Sprintnet (formarly Telenet)

Telenet has more computers hooked to it than any other system in the world
once you consider that from Telenet you have access to Tymnet, ItaPAC, JANET,
DATAPAC, SBDN, PandaNet, THEnet, The Internet, and a whole host of other
networks, all of which you can connect to from your terminal.

The first step that you need to take is to identify your local dialup port.
This is done by dialing 1-800-546-2500 (1200 or higher 7E1) and connecting.
It will spout some garbage at you and then you'll get a prompt saying
'TERMINAL= '. This is your terminal type.  If you have vt100 emulation, type
it in now.  Or just hit return and it will default to dumb terminal mode.

You'll now get a prompt that looks like a @.  From here, type @c mail <cr> and
then it will ask for a Username.  Enter 'phones' for the username.  When it
asks for a password, enter 'phones' again.  From this point, it is menu driven.
Use this to locate your local dialup, and call it back locally.  If you don't
have a local dialup, then use whatever means you wish to connect to one long
distance (more on this later).

When you call your local dialup, you will once again go through the TERMINAL=
stuff, and once again you'll be presented with a @.  This prompt lets you know
you are connected to a Telenet PAD.  PAD stands for either Packet
Assembler/Disassembler (if you talk to an engineer), or Public Access Device
(if you talk to Telenet's marketing people.)  The first description is more
correct.

Telenet works by taking the data you enter in on the PAD you dialed into,
bundling it into a 128 byte chunk (normally... this can be changed), and then
transmitting it at speeds ranging from 9600 to 19,200 baud to another PAD, who
then takes the data and hands it down to whatever computer or system it's
connected to.  Basically, the PAD allows two computers that have different baud
rates or communication protocols to communicate with each other over a long
distance.  Sometimes you'll notice a time lag in the remote machines response.
This is called PAD Delay, and is to be expected when you're sending data
through several different links.

What do you do with this PAD?  You use it to connect to remote computer
systems by typing 'C' for connect and then the Network User Address (NUA) of
the system you want to go to.

An NUA takes the form of   031103130002520
                           \___/\___/\___/
                             |    |    |
                             |    |    |____ network address
                             |    |_________ area prefix
                             |______________ DNIC


This is a summary of DNIC's according to their country and network name.


DNIC   Network Name    Country          DNIC   Network Name    Country
_______________________________________________________________________________
                                     |
02041   Datanet 1       Netherlands  |  03110   Telenet         USA
02062   DCS             Belgium      |  03340   Telepac         Mexico
02080   Transpac        France       |  03400   UDTS-Curacau    Curacau
02284   Telepac         Switzerland  |  04251   Isranet         Israel
02322   Datex-P         Austria      |  04401   DDX-P           Japan
02329   Radaus          Austria      |  04408   Venus-P         Japan
02342   PSS             UK           |  04501   Dacom-Net       South Korea
02382   Datapak         Denmark      |  04542   Intelpak        Singapore
02402   Datapak         Sweden       |  05052   Austpac         Australia
02405   Telepak         Sweden       |  05053   Midas           Australia
02442   Finpak          Finland      |  05252   Telepac         Hong Kong
02624   Datex-P         West Germany |  05301   Pacnet          New Zealand
02704   Luxpac          Luxembourg   |  06550   Saponet         South Africa
02724   Eirpak          Ireland      |  07240   Interdata       Brazil
03020   Datapac         Canada       |  07241   Renpac          Brazil
03028   Infogram        Canada       |  09000   Dialnet         USA
03103   ITT/UDTS        USA          |  07421   Dompac          French Guiana
03106   Tymnet          USA          |

