, So How Do I Use One?

The operation of a blue box was/is simple: First, the user places a long distance telephone call, usually to an 800 number or some other non-supervising phone number. For the most part, anything going beyond 50 miles would go over a trunk type susceptible to this technique.

When the call starts to ring, the caller uses the blue box to send a 2600 Hz tone. The 2600 Hz is a supervisory signal, because it indicates the status of a trunk; on hook (tone) or off-hook (no tone). By playing this tone, you are convincing the far end of the connection that you've hung up and it should wait. When the tone stops, the trunk will go off-hook and on-hook (known as a supervision flash), making a "Ka-Cheep" noise, followed by silence. This is the far end of the connection signaling to the near end that it is now waiting for MF routing digits.

Once the far end sends the supervision flash, the user would use the blue box to dial a "Key Pulse" or "KP", the tone that starts a routing digit sequence, followed by either a telephone number or one of the numerous special codes that were used internally by the telephone company, then finished up with a "Start" or "ST" tone. At this point, the far end of the connection would route the call the way you told it, while the users end would think you were still ringing at the original number.

Huh. So where ProjectMF Fit In To All This?

Even though this is all obsolete, it is again made possible by a set of modifications and patches made to the open-source Asterisk PBX server. It allows users to dial into the system via a variety of access methods, including the regular public switched telephone network and SIP. The user is presented with a ringing line. The ringing can be disconnected and the trunk seized by playing a 2600 tone into the line. Thereafter, the call can be diverted to another number or to a series of internal recordings and functions that reside on the server/switch by playing MF or multifrequency tones into the line.

This is all perfectly legal, as the system is totally private. It is really more than a simulation. The call is going over a trunk group of 24 SF/MF trunks, although both sides of the trunks are terminated on the same PC. The hardware that makes this possible is two extra dedicated Ethernet cards on the PC running T1 over Ethernet protocol over a loopback Ethernet cable. Your incoming call gets looped over one of the 24 trunks before terminating back on the same switch, so you have 2600 and MF control.

Project MF server in basement

I have maintained a public ProjectMF system since 2006. At last old-timers, aspiring phone phreaks, and the curious can experience the clandestine thrill of blue boxing their own calls! I have extended Phiber's original patches to add to the realism and reliability of the system. Lots of the old tricks are possible, including trunk "stacking",as illustrated in one of the Phonetrips recordings.

Accessing My ProjectMF Server

My ProjectMF server can be accessed via the PSTN on 630-485-2995. The switch will play back recorded instructions when you dial in.

Anonymous callerid on incoming calls is no longer permitted. Calls subject to monitoring and/or recording to prevent abuse.

Access is also available via:

Note that you need a source of 2600 Hz tone and an MF dialer (NOT a regular DTMF (Touch-Tone) dialer) to make ANY use of this at all. You can download a software blue box for Windows, which also requires you to install Microsoft's .net framework. This program will let you generate MF tones through your PC's sound card and speakers. You can use the number keys on the right side of your keyboard (if you use a full-size keyboard) as an almost-real blue box, as well as the point and click method!

Alternately, you can build your own, real blue box with instructions found on this site!

During the ringing of the line (or after it stops), play a short burst of 2600, wait for the wink acknowledgment (the "Ker-Cheep"), followed by the MF digits from the list below. The 2600 Hz tone must be played at a somewhat higher level than the MF digits. Additional calls can be placed by playing 2600 again, waiting for the wink, and re-routing the call with new MF digits.

If you do not begin dialing within 5 seconds after playing 2600 and getting the wink, you will hear a "reorder" tone (fast busy). You must then re-seize the line with another burst of 2600.

The system will read back the digits it hears if you dial anything the switch does not understand. Play around with volume levels, especially if just holding the PC speaker up to the phone. The MF tones do not need to be excessively loud. It is important to do this in a fairly quiet environment. Do not talk while dialing. The switch will try to interpret loud sounds as MF digits.

You can divert a call through the box. Just dial 2600, KP, a 10-digit phone number (no leading "1"), and ST. Experiment on the test numbers to get the levels right first.

