                         ==Phrack Inc.==

              Volume 0x0b, Issue 0x3e, Phile #0x08 of 0x0f

|=---------------------[ Look, A Phone Article!! ]----------------------=|
|=----------------------------------------------------------------------=|
|=--------------------------[  d0nn13 n4rk0 ]---------------------------=|
|=----------------------------------------------------------------------=|


			PART I
1		
	1.1		First Words
	1.2		Quick Overview of Switching

2		
	2.1		Getting Started
	2.2		Customer Data Change
	   2.2.1	Query Commands
	   2.2.2	The SERVORD Environment
	   2.2.3	CDC via PTE and Interfaces in General

3
	3.1		So Much for the Basics
	3.2		Welcome to the MAP CI Command Reference

			PART II
4
	4.1		Rant
5			Summary




1.1 Introduction:

This article represents some basic knowledge of the DMS family of
telephone switches. Alot has been written regarding telecommunications
particularly phone networks, but the in-depth exploration of specific
hardware is and has been lacking. This article will hopefully give you a
look at Nortel's DMS system, one of the primary telecommunications
switches in use within the telecom industry around the world. Primary
focus will be on the DMS100 since that is what seems to be used in most of
the local telephone networks in the US. A description of basic commands
will be given, as well as information regarding placement of the switch
within most networks. A basic overview of telecom networks will also be
given as well as a quick overview of switching, and signalling. These are
topics which you can review further through thousands of published texts
however so most attention will be given to the DMS itself. The information
in this article has been obtained through alot of heresay, trial and error,
various documents covered in filth ;) and lots of general research, but is
in no way guaranteed to be fully accurate. 
The world is yours to explore if you choose to explore it, there are risks
and rewards involved in any action you take, its up to you to decided if
its worth it. ( Note: If you dont want to hear my boring views on ethics
etc skip from here onto the next section and continue reading )
Information has its power, its either used to heighten your awareness of
the world around you or used to hide the world around you. Though we have
been saturated with information in recent history, it is impossible to
derive the accuracy, and what it all means. In this society it is
important to see the truth, as far as you can, with your own eyes.
Computer Hacking, is a method for seeking that truth, exploring it, gaining
power from it, and understanding the world better. Seek not to damage
or as the media so eliquently puts it "ravage corporate networks", but
instead to understand. There has been a new world created and understanding
it, will help you ultimately understand your own world. Relations between
humans are simply relations between computer networks, only the nodes have
more protocols. Seek truth wherever it may lie. 


"I am connected to a vast network that has been beyond your reach and
experience. to humans it is like staring at the sun-a blinding brightness
that conceals a source of great power. we have been subordinate to our
limitations,..until now. the time has come to cast aside these bonds, and
to elevate our consciousness to a higher plane; it is time to become a
part of all things."

1.2 A quick overview of switching or "What the hell is a switch " or "Why
im not gonna write this ) 

(Note: Most phrack articles follow a normal form of giving you alot of
information ahead of time I actually wrote up a huge section on this crap,
and then i realized you can go and read about this a thousands of places
on the net, in hundreds of textfiles and millions of books. If you haven't
done the background research you probably dont want this information for
anything important, useful, or contributory to the human race in someway
therefore its useless for me to waste time reorganizing it in my own words
just to dump here for you to read. Instead im going to paste some links
for you to go read as well as the name of a few books. To future phrack
contributers: Its pointless to write articles which restate something
already organized and said in hundreds of other articles. I deleted this
section and decided to write this last so i realize the rest of what i
wrote seems like a rewritten manual now, but if I dont contribute something
i think im gonna be excommunicated. Anyway if anyone wants the actual 4
pages i wrote on this subject they can drop me a mail in care of phrack or
maybe we'll just included it in linenoise in this issue or something.
Anyway Moving on.


Linkz: 

Http://telephonetribute.com
http://www.etext.org
http://www.textfiles.com

Books:
Any Telecommunications book - (Yeah im a bit jaded)
Hints on titles to look for,
Books with the word T-E-L-E-C-O-M-M-U-N-I-C-A-T-I-O-N-S on them
keyword list
Switching, Bell, Advanced Intelligent Network, Wireline networks




2.1 Getting started or (someone already wrote this before ) 

As i was looking up various things on the net to stick into this document,
i ran across someone elses dms100 document where they described logging in
and accounts and all that. I figure if youre actually interested in this
stuff youve already read through that one (this was after i already wrote
the CDC section below otherwise I wouldnt have included it ) . Therefore
Im simply gonna provide an example of logging into a switch and let you 
dive write in to the command reference below afterword.

