ISDN + POTS Telephony at Congress and Camp

ISDN + POTS Telephony at Congress and Camp

Speakers: Harald "LaF0rge" Welte

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=_Pq9wTTGpbo

Overview

Harald "LaF0rge" Welte's talk, "ISDN + POTS Telephony at Congress and Camp," delves into the ambitious project undertaken by the C3 ISDN team to establish and operate a fully functional, real-world legacy digital telephone network at Chaos Communication Congress (CCC) events. This endeavor provides attendees with access to traditional analog and Integrated Services Digital Network (ISDN) services, from voice calls and faxing to dial-up internet and Bulletin Board Systems (BBSs), using authentic telecommunications equipment from the 1980s to early 2000s.

The talk highlights the critical importance of preserving digital heritage by maintaining operational examples of foundational technologies that underpinned early digital communication. Welte, a prominent figure in the retro networking community, articulates the challenges and triumphs of deploying complex infrastructure like a Siemens EWSD switch, Synchronous Digital Hierarchy (SDH) transport, and V5 access multiplexers within a temporary event environment. This project not only offers a unique retro experience but also serves as a living museum, ensuring that the intricacies of circuit-switched telephony remain accessible for study and exploration.

This initiative is significant for several reasons: it demonstrates the practical application of historical telecommunications technology, addresses the limitations of modern Voice over IP (VoIP) for legacy services, and fosters a deeper understanding of the infrastructure that shaped the internet's predecessors. By meticulously recreating a traditional telephone exchange, the C3 ISDN team provides a tangible link to the hacker community's deep historical roots in telecommunications, offering both nostalgic appeal and invaluable educational opportunities for a new generation of technologists.

Background

▶ Watch: Introduction and CCC's telecom heritage (0:00)

The Chaos Computer Club (CCC) has a rich and long-standing history intertwined with data and telecommunications. From the early days of DFÜ (Datenfernübertragung) – German for wide-area networking – and the iconic DIY acoustic coupler, to the infamous BTX hack of the 1980s, the CCC community has consistently explored and pushed the boundaries of communication technologies. This tradition continued through the dial-up era, with hackers exploring Unix machines, BBSs, and networks like the German X.25 network (DXP), eventually embracing ISDN. This deep engagement fostered a unique relationship between the hacker community and the underlying infrastructure of telecommunications.

Historically, telephony at CCC events has been managed by teams like "falk" and the "event phone team" for over two decades. They began with traditional circuit-switched Private Branch Exchanges (PBXs), primarily Alcatel systems, supporting proprietary telephones and DECT cordless phones. These systems utilized Time-Division Multiplexing (TDM) and Primary Rate ISDN uplinks to the external world, representing the state-of-the-art in event telephony for many years. However, in recent times, the Phone Operation Center (POC) at CCC events has fully migrated to modern VoIP solutions. Even DECT base stations are now connected over IP, effectively eliminating traditional circuit-switched elements from the primary event phone network. This evolution mirrors the broader industry trend where public telephone networks have largely transitioned from circuit-switched to IP-based infrastructure.

While modern VoIP, DECT, and GSM networks (operated by the C3GSM team) excel at voice communication, they often struggle with legacy communication services. Dial-up modems over VoIP, for instance, typically offer limited bit rates and unreliable connections. Similarly, ISDN data calls and services like telefax, BTX, or Miniel are either impractical or impossible to operate effectively over modern, packet-switched voice-centric technologies. This gap motivated the formation of the C3 ISDN team. Their mission is to operate a classic digital telephone network, reflecting the 1980s-2010 era, to provide authentic analog and ISDN subscriber lines. Crucially, their approach emphasizes reenactment – using real, decommissioned telco equipment at all levels of the stack – rather than mere emulation, aiming to preserve this vital part of digital heritage.