Video Tutorial

To help you get started, a video tutorial is available on YouTube:

 

The Dialing Plan

Here are some numbers to try after you have seized a trunk with 2600 Hz. (Any three/four-digit code will also work with an area code prefixed.)

Most recordings: DTMF 0 to exit, * and # to skip backward and forward.

Dialing sequenceGets you ...
KP+000+ST Operator console WECO Spacesaver and Polycom IP320. No-answer transfer to cell phone. VoiceMail.
KP+001+ST Ernest COCOT D3 Payphone 24/7 (no ringer). After 5 rings, phone auto-answers. To check coin box totals, press *123456 after beep but before modem tone. Press * again for cumulative total. May or may not work over IAX due to poor Asterisk 1.2 DTMF handling.AX due to poor Asterisk 1.2 DTMF handling.
KP+002+ST Alternate Line WECO Spacesaver and Polycom IP320. No transfer to cell phone. VoiceMail.
KP+003+ST VoiceMail Direct line to leave a VoiceMail message on the system.
KP+004+ST Alternate Line WECO Spacesaver and Polycom IP320. No transfer to cell phone or voicemail.
KP+010+ST Rules compliant COCOTs, Part 1 These were the most rules-compliant COCOTs Evan Doorbell and Les had ever seen. Red box used and anti-blue box measures discussed. Green boxing explained! 0 to exit, * and # to skip back and forth.
KP+011+ST Rules compliant COCOTs, Part 2 These were the most rules-compliant COCOTs Evan Doorbell and Les had ever seen. Red box used and anti-blue box measures discussed. Green boxing explained! 0 to exit, * and # to skip back and forth.
KP+012+ST Warwick Part 1 Warwick and the 914 Area of NY.
KP+013+ST Warwick Part 2 Warwick and the 914 Area of NY.
KP+014+ST Warwick Part 3 Warwick and the 914 Area of NY.
KP+015+ST Warwick Part 4 Warwick and the 914 Area of NY.
KP+016+ST Warwick Part 5 Warwick and the 914 Area of NY.
KP+017+ST Warwick Part 6 Warwick and the 914 Area of NY.
KP+018+ST CCIS and phreaking Effect of CCIS on Phreaking, Olney SFing, 1981-83.
KP+019+ST Firesign Theater "Waiting for the Electrician or Someone Like Him". A bit of groundbreaking comedy from the mid-1960s.
KP+020+ST Exploring the Life Insurance Tie-lines Exploring the Life Insurance Tie-lines, pgm 1 PARTIAL, Fall 1976 (ends abruptly)
KP+021+ST How I Became a Phone Phreak pgm. 7 How I Became a Phone Phreak pgm.7: The Dark Side of "Party Lines," November 1970
KP+022+ST How I Became a Phone Phreak pgm.8 How I Became a Phone Phreak pgm. 8: Kennedy Airport Phone Trip, December 1970
KP+023+ST How I Became a Phone Phreak pgm.9 How I Became a Phone Phreak pgm. 9 (Nov-Dec 1970)
KP+024+ST How I Became a Phone Phreak pgm.10 How I Became a Phone Phreak pgm. 10 (December 1970)
KP+025+ST Secrets of the Little Blue Box, Part 1 By Ron Rosenbaum. Originally published in Esquire, October 1971. Part 1 of 5.
KP+026+ST Secrets of the Little Blue Box, Part 2 By Ron Rosenbaum. Originally published in Esquire, October 1971. Part 2 of 5.
KP+027+ST Secrets of the Little Blue Box, Part 3 By Ron Rosenbaum. Originally published in Esquire, October 1971. Part 3 of 5.
KP+028+ST Secrets of the Little Blue Box, Part 4 By Ron Rosenbaum. Originally published in Esquire, October 1971. Part 4 of 5.
KP+029+ST Secrets of the Little Blue Box, Part 5 By Ron Rosenbaum. Originally published in Esquire, October 1971. Part 5 of 5.