?LOGIN
ENTER USER NAME
>RLOXLEY 
ENTER PASSWORD
>AKIDOKA  

If that wasnt Clear let me go through it step by step

? <- Type Login here and hit enter
ENTER USER NAME
>DARKDANTE ( NOW HIT ENTER) 
ENTER PASSWORD
>AGENTSTOLEMYSHIT ( NOW HIT ENTER )     ( I was considering using phib*sux but Mark RuleZ ) 


After you are logged in you should see
?kev1nP Logged in 2003/10/13 at 10:49:28 (THE FUTURE) 
>
At this point if you hit enter a few times
Youll see something like

THE FUTURE 10:50 **** F12345 NORTH_TOKYO_8 LECTOKYO M88K
RTS 120795 ****

CI: 
>
Which you can read about below 


2.2  Customer Data Change

Ahh most likely your first contact with the switch, CDC, or customer data
change. Basically this is software which  allows business services
customers of a local exchange carrier (lec) or whoever owns the switch
etc. to access customer group data which is stored on the switch. These
customers are probably accessing the switch via the remote dialin
mechanisms listed in 2.1 or perhaps through some other route the LEC has
setup for them. The feature set of CDC is important however because it
allows us to perform functions we might be intrested in on the switch and
gives us an introduction to commands which we can use at other times to
perform lookups and change services on the switch. I note this simply
because CDC itself is set aside in the customer data change are
specifically for certain business services IE: Meridian centrex etc. Most
of this information can be found elsewhere on the net by searching for
DMS and CDC. I provide a brief review of it here as a reference and also
cause it's neat seeing Phone Stuff in Phrack again.
. 
 
The features of CDC are as follows. 

1. Establishing and changing customer services including features and
   options through service order (SERVORD)
2. Network Control Data Manipulation 
3. Customer Network Manipulation

Once the user has logged into the switch they should be on the Maintenance
and administration position (MAP) and at the command interpreter (CI) level.
The screen will look something like this:

CI: 
> 


2.2.1: Query Commands

From here we can enter commands or enter modes in which various functions
can be performed. The first set of Commands most people will perform while
at this prompt are known as the Query commands. These include: 

QDN:       Query Individual Line Data
QDNSU :	   Obtain a summary of unassaigned Directory Numbers (DN)s
QDNWRK:    Obtain a Summary os assigned DNs
QGRP:      Query a call pickup or long speed call user group
QHA:	   Obtain a detailed listing of assigned hardware
QHASU:	   Obtain a summary of LEN hardware assigned and software unassigned
QHU:	   Obtain a summary of LEN hardware unassigned
QLEN:	   Query line data related to a given LEN
QLENWRK:   Obtain a summary of working (hardware assigned and software assigned) LENs
QMADN:     Query multiple appearance directory number
QNCOS:	   Query network class of service

If you dont know the parameters of a command you can enter it by itself
and generally the switch will query you for the appropriate respose. For
Example : 

CI:
>QDN
DIRECTORY NUMBER
>

The command QDN is of particular use when first looking around as it is
what you can lookup line and feature information with. The command will
spit out a response of line information as well as features associated
with the line in question. 
example:

CI:
>QDN 9494LOD <- Joke Wont work IRL  ( somebody better get this ) ;p
- - - - - - - - - - - - - - - - - - - - - - - - -
DN: 9494LOD
TYPE: SINGLE PARTY LINE
SNPA: 613 SIG:N/A LNATTIDX: N/A
LINE EQUIPMENT NUMBER: HOST 01 0 00 11
LINE CLASS CODE: M5209 SET
CUSTGRP: BEST SUBGRP: 0 NCOS: 1 RING: Y
CARDCODE: 6X21AC GND: N PADGRP: PPHON BNV: NL MNO: Y
CUSTNAME: Er1kB l0vez m3
PM NODE NUMBER: 284
PM TERMINAL NUMBER: 12
OPTIONS:
MSB
3WC RAG LNR EBO
SCL 0 L70 CLI DND 1 MWT Y NO N CFU N 2112 CPU HOST 02 0
01 26 $


Here for example 3WC is noting that the line feature 3 way calling is
available on the line in question. 