There are two ways to find interesting addresses to connect to.  The first and
easiest way is to obtain a copy of the LOD/H Telenet Directory from the LOD/H
Technical Journal 4 or 2600 Magazine.  Jester Sluggo also put out a good list
of non-US addresses in Phrack Inc. Newsletter Issue 21.  These files will tell
you the NUA, whether it will accept collect calls or not, what type of computer
system it is (if known) and who it belongs to (also if known.) However many
of these sources are real out dated and many of the dont exist anymore.
or use a worm program to map out networks.
The second method of locating interesting addresses is to scan for them
manually.  On Telenet, you do not have to enter the 03110 DNIC to connect to a
Telenet host.  So if you saw that 031104120006140 had a VAX on it you wanted to
look at, you could type @c 412 614 (0's can be ignored most of the time).
If this node allows collect billed connections, it will say 412 614 CONNECTED
and then you'll possibly get an identifying header or just a Username: prompt.
If it doesn't allow collect connections, it will give you a message such as 412
614 REFUSED COLLECT CONNECTION with some error codes out to the right, and
return you to the @ prompt.
There are two primary ways to get around the REFUSED COLLECT message.  The
first is to use a Network User Id (NUI) to connect.  An NUI is a username/pw
combination that acts like a charge account on Telenet.  To collect to node
412 614 with NUI junk4248, password 525332, I'd type the following:
@c 412 614,junk4248,525332  <---- the 525332 will *not* be echoed to the
screen.  The problem with NUI's is that they're hard to come by unless you're a
good social engineer with a thorough knowledge of Telenet (in which case you
probably aren't reading this section), or you have someone who can provide you
with them.
The second way to connect is to use a private PAD, either through an X.25 PAD
or through something like Netlink off of a Prime computer (more on these two
below).
The prefix in a Telenet NUA oftentimes (not always) refers to the phone Area
Code that the computer is located in (i.e. 713 xxx would be a computer in
Houston, Texas).  If there's a particular area you're interested in, (say, New
York City 914), you could begin by typing @c 914 001 <cr>.  If it connects, you
make a note of it and go on to 914 002.  You do this until you've found some
interesting systems to play with.
Not all systems are on a simple xxx yyy address.  Some go out to four or five
digits (914 2354), and some have decimal or numeric extensions (422 121A = 422
121.01).  You have to play with them, and you never know what you're going to
find.  To fully scan out a prefix would take ten million attempts per prefix.
For example, if I want to scan 512 completely, I'd have to start with 512
00000.00 and go through 512 00000.99, then increment the address by 1 and try
512 00001.00 through 512 00001.99.  A lot of scanning.  There are plenty of
neat computers to play with in a 3-digit scan, however, so don't go berserk
with the extensions.
Sometimes you'll attempt to connect and it will just be sitting there after one
or two minutes.  In this case, you want to abort the connect attempt by sending
a hard break (this varies with different term programs, on Procomm, it's
ALT-B), and then when you get the @ prompt back, type 'D' for disconnect.
If you connect to a computer and wish to disconnect, you can type <cr> @ <cr>
and you it should say TELENET and then give you the @ prompt.  From there, type
D to disconnect or CONT to re-connect and continue your session uninterrupted.


Outdials, Network Servers, and PADs
                                     
In addition to computers, an NUA may connect you to several other things. One
of the most useful is the outdial.  An outdial is nothing more than a modem
you can get to over telenet -- similar to the PC Pursuit concept, except that
these don't have passwords on them most of the time.
When you connect, you will get a message like 'Hayes 1200 baud outdial,
Detroit, MI', or 'VEN-TEL 212 Modem', or possibly 'Session 1234 established on
Modem 5588.'  The best way to figure out the commands on these is to type ? or
H or HELP -- this will get you all the information that you need to use one.
Safety tip here -- when you are hacking *any* system through a phone dialup,
always use an outdial or a diverter, especially if it is a local phone number
to you.  More people get popped hacking on local computers than you can
imagine, Intra-LATA calls are the easiest things in the world to trace
inexpensively.
Another nice trick you can do with an outdial is use the redial or macro
function that many of them have.  First thing you do when you connect is to
invoke the 'Redial Last Number' facility.  This will dial the last number used,
which will be the one the person using it before you typed.  Write down the
number, as no one would be calling a number without a computer on it.  This is
a good way to find new systems to hack.  Also, on a VENTEL modem, type 'D' for
Display and it will display the five numbers stored as macros in the modem's
memory.
There are also different types of servers for remote Local Area Networks (LAN)
that have many machine all over the office or the nation connected to them.
I'll discuss identifying these later in the computer ID section.
And finally, you may connect to something that says 'X.25 Communication PAD'
and then some more stuff, followed by a new @ prompt.  This is a PAD just like
the one you are on, except that all attempted connections are billed to the
PAD, allowing you to connect to those nodes who earlier refused collect
connections.
This also has the added bonus of confusing where you are connecting from.  When
a packet is transmitted from PAD to PAD, it contains a header that has the
location you're calling from.  For instance, when you first connected to
Telenet, it might have said 212 44A CONNECTED if you called from the 212 area
code.  This means you were calling PAD number 44A in the 212 area.  That 21244A
will be sent out in the header of all packets leaving the PAD.
Once you connect to a private PAD, however, all the packets going out from *it*
will have it's address on them, not yours.  This can be a valuable buffer
between yourself and detection.




                         Sprintnet Terminal Identifiers
 
 
Enter the  identifier for your  particular terminal  model in response  to the
Sprintnet inquiry TERMINAL=.
 
If you  are using  an asynchronous  ASCII CRT  terminal model  which does  not
appear on the list, you may assume the correct code to be D1.   This will work
in the majority of cases.  However, if you are unsure, simply press a carriage
return in response to the prompt.
 