KP+030+ST Retrospective by Ron Rosenbaum, Part 1 Retrospective on Secrets of the Little Blue Box by the author Ron Rosenbaum. 2018. Part 1.
KP+031+ST Retrospective by Ron Rosenbaum, Part 2 Retrospective on Secrets of the Little Blue Box by the author Ron Rosenbaum. 2018. Part 2.
KP+032+ST Exploding the Phone, Foreward "Foreward" by Steve Wozniak. By Phil Lapsley. Narrated by Evan Doorbell.
KP+033+ST Exploding the Phone, Ch. 01 "Fine Arts 13" By Phil Lapsley. Narrated by Evan Doorbell.
KP+034+ST Exploding the Phone, Ch. 02 "Birth of a Playground" By Phil Lapsley. Narrated by Evan Doorbell.
KP+035+ST Exploding the Phone, Ch. 03 "Cat and Canary" By Phil Lapsley. Narrated by Evan Doorbell.
KP+036+ST Exploding the Phone, Ch. 04 "The Largest Machine in the World" By Phil Lapsley. Narrated by Evan Doorbell.
KP+037+ST Exploding the Phone, Ch. 05 "Blue Box" By Phil Lapsley. Narrated by Evan Doorbell.
KP+038+ST Exploding the Phone, Ch. 06 "Some People Collect Stamps" By Phil Lapsley. Narrated by Evan Doorbell.
KP+039+ST Exploding the Phone, Ch. 07 "Headache" By Phil Lapsley. Narrated by Evan Doorbell.
KP+040+ST Exploding the Phone, Ch. 08 "Blue Box Bookies" By Phil Lapsley. Narrated by Evan Doorbell.
KP+041+ST Exploding the Phone, Ch. 09 "Little Jojo Learns to Whistle" By Phil Lapsley. Narrated by Evan Doorbell.
KP+042+ST Exploding the Phone, Ch. 10 "Bill Acker Learns to Play the Flute" By Phil Lapsley. Narrated by Evan Doorbell.
KP+043+ST Exploding the Phone, Ch. 11 "The Phone Phreaks of America" By Phil Lapsley. Narrated by Evan Doorbell.
KP+044+ST Exploding the Phone, Ch. 12 "The Law of Unintended Consequences" By Phil Lapsley. Narrated by Evan Doorbell.
KP+045+ST Exploding the Phone, Ch. 13 "Counterculture" By Phil Lapsley. Narrated by Evan Doorbell.
KP+046+ST Exploding the Phone, Ch. 14 "Busted" By Phil Lapsley. Narrated by Evan Doorbell.
KP+047+ST Exploding the Phone, Ch. 15 "Pranks" By Phil Lapsley. Narrated by Evan Doorbell.
KP+048+ST Exploding the Phone, Ch. 16 "The Story of a War" By Phil Lapsley. Narrated by Evan Doorbell.
KP+049+ST Exploding the Phone, Ch. 17 "A Little Bit Stupid" By Phil Lapsley. Narrated by Evan Doorbell.
KP+050+ST Exploding the Phone, Ch. 18 "Snitch" By Phil Lapsley. Narrated by Evan Doorbell.
KP+051+ST Exploding the Phone, Ch. 19 "Crunched" By Phil Lapsley. Narrated by Evan Doorbell.
KP+052+ST Exploding the Phone, Ch. 20 "Twilight" By Phil Lapsley. Narrated by Evan Doorbell.
KP+053+ST Exploding the Phone, Ch. 21 "Nightfall" By Phil Lapsley. Narrated by Evan Doorbell.
KP+054+ST Exploding the Phone, Epilogue "Epilogue" By Phil Lapsley. Narrated by Evan Doorbell.
KP+056+ST Lenny "Lenny" script to drive telemarketers nuts. Try to sell him something.
KP+100+ST "Milliwatt" 1004 Hz. Measures -13.5 dB locally over my PAP2T. YMMV.
KP+101+ST Test number "Weasels" recording
KP+102+ST Test number "Monkeys" recording
KP+103+ST Test number "Moo 1" recording
KP+104+ST Test number "Moron" recording
KP+105+ST Test number "Moo 2" recording
KP+106+ST Test number "Something wrong" recording
KP+107+ST Test number "Made it up" recording
KP+108+ST Test number "Im bored" recording
KP+109+ST Test number "Dont Understand" recording
KP+110+ST Test number "Step in stream" recording