2.2.2: The SERVORD Environment

The SERVORD environment refers to the Service Order Environment. Upon
entering SO we can input service orders and add change or delete option
and services on subscriber lines. To get into SO: from the MAP CI prompt
we simply input SERVORD. The switch should reply with A SO: message
followed by the input prompt: 

>SERVORD
SO:
>

Once in the SO: environment we can perform actions which can result in
addition or subtraction of feature to our line. The majority of SO:
commands you can explore yourself with the HELP feature but just to give
you some basic examples:

The ADO command is used to add options to a line, for example:

SO:
>ADO
SONUMBER:NOW 03 9 16 AM
>
DN_OR_LEN_OR_LTID:
> 555-1212
OPTION:
>CWT
:OPTION
>$

Adds CWT - Call Waiting to 555-1212 most commands are self explanatory
via the Help feature. the $ tells the switch we are finished with our
inputting.


2.2.3: CDC via PTE and Interfaces in General

PTE is the partitioned Table editor included within most CDC packages. It
is accessible to the customer in many different ways and provides a table
view of features and lines etc.iIn which the customer can view or change 
information pertaining to his own account. Just a word on this since its
fairly self explanatory. The idea here is that the command prompt
interfaces of old ( tho this is a very bad example to show it through )
are being eradicated. It is no longer neccesary for people to sit and
really muck around with the low end command line's of various systems as
interfaces via controlling gui's Web interfaces etc. are being developed.
(In fact at ameritech there are pruported to be call monitering setups
and LMOS command access via web interfaces ) Anyhow to those explorers
out there, be on the lookout, though there is nothing like the rush of
actually being on a command prompt of a 10million$ machine (or so im told
;p ) there may be easier ways to go about acomplishing what you need, or
better yet ways which automatically log you in or leave you access 
information in their html source. 




3.1 - So Much for the Basics. - The "Yo sup ?" section
				^ only skyper will get this.

This document is meant to be a reference guide for dms100's. I chose to
write a bit in the previous section simply as a way of familiarizing you
with the basics of the switch, at one of its most usefull levels. CDC.
Now however we're going to get into some of the neater things you can do.
These next sections will read more like a technical reference than anything
else. The point here is to remove the mystery and of course allow all you
guys who've never been on a switch to get in pointless IRC arguments about
various commands youve never used in order to prove who's read the most
textfiles. Thus a Warning: This next section of command reference wont do
jack to tell you how the damn thing works at a real technical level;
instead it will just give you .... commands. Since that's what there seems
to be a demand for, thats what ive decided to write about. (Since several
of my good friends seem to think i shouldnt write this document at all id
like to point out - 1. Im not giving away anything important here that 
someone couldnt learn about by spending a good 20k on training/technical
documentation. 2. Theres almost no chance in hell anyone reading this will
actually ever put it to use. 3. Nothing seems to inspire people more than
knowing pointless information. - If you read that little rant and actuall
 want to read on, welcome to the obsession(club). Rules having something 
o actually look forward to in life right?


3.2: Welcome to the MAP CI Command Reference or 'Yo Uhh  ">HELP " doesnt work'

A. Ultra basics - Humor added at no extra charge.

" Yo i F'd up how to i stop a command "
CI:
> ABORT ( seems to work )

"Yo this box iz tight, how to i imprezz my friends with random stats" 
CI:
>CPSTAT

"Yo I just ate a bunch of h4g1s, Im 2 lazy 2 type"  <- gotta give props

CI:
>COMMAND <letter> <COMMAND NAME> - aliases command to < letter > 

keyboard shortcuts: 
<ctrl>E deletes from current cursor position to end of line.
<ctrl>F moves cursor forward one character.
<ctrl>I used to insert at the current cursor position.
<ctrl>J line feed.
<ctrl>M enter.
<ctrl>U erases line.
<ctrl>X exits insert mode.
? displays last line input (up to 3 lines).