Key Findings

▶ Watch: Why modern VoIP fails legacy services (3:16)

The central achievement and key finding of the C3 ISDN team's work is the successful deployment and operation of a full-scale, authentic, and interconnected legacy digital telephone network at a major contemporary hacker event. This project demonstrates that it is not only feasible but highly valuable to resurrect and run complex, decommissioned telecommunications infrastructure. The team's ability to integrate this vintage network with modern VoIP, GSM, and public telephone networks, using a unified numbering plan, represents a significant technical and organizational accomplishment.

A particularly notable finding is the successful minimization and adaptation of the Siemens EWSD switch. Originally requiring eight racks for even the smallest configuration, the team, led by "Jolly," managed to condense an operational, albeit non-redundant, EWSD system into a single rack. This involved emulating hard disk and tape drives and utilizing remote subscriber line termination units, a configuration not documented by Siemens. This innovation made the deployment of such a complex piece of equipment practical for a temporary event setting, proving that historical hardware can be re-engineered for new contexts.

Furthermore, the project highlights the practical challenges and solutions involved in integrating disparate technologies across different eras. The team’s custom engineering efforts, such as building breakout boards for high-density connectors and designing self-contained wooden boxes for V5 access multiplexers, showcase ingenuity in overcoming hardware limitations and adapting equipment for field deployment. The successful provision of legacy services like reliable modem dial-up internet (with real public IPv4 addresses), functional fax-to-Fediverse gateways, and accessible BBSs underscores the unique value proposition of this retro networking initiative, proving that these services can indeed thrive outside of their original technological context.

Technical Deep Dive

▶ Watch: C3 ISDN team's mission: Real telecom reenactment (4:21)

The C3 ISDN network at CCC events is an intricate tapestry of interconnected legacy telecommunications components, meticulously assembled to replicate a functional public telephone network from the late 20th century. At its core, the network comprises three main logical elements: a central telephone exchange, a transport network, and remote subscriber line termination equipment.

The heart of the system is the Siemens EWSD (Elektronisches WählSystem Digital), a digital telephone switch widely deployed in over 100 countries, including Germany, where it was the primary system. These massive switches, typically comprising at least eight racks in their smallest commercial configurations, have largely been phased out from public networks. The C3 ISDN team's significant achievement here was to reduce the EWSD to a minimal operational system within a single rack. This required removing all redundancy, emulating hard disk and tape drives, and relying entirely on remote subscriber line termination units. The physical EWSD unit, affectionately adorned with custom "eyes," features plexiglass safety covers to prevent electrostatic discharge (ESD) from curious hackers. The team has been instrumental in rescuing at least five EWSDs globally, preserving this critical piece of digital heritage, with some now residing in museums. The challenge of acquiring operational software, often destroyed for privacy reasons when switches are decommissioned, was a major hurdle, overcome by securing units that still retained their original software releases.

Connecting the central EWSD switch to various parts of the venue is the SDH (Synchronous Digital Hierarchy) transport network. SDH, a fiber-optic transmission standard from the late 1980s, is entirely service-agnostic, designed to carry digital bitstreams. It is the European equivalent of the American SONET standard. The C3 ISDN team operates at the STM-1 level, providing 155 Megabits per second (Mbps) of bandwidth, capable of carrying 63 E1 carriers, which translates to 1,890 concurrent voice calls over a single fiber. The choice of SDH reflects its historical role in carrying primary digital E1 carriers within public networks. The team utilizes Ericsson Maronei Oms 860 add-drop multiplexers for ring topologies and RAD FCD55 terminal multiplexers for point-to-point connections. A particular challenge was the building's use of multimode fibers, whereas 1980s telecom equipment typically used singlemode fibers. This necessitated the use of later-generation SDH equipment with SFP slots to accommodate multimode transceivers, demonstrating adaptation to existing infrastructure constraints. The SDH network also efficiently distributes clock signals, with the EWSD acting as the master clock, which is recovered and retransmitted by each SDH unit along the ring, ensuring synchronous operation without phase shift issues over the event's distances.