KP+111+ST ProjectMF demo Phiber ProjectMF presentation at Hope 6.
KP+112+ST Tandem stacking Evan Doorbell.
KP+113+ST N1 phreaking, part 1 Evan Doorbell juices off N1 and phreaks around. Part 1.
KP+114+ST N1 phreaking, part 2 Evan Doorbell juices off N1 and phreaks around. Part 2.
KP+115+ST 1xx and 0xx codes Evan Doorbell investigates 1xx and 0xx codes. Also a reference to the 2111 conference.
KP+116+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 1.
KP+117+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 2.
KP+118+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 3.
KP+119+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 4.
KP+120+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 5.
KP+121+ST Inward Operator Rings switch phone and cell phone
KP+122+ST Evan Doorbell How Evan Doorbell became a Phone Phreak, Part 6.
KP+123+ST Joybubbles, Part 1 Emmannuel Goldstein 1991 interview with Joybubbles, Part 1.
KP+124+ST Joybubbles, Part 2 Emmannuel Goldstein 1991 interview with Joybubbles, Part 2.
KP+125+ST Joybubbles Tech., Part 1 Haxor interview with Joybubbles, part 1. Great technical info.
KP+126+ST Joybubbles tech., Part 2 Haxor interview with Joybubbles, part 2. Great technical info.
KP+127+ST Joybubbles Tech., Part 3 Haxor interview with Joybubbles, part 3. Great technical info.
KP+128+ST Sounds of Long Distance, Part 1 Introduction.
KP+129+ST Sounds of Long Distance, Part 2 Calls to Centralized Intercept (February 1977, June 1976).
KP+130+ST Sounds of Long Distance, Part 3 The Hempstead-White Plains Route (June 1976).
KP+131+ST Free411 Directory assistance
KP+132+ST Sounds of Long Distance, Part 4 Anecdotes, Centralized Intercept, #5 Crossbar (February 1977, June 1976).
KP+133+ST Sounds of Long Distance, Part 5 An Assortments of Calls via Hempstead Tandem 3 (June 1976).
KP+134+ST Sounds of Long Distance, Part 6 Centralized Intercept Calls via New York 7 (February 1977).
KP+135+ST Sounds of Long Distance, Part 7 Calls to NY States 315 NPA (Summer 1977).
KP+136+ST Sounds of Long Distance, Part 8 More calls to NY States 315 NPA (Summer 1977).
KP+137+ST Sounds of Long Distance, Part 9 DDD from Panel, 4M Dialpulsing (1977).
KP+138+ST Sounds of Long Distance, Part 10 DDD from #1 Crossbar, ANI Failures, NX1 Sounds (1974-1977).
KP+139+ST Sounds of Long Distance, Part 11 Calls to -- and through -- NX1s (1974-1976).
KP+140+ST Sounds of Long Distance, Part 12 Centralized Intercept, NX1 Test Board, NX1 Tandem calls (1974-1976).
KP+141+ST Sounds of Long Distance, Part 13 More NX1s, Receiving a Stacked Call, Hempstead-White Plains Route (1974-1977).
KP+142+ST Sounds of Long Distance, Part 14 DDD Demo Recordings (1971-1975), SP1 Tandems (1976).
KP+143+ST Sounds of Long Distance, Part 15 SP1s, SFing Augusta Step Tandem (1976-77).
KP+144+ST Sounds of Long Distance, Part 16 4M & XBT Audible Dialpulsing, Calling France, Forced Reroutes (1974-1982).
KP+145+ST Listen to 762-0115 first Dialing the "1xx" Codes from Greenville NC Coin Phones, part 1 (1978,1980).
KP+146+ST Listen to 762-0115 first Dialing the "1xx" Codes from Greenville NC Coin Phones, part 2 (1978,1980).
KP+147+ST Local Coin Control in the 1970s 1975-1978, 2001.