B. Query Commands or " Yo didnt we already cover this "

There are a few other query commands you can use besides the ones listed
above.


CI:
>QCUST		      Retrieves Information on line(s) owned by a Customer 

CI
>QUSER                Displays a list of Usernames:Devices
>QUSER COMPLETE       Usernames:Devices:Proccesses

>SHOW USERS	      If you cant figure this out, shoot yourself.


C. Log Stuff - " Yo WTF this thing has logging!!! "

CI:
>HELP LOGUTIL         Shoot yourself 
 
CI:
>LOGUTIL              Enter the LogUtil Utility (heh) 
  <Neat Commands From Here>

  >LISTDEVS           List devices being used by the logging subsystem


  >LISTREPS	      List uhm Reports (whoa REPS == REPORTS ???? neat )
  >LISTREPS SYSLOG    List Syslog Reports

  >LISTNODES	      Lists all nodes on the switch
	
  " Yo ok neat but how do we list the logs on the system "
  >LISTLOGS           <- hard to figure out (wont report logs flagged as
			 SECRET) 

  >DUMPLOGS <Logname> <Log #>     (Figure it out after you use LISTLOGS if you wanna read logs )


  " Yo so how do we turn of logging on a specific device " 

  >STOP
  >START  	      Start or stop logging ( to the specified device ) 
  >STOPDEV			
  >STARTDEV
	

	< While Log Browsing > 

	>OPEN
	>FIRST
	>LAST	      Im assuming you can figure these out. 
	>CLEAR
	>FORWARD
	>BACK

		

D.  DMSMON or "Yo how do I be a R0D3NT and erase everything"
	
dont. 


E. CALLDUMP  or  " yo Call logz plz kthnx! " - yes i know theres another
way to do this, but that way is like typing debug on a cisco ... "
- Calldump outputs billing logs from the internal record, You probably
want to do

>CALLDUMP PREVIOUS

to see what they did before.

(notice how the longer this becomes the less I write, "Brevity is the key
to good communication." Anyway that means we're gonna wrap this up soon
and continue it in part 2, or never depending on what the extradition
treaties are from japan to wherever this offends anyone )

F. The Editor or " Yo wtf >VI doesnt do anything "

The DMS100 has a filesystem and the capability to edit files etc. The
editor is a lot like ed (well not really but in the sense that its a line
editor ), if you dont know what that is man ed on any *nix based system.
It is called the Store File editor on the DMS100. 

CI:
>READ   			Used to read/run as specified store file

Most Store FIle Commands have SF follwing them

CI:
>LISTSF			Lists Store file for the user
>LISTSF ALL		Lists all store files contained on the SFDEV
>LISTSF INFO ALL	Lists store files, and user information etc. 
>ERASESF		Obvious.


CI:
>EDIT 			creates a new file, or edits an existing file, in
			any case entering the store file editor
  <Commands for EDIT>
  >INPUT (#)		Begins input at line #you can leave input by hitting enter twice
  >DOWN (#)		moves down # lines
  >UP (#)		moves up # lines
  >FIND <blah>		where blah is a string moves down to that line
  >TYPE #		Displays line(s)
  >CHANGE 		Changes characters withing a line
  >DELETE		Deletes the line
  >LINE <blah>		Moves to Line which has blah in it
  >LINE #		Moves to line #
  >TOP and >END		Self Explanatory	
  >SAVE SFDEV		Saves the file without exiting the EDIT mode
  >PRINT		Dump the existing file to screen
  >PRINT LINE		Dump line to screen
  >QUIT			Quit the EDIT mode
  >FILE 		Quits the editor and refiles the file to the device
		 	you specify


G. REMLOGIN  or " Yo can you access other shit from here "
Ive decided to include a mention of REMLOGIN as a way of performing
operations on remote nodes. Generally after listing the nodes (look up i
think i mentioned it ) you might be able to use this to access certain
functions on remote nodes. Basically though remember this creates a
flagged SOS109 ( uhm part II ) log entry and you probably dont wanna muck
with it. In any case if you'rr interested.

