.oO Phrack 50 Oo. Volume Seven, Issue Fifty 14 of 16 //===============================\\ || The DCO-CS Operating System || || -*- || || || || by Trunkin' Fool AKA mrnobody || || 4.1.97 || \\===============================// OK... this is the first part of what (hopefully) will be a little series type thing of articles on the DCO operating system, which is from Siemens. DCO is run on an LLS/RLS-1000/RLS-4000 machine. It has psychotically mad logging, but the logs are configurable from the admin accounts. The DCO box I was using just happened to only have a 1200 bps dialup, so some operations (i.e. listing INWATS trunks and what they route to) were painfully slow considering the large amount of trunks this thing can control. It is similar to a 4ESS in some ways, and offers some PABX functions. A guy can have lots of fun with one of these things... Some features/specifications: Billing Computer Interface -------------------------- "The DCO-CS collects AMA data and provides direct data interface with your business computer, as well as 1600 BPI magnetic tape backup or primary data collector" International Callback ---------------------- "Allows the system to place a return call to an international subscriber for the dialed domestic number originally called, either through a live or automated operator position." ISDN Transport -------------- The DCO-CS is capable of switching 64 Kb/s data. This allows people (customers, hehe) to switch Primary and Basic Rate ISDN traffic. LEC Services ------------ Full LEC services are offered, including POTS (duh), Centrex & Enhanced Centrex (combines ISDN & POTS lines in the same Centrex groups, direct inward dialing, call forwarding, hold, call transfer, intercom, conferencing, OUTWATS over line groups of any size.), CLASS including calling number delivery and display, selective call blocking and forwarding, automatic recall and call trace. "Hacker intrusion is detected and 'thwarted' by sophisticated pattern recognition software. The DCO-CS switch lets you detect abused authorization codes and service-denied authorization codes and automatically route the calls to your service departments. The system also offers timed threshold levels for both ANI and authorization codes as another form of fraud protection. It delivers detailed traffic and facilities usage reports to help you plan the optimum use of your private and leased facilities." --Siemens Stromberg-Carlson Calls are processed simultaneously with separate processors and switching matrices. In the event of a failure, not even calls in the process of being switched are lost because when the failure occurs, the system simply switches to "its redundant processor and memory". I guess that before I dive straight into the commands, I should discuss something pretty damn important. That something is MMI. MMI stands for Man-Machine-Interface,and is basically the 'shell' for this system. First off, in MMI, every command is prefixed by a '$', ie, to run the account maintenance program, "passwm", one would type: "$PASSWM", without the quotes. Always put a comma between parameters. For example, say that a program ADDTFREE requires the parameters SAC(service access code),Toll-Free Number, and the Trunk to Assign the Toll-Free number to. The hypothetical command to add a tollfree number, 555-6969, with a SAC of 800, for example, and route it to (123)456-7890, would be: "$ADDTFREE 800,5556969,1234567890" (without the quotes). The ';' denotes a line terminator. For example, to run a program PROG1, which,say, clears the terminal screen, and the INWANI utility, one would type: "$PROG1;$INWANI", without the quotes. The "" (quotes) are used to contain a string of one or more characters. A string is considered anything that contains either a blank or comma not being used as a delimiter. The '\' allows special characters to be input to tasks (similar to linux/unix?). And finally, the ':' is synonymous to done (whatever that means). Some more on MMI... The command line/response length is 65 characters, so anything longer than 65 will be truncated. Exit is a valid response at any prompt. Help is also valid and lists the valid responses with descriptions. To automatically display the help information prior to all prompts, type "HELP=ON" without the quotes. "HELP=OFF" disables this function. The '^' is used to back up a menu. Control-P cancels a function in progress. The '&' represents logical AND. However, the '&&' represents a logical inclusive. The '*' is a wildcard, and allows the user to select the entire range of possibilities. 