KP+148+ST Sounds of Panel, Part 1 GEdney 9 Panel in Brooklyn NY (November, 1977).
KP+149+ST Sounds of Panel, Part 2 GEdney 9 Panel in Brooklyn NY (November, 1977).
KP+150+ST Sounds of Panel, Part 3 GEdney 9 Panel in Brooklyn NY (November, 1977) - Great explanation of panel operation.
KP+151+ST Network Sounds of the 70s, Part 1 1976-1981.
KP+152+ST Network Sounds of the 70s, Part 2 1976-1981.
KP+153+ST Elizabeth City Part 1 Step With Directors: Elizabeth City NC Area (March, 1977).
KP+154+ST Elizabeth City Part 2 Step With Directors: Elizabeth City NC Area (March, 1977).
KP+155+ST Elizabeth City Part 3 STACKING local offices: Elizabeth City NC Area (Summer, 1978).
KP+156+ST Elizabeth City Part 4 Step With Directors, More Details: Elizabeth City NC Area (March, 1977).
KP+157+ST Elizabeth City Part 5 Step With Directors, A Closer C.O.: Elizabeth City NC Area (March, 1977).
KP+158+ST CNET Switch Stacking Demo of switch stacking on CNET with DISA and MF.
KP+159+ST Overview of #1 Step, Part 1 Bell System #1 Step in downtown Raleigh NC (Sept., 1979).
KP+160+ST Overview of #1 Step, Part 2 Bell System #1 Step in downtown Raleigh NC (Sept., 1979).
KP+161+ST Comment line Record a comment for all to hear. Playback at 1-762-0171.
KP+162+ST Overview of #1 Step, Part 3 Bell System #1 Step in downtown Raleigh NC (Sept., 1979).
KP+163+ST Overview of #1 Step, Part 4 Bell System #1 Step in downtown Raleigh NC (Sept., 1979).
KP+164+ST ProjectMF Lecture My ConfCon presentation on ProjectMF, July 2009. www.confcon.org.
KP+165+ST Senderized XY Steps, Intro Prince William County VA, Woodbridge-Occoquan-Lorton (June 1973, August 1977).
KP+166+ST Senderized XY Steps, Part 1 Prince William County VA: The Local Area From Woodbridge-Occoquan (August 1977, October 1973).
KP+167+ST Senderized XY Steps, Part 2 Prince William County VA: changes in the Occoquan switch, 1973 to 1977 (October 1973, August 1977).
KP+168+ST Senderized XY Steps, Part 3 Prince William County VA: Manassas in 1976 (May, June 1976).
KP+169+ST Senderized XY Steps, Part 4 Prince William County VA: Dale City in October 1973.
KP+170+ST Senderized XY Steps, Part 5 Prince William County VA: Dale City, Rewired (August 1977).
KP+171+ST Playback comments Playback comments recorded at 1-762-0161.
KP+172+ST Senderized XY Steps, Part 6 Prince William County VA: Long Distance from Dale City; Virginia Suburbs of D.C. from Occoquan-Lorton (August 1977).
KP+173+ST Lily Tomlin - Ernestine Complete "This is a Recording" album featuring Lily Tomlin as Ernestine the operator. 45 minutes.
KP+174+ST 052 Conference, Part 1 Phreaks from Esquire article on "052" conference, part 1 (January, 1972).
KP+175+ST 052 Conference, Part 2 Phreaks from Esquire article on "052" conference, part 2 (January, 1972).
KP+176+ST Tom Duffy Conversation Conversation with AT&T security man, Tom Duffy (1972).
KP+177+ST Carolina Tel. part 1 Step with ESS tones in Washington NC (March, 1977).
KP+178+ST Carolina Tel. part 2 Step in Belhaven NC (March, 1977).
KP+179+ST Carolina Tel. part 3 LD Calls from Greenville NX1 (March, 1977).
KP+180+ST Carolina Tel. part 4 NX1-E in Vanceboro NC (March, 1977).
KP+181+ST Carolina Tel. part 5 Step with "GTE" ring in Williamston NC (March, 1977).
KP+182+ST Carolina Tel. part 6 Step with no E.A.S. in Windsor NC (March, 1977).