 
           Code    Terminal Model
 
           D1      ADDS CONSUL 520, 580, 980
           D1      ADDS ENVOY 620, REGENT SERIES
           A1      ALANTHUS DATA TERMINAL T-133
           A8      ALANTHUS DATA TERMINAL T-300
           A3      ALANTHUS DATA TERMINAL T-1200
           A2      ALANTHUS MINITERM
           D1      AM-JACQUARD AMTEXT 425
           D1      ANDERSON JACOBSEN 510
           B1      ANDERSON JACOBSEN 630
           B3      ANDERSON JACOBSEN 830, 832
           B5      ANDERSON JACOBSEN 860
           D1      APPLE II
           D1      ATARI 400, 800
           D1      AT&T DATASPEED 40, 40/1, 40/2
           D1                     43
           D1      BEEHIVE MINIBEE, MICROBEE, SUPERBEE
           A8      CENTRONICS 761
           D1      COMMODORE PET
           D1      COMPU-COLOR II
           A2      COMPUTER DEVICES CDI 1030
           A8      COMPUTER DEVICES TELETERM 1132
           A2      COMPUTER DEVICES MINITERM 1200 SERIES
           A2      COMPUTER TRANSCEIVER EXECUPORT 300, 380, 3000
           A9      COMPUTER TRANSCEIVER EXECUPORT 1200
           A8      COMPUTER TRANSCEIVER EXECUPORT 4000
           D1      CPT 6000, 8000
           D1      DATAMEDIA ELITE
           D1      DATAPOINT 1500,1800,2200,3000,3300,3600,3800
           A1      DATA PRODUCTS PORTATERM
           B3      DATA TERMINAL & COMMUNICATIONS DTC 300, 302
           B3      DIABLO HYTERM
           D1      DIGI-LOG 33 & TELECOMPUTER II
           A8      DIGITAL EQUIPMENT (LA 35-36) DECWRITER II
           A8                        (LA 120) DECWRITER III
           D1      DIGITAL EQUIPMENT VT50, VT52, VT100, WS78, WS200
           B3      GEN-COMM SYSTEMS 300
           A5      GE TERMINET 30
           A4      GE TERMINET 300
           A3      GE TERMINET 120, 1200
           D1      GENERAL TERMINAL GT-100A, GT-101, GT-110
           D1      HAZELTINE 1500, 1400, 2000
           D1      HEWLETT PACKARD 2640 SERIES
           D1      IBM 3101
           D1      INFORMER 1304, D304
           D1      INFOTON 100, 200, 400, VISTAR
           D1      INTELLIGENT SYSTEMS INTECOLOR
           D1      INTERTEC INTERTUBE II
           D1      LANIER WORD PROCESSOR
           D1      LEAR SIEGLER ADM SERIES
           D1      LEXITRON 1202, 1303
           A2      MEMOREX 1240
           D1      MICOM 2000, 2001
           D1      NBI 3000
           A2      NCR 260
           D1      PERKIN-ELMER MODEL 1100, OWL, BANTAM
           A8      PERKIN-ELMER CAROUSEL 300 SERIES
           D1      RADIO SHACK TRS 80
           D1      RESEARCH INC. TELERAY
           D1      TEKTRONIX 4002-4024
           A1      TELETYPE MODEL 33, 35
           D1                     40
           B3                     43
           D1                     40/1, 40/2, 40/3
           A7      TEXAS INSTRUMENT 725
           A2                       733
           A6                       735
           D1                       743, 745, 763, 765
           B3                       820
           D1                       99/4
           B1      TRENDATA 4000 (ASCII)
           A2      TYMSHARE 110, 212
           A8               315
           B3               325
           B4      UNIVAC DCT 500
           D1      WANG 20, 25, 30, 015, 130, 145
           A1      WESTERN UNION EDT 33, 35
           A3                        300
           A4                        1200
           D1      XEROX 800, 850, 860
           B3      XEROX 1700



  General Notes
 
 
 1.  Because Sprintnet provides local echoing of characters, your terminal and
     coupler  must  both be  in FULL-DUPLEX  mode.  If you  type ahead  of the
     prompts,  the  input  data  may  be echoed  immediately  and  may  appear
      interspersed among the output data.
 
 2.  The response to a "BREAK" character may be delayed up to two (2) or three
     (3) lines while Sprintnet outputs data from its buffers.
 
 3.  If a carriage return (<CR>) is  input followed by a commercial "at"  sign
     (@) and another carriage return  (<CR>), you will automatically revert to
     Sprintnet's Command Language  and receive a commercial "at"  sign (@) and
     another carriage  return (<CR>).  To return to  the host  session, simply
     type CONTINUE, followed by a carriage return <CR>.

 4.  Certain characters,  such as  Control O  and Control X,  may not  produce
     desired results.
 
 5.  Users  must enter  the numeric  X.121 host  address (3126NNNNNNNN).  Host
     alphernumerics or names are not supported.

If you need any assistance, contact ADP Autonet Client Support at 800-521-2733
in Ann  Arbor, Michigan. Contact  your ADP Autonet Account  Representative for
the specific host address.

X.25 Dial Service sends your data in the enhanced X.25 protocol
directly from a single terminal or a large cluster of terminals
attached to a terminal concentrator supporting X.25.