'Option Words'- the option word is entered on the command line after the task(command) name. The Option Word can be either in octal or ASCII. Value ASCII Definition -F1 /NODIAL no dialogue (header or trailer msg output) to terminal -F2 /OFFLINE Request communication with offline CP -F4 /NOCOMM No user input. All input must be on the command line -F40 /NOPAGE Do not paginate output. Values may be added together to indicate multiple options, eg: -F3 = -F1 and -F2. One final thing: I said that all commands must be prefixed with a '$', however, this does not apply to input, ie when inside a program it is not necessary. The next part is basically just a command list for DCO. I will do a more detailed (tutorial even) as i learn more and as people ask for one, or if I just feel like writing it (and I probably do, as I have read Phrack for some time and always wanted to contribute). One last warning: the LLS/RLS is a fairly large system, so be VERY CAREFUL as one can do about as many bad things as good things if you're not careful. So... without further ado, heres the command list: Command ~ Description ------- ----------- ABNUTL - perform automatic balance network (ABN) functions ABORT - abort operation of an active task ACISU - alarm control interface start up ACITST - alarm control interface test ACTUTL - display/clear/acknowledge active alarms ADMIN - recent change/database administration ALMSEN - switch between local and remote alarm reporting AMA - configure automatic message accounting (AMA) AMCDMP - administer AMA message thresholds AMFMAU - verify formatted AMA tickets AMOPT - administer system options AMPRPT - set frequency of repeat notification of alarms AMPUTL - alarm message processing utility AUDIT - verify software record of hardware states match actual hardware BKRNS - backup RNS disk at the host office BLDINH - mask/unmask building security alarm (heh, this should be fun) BUFDMP - search/clear/dump CP buffers CANCEL - cancel wait timer for TID and IDN CBUG - debug utility for LLS/RLS-1000 and CODC devices CHEKER - compare MP memory to disk CHKUTL - verify disk integrity (DCO equivalent of scandisk for dos) CLEAR - initialize span error counters CODE - DCO-CS customer routing CONFIG - configuration control (load,switch,mask, etc.) CONUTL - convert equipment numbers COPY - copy databases from memory to disk CPDMP - display data collected from a CP crash CPPTCH - call processing patch utility CPREST - online CP reset CPSRCH - search CP buffer CPSU - call processing startup CSADM - DCO-CS administer ANI DN's and auth codes DBADMN - DCO-CS change max entries in selected tables DBUTL - administer MP database parameters DBVER - database verifications and configuration reports DEBUG - debug utility for MP DEVMOU - build config file to rebuild system mount status DIAG2 - manually diagnose/verify fault in the MOS side of the system DIAG3 - manual diagnostics to test forced faults DMPUTL - duplex MP utility (switchover,download,lock,etc.) DNAUTL - directory number audit utility DTIUTL - configure/status of DTI/DS1M for LLS/RLS-1000/RLS-4000 DUMPER - dump raw data records from disk ECCRPT - report 1-bit parity errors corrected in MP/CP/FP ECD - display error counters EDIT - DCO system editor EQCHEK - test access to equipped hardware FILSYS - perform file or disk manipulation functions FLSH - flush alarm message processing buffers FLXANI - DCO-CS administer FLEX ANI tables FPBUG - debug utility for FP FPCDMP - display/save data collected from FP crash FPSU - FP start up FREE - display number of free blocks in MP memory FXLN - administer/configure FX communications to an RNS GBUG - generic debug utility HEY - MP operating system task completion advisor HSTUTL - collect/retrieve alarm message history HOTLIN - DCO-CS administer hotline database INSTAL - MP operating system manual task installer INWANI - DCO-CS administer INWATS number routed by NPA/NXX INWATS - DCO-CS administer incoming toll free (INWATS) service ISUUTL - administer alarm level priorities and conditions LLC - line load control of subscriber lines LOGOFF - logs off the terminal LSPT - light traffic tests (avoid running during heavy traffic) MACLR - clear memory audit data MANUAL - manual control of ports MAUDIT - memory audit routine MBI - report