KP+183+ST Carolina Tel. part 7 Step homing on an NX1 in Farmville NC (March, 1977).
KP+184+ST Carolina Tel. part 8 Step C.D.O. in Stantonsburg NC (March, 1977).
KP+185+ST Carolina Tel. part 9 A Larger Step in Wilson NC (March, 1977).
KP+186+ST Busy and Ring Busy signals and ring sounds around the U.S. (1971).
KP+187+ST Phil Lapsley "History of Phone Phreaking" talk by Phil Lapsley, who has just completed a book on the history of phone phreaking.
KP+188+ST Harrisonburg, VA, part 1 Step in Harrisonburg VA, part 1 (August, 1976).
KP+189+ST Harrisonburg, VA, part 2 Step in Harrisonburg VA, part 2 (August, 1976) (Includes "Local Carrier Sounds" Demo, 1974-1986).
KP+190+ST Harrisonburg, VA, part 3 Step Tributaries of Harrisonburg VA, part 1 (August, 1976).
KP+191+ST Harrisonburg, VA, part 4 Step Tributaries of Harrisonburg VA, part 2 (August, 1976).
KP+194+ST Phil Lapsley Phone Phreak Confidential: The Backstory of the History of Phone Phreaking. Presented at HOPE Number 9 conference, 2012.
KP+195+ST John Draper interview 2006 UK Hacker Voice Radio interview with John Draper (Captain Crunch), legendary phone phreak. Use "#" repeatedly to bypass lengthy musical intro.
KP+196+ST Phone Trips Song Evan Doorbell goes over the top. Listen to all 6 minutes, if you dare!
KP+199+ST Supervision test Flashes 2600 Hz. Routed through a 2600-controlled trunk so that operation of the notch filter may be heard. Two cheeps of 2600 are heard for each burst of 2600, one when the tone is applied, one when removed, as the DSP filter "rings".
KP+555+ST Revertive Pulse Generator Repeatedly prompts for a 4-digit number and converts to revertive pulses, as generated by the Incoming and Final frames of a panel switch.
KP+600+ST Echo Test Asterisk echo test
KP+919+ST ProjectMF Operator Paging Dials my Polycom IP320 desk phone in auto-answer speakerphone mode, connecting both parties directly to the 762-2111 conference bridge. Allows paging the Operator or adding him to a conference remotely.
KP+1111+ST CNAM Reverse Lookup Enter a 10-digit phone number after the voice prompt and beep. The system performs a reverse lookup from a real CNAM database and spells out the resulting name twice.
KP+2020+ST Monitor SF or DP tandem trunks Monitors the near and far SF/DP tandem trunks used for the ProjectMF system. Trunks 1-24 (SF/MF) and 49-72 (DP) are on the originating tandem trunk group, paired with trunks 25-48 (SF/MF) and 73-96 (DP) on the terminating tandem trunk group. Channels are paired 1 and 25, 2 and 26, 3 and 27 and so on. You can listen to the same call from the perspective of either end of the trunk.
KP+2111+ST Conference Bridge "#" disconnects. "*" plays a menu of settings. "8" exits the menu and returns to the conference.
KP+xxx-xxx-xxxx+ST Outdial to the PSTN via Blue Box
KP+011+country code+number+ST Collectors Net Access via Blue Box
KP+013+number+ST NPSTN access via Blue Box.
KP+2602+ST CNET DISA Dialtone DISA to test your incoming configurations. CNET only. Dial 011+Country_Code+CNET_Number.
KP+2606+ST Sample Toneplant Tones US and UK modern and vintage telephony tones generated by the Arduino toneplant software written by Don Froula. Build your own tone plant. Contact Don for info.