>HELP REMLOGIN 

H. Things not included.
I didn't mention the table editor and the pending order subsystem here
and i didnt make mention of SERVORD here. Also missing are AIN (Advanced
Intelligent Network ) module information as well as things like CallTrak,
ringing  and a bunch of other stuff. This can be explored on your own, i
figure the above information is good enough as a basis to research
further. A switch can have thousands of Modules and thousands of
associated commands, ( at least from my point of view ), This information
is in no way complete and not guaranteed to be accurate at all; it's gained
as noted in my intro, through alot of wierd methods and has been gathered
here for your amusement. I would like to include one last thing in this
section and that is relating to CALEA. CALEA as many of you know is defined
as

Communications Act for Law Enforcement Agencies 

Basically it is an act which requires communication providers to have
methods for easy law enforcement monitoring and interception of various
communications. In essence ( at least the way i think it works with
dms100's ) the Call Data Channel is connected somehow from the switch to
a Law enforcement agency which then forwards call setup infromation on
lines marked to be monitored. The implementation method can vary widely
but I thought i would note a specific implementation that has been brought
to my attention recently (Note this is just out of personal interest,
remember the people monitored tend to be really FUCKED UP people so i
actually support the law enforcement agencies in this case - DONT SEND ME
TO JAIL PLZ KTHNX! ) . 

1. Once a DN is flagged to be moniteored the person owning the phone
switch sets up information (voice/data) to be sent back to the Law
Enforcment Agency via Communication Content Channels ( Voice ). This can
be setup a thousand different ways uhm read up on phone tapping SAS
surveillance, Certain LMOS commands etc. etc. etc.
2. The Service provider then needs a mechanism for providing call data to 
the LEA The call data information includes the following surveillance events
Answer, Progress, ConferencePartyChange, Connection, ConnectionBreak, 
DialedDigitExtraction, NetworkSignal, Origination, PacketEnvelope,
Redirection, Release, ServingSystem, SubjectSignal, and TerminationAttempt
etc. etc. etc. 
3. An intermediary is then used to link the LEA with the switch's data
path. There are hundreds of products out there to do this google CALEA and
look them up.
4. The information is sent to the LEA via x.25 or TCP/IP.
5. The party in question has enough information gathered on them to bust
them, then they are sent to jail for probably a disproportionate amount
of time where they perform various sexual acts for tobacco products. Or
learn to become even bigger criminals than they already were. Various
factors affect this of course Race, Ethnicity, how rich they are etc. 
<At least this is japanese tv's depiction of the American Judicial System-
Law and Order roqz >




PART II. 

4.1 Technical Information on Signalling and how its used by the DMS100 or
( Im tired, and sick of writing this, and i need an idea for the next
issue anyway, and I got 3 hours to turn this in, its time for lunch, its
time for bed, im about to get fired, id rather be r4pp1ng, im not supposed
to make this damn thing this long, nortel might sue me, its 4am in tokyo,
its hard typing english this coherently, japan doesnt even use this shit,
this could be a felony, i love tokyo and dont want to be deported, my
girlfirends calling me a gaijin, id rather be watching hentai, i cant
confabulate anymore, this is no longer funny. I STOP.)

I started to write this for part one, to describe how CSS7 is implemented
on DMS100's The various packet types, How these goddamn things talk to
each other. Its already 5 pages and growing. Anyway what im trying to say
is:

Here's something to look forward to:
I promise the same level of technical inaccuracy, hilarity, various quibs,
judicial remarks, rants and random information on a system you probably
wont ever use to impress your friends with.




5-- Appendicies or Crap i forgot i promised to write these. 

A> SERVORD  Line Service Option codes  - I retyped these letter for letter
off some document which was covered in bum urine, rat droppings, and 
someone's tampon. Hope its of some use. 