masks and errors on MBI bus MEMCHK - report differences between CP memory (generic code) and disk MEMMAP - display memory map MODEM - administer system parameters for modem security MOVEDB - DCO-CS database compress program MSKUTL - temporarily mask alarm and message reporting NITSWC - initiate service circuit switchover OCC - DCO-CS administer system options OPR - administer system operator groups PABX - administer PABX groups PARTN - DCO-CS administer partition number tables PASSWM - administer user/password list PATCH - MP operating system patcher PATRPT - format patch into report PAUDIT - audit patches applied to disk/system PCOS - DCO-CS administer partition class of service PED - administer/apply/verify patches to disk/system POORA - point of origination for recorded announcements PORTST - list port status; list/change lockout thresholds PSAUTL - port store area (PSA) utility REBOOT - reboots the maintenance processor RECOV - put call processors in sync REMOVE - remove a resident program from memory RESTOR - restore call processor RFRNS - copy files from an RNS to the host office RGU - DCO-CS least cost routing/update display RNSAMA - display AMA buffer status in an RNS at the host RNSBMP - display RNS BMP status at the host RNSUTL - configure/status/diagnostic testing of signaling links ROTL - transmission/operational testing of outgoing & 2-way trunks ROUTE - DCO-CS display customer routing RRTUTL - reroute messages to additional terminal points RSMUTL - remove/restore/mask/unmask/test RLG span RSUTL - routine switchover utility RTEST - routine testing RTOPT - administer analog trunks and service circuits RTR - administer route treatment database SBUG - stop FBUG SCTST - DCO-CS service circuit diagnostics SECTTY - administer terminal access groups SELMCL - outgoing call trace SELNUM - DCO-CS administer blocked directory tables SERV - DCO-CS change service circuit tables SLUUTL - configure/administer/mask/test SLUS SNCUTL - configure/status of SNC for LLS & RLS-1000 SPCALL - DCO-CS administer speed codes STASND - digital alarm sending utility STATE - display system state STATE1 - switch to system state 1 STATE2 - switch to system state 2 STATUS - display system status STOP - terminate execution of TEST, GBUG, DIAG2, or BTBT SWITCH - manually switch tones/ringing generators/clocks (non RLS-4000) TAPE - display formatted tickets on AMA tape TASKCK - audits the disk database for necessary/unnecessary files TCOS - administer trunk class of service TFM - activate/deactive/audit/display TMRS TFMRP - display specific TMRS measurements/report data/study set TIKFM - DCO-CS display AMA tape format TIME - display system date/time TIMEC - changes system date/time TIMER - administer/configure CP occupancy measurements TKTHRS - administer trunk thresholds TMAD - administer/configure TMRS TMBUG - debugger for traffic measurement processor TMPDMP - display data collected from a TMP crash TMRPRT - manually display a TMRS variable report (with FP) TRACE - DCO-CS call trace utility TRACER - allows use of tracer board for CP TRK - administer trunk group assignments TRKUTL - administer trunk testing database TSEP - administer/configure traffic separations TTU - administer translation database UNMASK - enable reporting of messages & H/W faults (non-RLS-4000) UNSYNC - take call processors out of sync UPACK - unpack a file UPDATE - update the system state UTL - mount/dismount device/feature; configure tasks VALPC - DCO-CS administer validated project codes VCHECK - version checker VST - administer variable state timers XDSO - CP message sender/debugger XFER - transfer files between the DCO and another system XRTEST - terminate routine testing Thats all for the commands... I will probably write a follow-up explaining some of the commands usage, what a DCO looks like when you call it (ie how you know its a DCO machine), what some defaults are, how to route numbers using INWATS or INWANI, and whatever else i figure out... for now, have phun & read Phrack... Feel free to contact me: mrnobody@pil.net resources i used: - an actual RLS machine running DCO siemens stromberg-carlson - my mind - the minds of my phriends, to whom i give much thanks: c-stone (is thatit?), lefty, port9, cyklonik (hope everything turns out OK....), a guy named don in CA :), and ben (look at me now, m0f0) sorry if i forgot anything or anyone that helped me... look out for "The DCO-CS part 2" soon... EOF