At the edges of the network, terminating the subscriber lines, are the V5 access multiplexers. These units represent a later evolution of digital telephone networks, emerging in the 1990s to enable remote subscriber line termination, reducing the need for a full exchange in every town. The team primarily uses Nokia Exos N20 units, which originally had a capacity of up to 480 analog or 240 ISDN basic rate interfaces per rack-mount unit. Given the distributed nature of CCC events, the team engineered custom wooden self-contained carry boxes for these multiplexers, complete with power supplies and fans. To simplify subscriber connections and reduce manual labor, custom RJ45 breakout boards were designed and fabricated. These boards replace half of the original line cards in the Nokia Exos N20, providing convenient RJ45 jacks for individual ISDN or analog lines, significantly streamlining field deployment compared to individual soldering or wire-wrapping.

The overall network architecture integrates these components seamlessly. Primary Rate ISDN subscribers (e.g., those bringing their own PBXs) connect directly to the EWSD, bypassing the V5 multiplexers. Northbound from the EWSD, services like the Livingston PortMaster 3 RAS server (for dial-up), a YATE-based fax and service machine, and a custom ISDN-to-SIP gateway named "Noodle" are connected. Noodle provides full integration with the event's modern POC (VoIP), C3GSM, and the public telephone network, enabling calls to and from the legacy network across all platforms with a unified numbering plan.

Demo / Proof of Concept

▶ Watch: Dissecting classic telephone network components (6:00)

The C3 ISDN team's entire operational network serves as a comprehensive demonstration and proof of concept for the viability and utility of legacy telecommunications infrastructure in a modern context. It showcases the practical application of historical hardware to provide services that are either impossible or severely degraded on contemporary IP-based networks.

Attendees at CCC events can connect to the network via analog voice telephony or modem and ISDN dial-up. The network supports a variety of BBSs, including a dedicated "C3BS" for the event. For internet dial-up, analog connections are supported at speeds of 2,400 bps and higher, while ISDN offers 64 Kbps per channel, with channel bundling for higher rates. Critically, the network provides actual public IPv4 addresses to dial-up users (from a /23 range provided by the NOC), replicating the authentic internet experience of decades past. To manage the inherent security risks of directly exposing legacy systems to the modern internet, inbound filtering with stateful packet filtering is implemented, preventing background port scans and other unsolicited traffic from overwhelming modem lines.

Beyond basic connectivity, the network offers a suite of unique services:

• Chaos Post Gateway: A dial-up service allowing users to write postcards from their terminals.
• ISDN Video Telephony: While fully functional, interfacing with modern open-source software remains a challenge due to the complex multiplexing layers of the H.320 standard, requiring significant development effort.
• Fax Services: A robust offering including public fax machines, a fax-to-Fediverse gateway (custom development that posts received faxes to the Fediverse), and fax polling services (e.g., for retrieving the event phone book).

The service infrastructure relies on specific legacy hardware:

• Livingston PortMaster 3: This Remote Access Server (RAS) handles up to 60 concurrent modem or ISDN dial-up calls over two E1 lines. It ingeniously routes BBS access by querying a RADIUS server, which returns a Telnet IP address and port, allowing users to dial into BBSs located anywhere on the planet through the PortMaster.
• Cisco AS5400: As an experiment and for potential future capacity, a Cisco AS5400 is on standby, capable of terminating 480 modem calls in parallel, demonstrating preparedness for increased demand.
• YATE on N100 Mini PC: An open-source ISDN USB primary rate interface connected to a small N100 mini PC runs the YATE software, hosting the fax polling services and the custom fax-to-Fediverse gateway.

Joining the network is designed to be accessible. Users locate one of the V5 access network boxes (the custom wooden units) distributed across the venue. The team assists with cable routing and provides NTBAs (Network Termination Basic Access) and other necessary adapters. Pre-configured analog and ISDN line cards offer fixed phone numbers. For those without their own equipment, public fax machines, ISDN video phones, and analog phones are available at the EWSD exchange. The team also encourages attendees to provide their own services, whether by connecting a modem to a server, using enterprise-grade ISDN primary interfaces, or exposing a BBS via Telnet for integration with the PortMaster. Voice services can also be attached via SIP, integrating them with the broader event phone network. This hands-on approach not only demonstrates the technology but actively invites participation and experimentation.