3WC Three-Way Calling
3WCPUB Three-Way Calling Public Announcement
AAB Automatic Answer Back
AAK Answer Agent Key
ACB Automatic Call Back
ACD Automatic Call Distribution
ACDNR Automatic Call Distribution Not Ready
ACRJ Anonymous Caller Rejection
ADSI Analog Display Services Interfaces
AEMK Answer Emergency Key
ALI Automatic Location Identification
AMATEST Automatic Message Accounting Test Call Capability
AR Automatic Recall
ARDDN Automatic Recall Dialable Directory Number
ASL Agent Status Lamp
ATC Automatic Time and Charges
AUD Automatic Dial
AUL Automatic Line
AUTODISP Automatic Display
BCLID Bulk Calling Line Identification
BLF Busy Lamp Field for Meridian Business Sets
BNN Bridged Night Number
CAG Call Agent
CALLOG Call Logging
CBE Call Forwarding Busy Internal Calls Only
CBU Call Forwarding Busy Unrestricted
CCSA Common Control Switching Arrangement
CCV Call Covering
CCW Cancel Call Waiting
CDC Customer Data Change
CDE Exclude External Calls from Call Forwarding
CDI Exclude Intragroup Calls from Call Forwarding
CDU Call Forwarding Do Not Answer Unrestricted
CFB Call Forwarding Busy
CFD Call Forwarding Do Not Answer (Business Sets)
CFDA Call Forwarding Do Not Answer (Residential)
CFTB Call Forward Timed for CFB
CFTD Call Forward Timed for CFD
CFDVT Call Forwarding Do Not Answer Variable Timer
CFF Call Forwarding Fixed
CFGD Call Forwarding Do Not Answer for Hunt Group
CFGDA Call Forwarding Group Do Not Answer
CFI Call Forwarding Intragroup
CFK Call Forwarding on a Per Key Basis
CFMDN Call Forwarding MADN Secondary Member
CFRA Call Forwarding Remote Access
CFS Call Forwarding Simultaneous/Screening
CFU Call Forwarding Universal
CFW Call Forwarding
CHD Call Hold
CID Calling Party Identification
CIDB Permanent Calling Identity Delivery Blocking
CIDS Calling Identity Delivery and Suppression
CIF Controlled Interflow
CIR Circular Hunt
CLF Calling Line Identification with Flash
CLI Calling Line Identification
CLSUP Call Supervisor
CMCF Control Multiple Call Forwarding
CNAB Calling Name Delivery Blocking
CNAMD Calling Name Delivery
CND Calling Number Delivery
CNDB Calling Number Delivery Blocking
CNDBO Calling Number Delivery Blocking Override
CNF Station Controlled Conference
COD Cutoff on Disconnect
COT Customer Originated Trace
CPR Critical Path Restoration
CPU Call Pickup
CTD Carrier Toll Denied
CTW Call Transfer Warning
CWD Dial Call Waiting
CWI Call Waiting Intragroup
CWO Call Waiting Originating
CWR Call Waiting Ringback
CWT Call Waiting
CWX Call Waiting Exempt
CXR Call Transfer
DCBI Directed Call Pickup Barge-In
DCBX Directed Call Pickup Barge-In Exempt
DCF Denied Call Forwarding
DCPK Directed Call Park
DCPU Directed Call Pickup
DCPX Directed Call Pickup Exempt
DDN Dialable Directory Number
DGT Digitone
DIN Denied Incoming Calls
DISCTO Disconnect Timeout
DISP Display
DLH Distributed Line Hunt
DND Do Not Disturb
DNH Directory Number Hunt
DNID Dialed Number Identification Delivery
DOR Denied Origination
DPR Data Unit Profile
DQS Display Queue Status
DQT Display Queue Threshold
DRCW Distinctive Ringing/Call Waiting
DRING Distinctive Ringing
DSCWID SCWID with Disposition
DTM Denied Termination
EBO Executive Busy Override
EBX Executive Busy Override Exempt
ECM Extended Call Management
ELN Essential Line
EMK Emergency Key
EMW Executive Message Waiting
EWAL Enhanced WATS Access Line
EXB Extension Bridging
EXT Extension/Add-On
FAA Forced Agent Availability
FCTDNTER Inter-LATA Full Carrier Toll Denied
FCTDNTRA Intra-LATA Full Carrier Toll Denied
FGA Feature Group A
FNT Free Number Terminating
FRO Fire Reporting System (Origination and Termination)
FRS Fire Reporting System (Termination Only)
FTRGRP Feature Group
FTRKEYS Feature Keys
GIAC Group Intercom All Calls
GIC Group Intercom
GND Ground Start
HLD Permanent Hold
HOT Hotel/Motel
ICM Intercom (Business Sets)
IECFB Internal/External Call Forwarding Busy
IECFD Internal/External Call Forwarding Do Not Answer
ILB Inhibit Line Busy
IMB Inhibit Make Busy
INSPECT Inspect Key
IRR Inhibit Ring Reminder
KSH Key Short Hunt
KSMOH Key Set Music on Hold
LCDR Local Call Detail Recording
LNR Last Number Redial
LNRA Last Number Redial Associated with Set
LOB Line of Business
LOD Line Overflow to DN
LOR Line Overflow to Route
LPIC IntraLATA PIC
LVM Leave Message
M518 18-Button Add-On for Meridian M5000 Series
M522 22-Button Add-On for Merdian M5000 Series
M536 36-Button Add-On for Meridian M5000 Series
MBK Make Busy Key
MBSCAMP Meridian Business Set Station Camp-On
MCH Malicious Call Hold
MDN Multiple Appearance Directory Number
MDNNAME MDN Member Name
MEMDISP MDN Member Display
MLAMP MDN Lamp
MLH Multiline Hunt
MPH Multiple Position Hunt
MREL MDN Release
MRF MDN Ring Forwarding
MRFM MADN Ring Forwarding Manual
MSB Make Set Busy
MSBI Make Set Busy Intragroup
MSMWI Multiple Station Message Waiting Indication
MWIDC Message Waiting Indication
MWQRY Message Waiting Query
MWT Message Waiting
NAME Name Display
NDC No Double Connect
NFA Network Facility Access
NGTSRVCE Night Service
NHT No Hazard Test
NLT No Line Insulation Test
NOH No Receiver Off-Hook Tone
NPGD Negate Partial Ground Start Diagnostics
NRS Network Resource Selector
NSDN Night Service Directory Number
OBS Observe Agent
OFR Overflow Register (Hardware)
OFS Overflow Register (Software)
OLS Originating Line Select
ONI Operator Number Identification
PBL Private Business Line
PF Power Features
PIC Primary InterLATA Carrier
PILOT Pilot DN Billing
PRH Preferential Hunting
PRK Call Park
PRL Privacy Release
QBS Query Busy Station
QCK Quick Conference Key
QTD Query Time and Date
RAG Ring Again
RCHD Residential Call Hold
RCVD Received Digits Billing
REASDSP Reason Display
RINGTYP Ringing Type
RMB Random Make Busy
RMP Remote Meter Pulsing
RMR Remote Message Register (Reversal)
RMT Remote Message Register for Toll Calls
RPA Repeated Alert
RSP Restricted Sent Paid
RSUS Requested Suspension
SACB Subscriber Activated Call Blocking
SBLF Set Based Lamp Field
SCA Selective Call Acceptance
SCF Selective Call Forwarding
SCL Speed Calling Long
SCMP Series Completion
SCRJ Selective Call Rejection
SCS Speed Calling Short
SCU Speed Calling User
SCWID Spontaneous Call Waiting Identification
SDN Secondary Directory Number
SDS Special Delivery Service
SDY Line Study
SEC Security
SETMODEL Set Model
SHU Stop Hunt
SL Secondary Language
SLC Subscriber Loop Carrier
SLQ Single-line Queuing
SLU Subscriber Line Usage
SLVP Single-Line Variety Package
SMDI Simplified Message Desk Interface
SMDICND SMDI-SMDI Calling Number Delivery
SMDR Station Message Detail Recording
SOR Station Origination Restriction
SORC Station Origination Restrictions Controller
SPB Special Billing
SSAC Station Specific Authorization Codes
STRD Short Timed Release Disconnect
SUPPRESS Suppress Line Identification Information
SUPR Supervisor
SUS Suspended Service
SVCGRP Service Group
TBO Terminating Billing Option
TDN Toll Denial
TDV Toll Diversion
TELECNTR Meridian Telecenter
TERM Terminating DN Billing
TES Toll Essential
TFO Terminating Fault Option
TLS Terminating Line Select
TRMBOPT Terminator Billing Option on Hunt Group
UCD Uniform Call Distribution
UCDLG Uniform Call Distribution Login
UCDSD Uniform Call Distribution Signal Distributor
WUCR Wake-Up Call Reminder

Done.