Defensive Implications

▶ Watch: The Siemens EWSD switch and network deployment (8:00)

Operating a legacy telecommunications network in a modern, open environment like a hacker conference presents unique defensive implications, largely centered on operational security, digital preservation, and understanding historical attack surfaces. Unlike typical security talks that focus on vulnerabilities in new systems, this project highlights the challenges of integrating and securing decades-old technology.

One primary defensive consideration is the isolation and filtering required when connecting legacy systems to the modern internet. The talk explicitly mentions that while dial-up internet users receive real public IPv4 addresses, inbound connections are filtered using stateful packet filtering. This is a crucial measure to prevent the exposed modem lines and potentially older operating systems from being overwhelmed by the constant background noise of internet port scans and malicious traffic. Without such filtering, the legacy systems would be rendered unusable or quickly compromised, demonstrating a practical defensive posture for retro-networking projects.

From a broader security perspective, the project serves as an invaluable resource for digital forensics and security research. By maintaining operational examples of switches like the EWSD, which are still used in some production environments globally, researchers can study their internal workings, protocols, and potential vulnerabilities in a controlled setting. The speaker notes the difficulty of obtaining software for these switches due to strict licensing and destruction policies for privacy reasons. This scarcity means that the team's efforts to preserve both hardware and software are critical for future security analysis, allowing understanding of how these complex systems were designed and how they might be exploited or defended. The proprietary and often undocumented nature of these systems means that security through obscurity is often the norm, and open study is essential to uncover potential weaknesses.

Furthermore, the very act of reenactment allows for the exploration of historical attack vectors. While not explicitly discussed as "defensive," understanding how systems like ISDN and POTS were attacked in their prime (e.g., phreaking techniques, toll fraud, or early data interception methods) provides context for modern network security. By operating these systems, the team inadvertently creates a living laboratory where historical security challenges can be revisited and understood in a hands-on manner, informing current best practices for securing critical infrastructure, even if the direct relevance to modern exploits is limited. The project also highlights the operational security challenges of running complex, multi-vendor legacy equipment, where patching and modern security updates are non-existent, emphasizing the need for network segmentation and careful access control.

Key Takeaways

• Digital Heritage Preservation: The C3 ISDN team is actively preserving critical pieces of digital heritage by operating real, decommissioned telecommunications equipment from the 1980s-2000s, like the Siemens EWSD switch, rather than relying on emulation.
• Legacy Service Enablement: The project successfully provides functional analog and ISDN services (voice, fax, dial-up internet, BBS access) that are impractical or impossible to reliably deliver over modern VoIP-centric networks.
• Innovative Hardware Adaptation: The team demonstrates significant ingenuity in adapting legacy hardware for event deployment, including minimizing the EWSD to a single rack, building custom wooden enclosures for V5 multiplexers, and designing RJ45 breakout boards for easier subscriber connections.
• Integrated Network Architecture: A complex network integrating the EWSD, SDH transport, and V5 access multiplexers is fully interconnected with modern VoIP (POC), GSM (C3GSM), and the public telephone network, all operating under a unified numbering plan.
• Authentic Dial-up Experience: The network offers a genuine dial-up internet experience, providing real public IPv4 addresses to users, albeit with necessary inbound filtering to protect legacy systems from modern internet noise.
• Educational and Community Value: The initiative serves as a living museum, offering hands-on experience with foundational telecommunications technology, fostering a deeper understanding of network history, and encouraging community participation in setup, operation, and service provision.

About the Speaker(s)

Harald "LaF0rge" Welte is a prominent figure in the open-source and retro networking communities, known for his deep technical expertise and dedication to digital preservation. As a key member of the C3 ISDN team, he is instrumental in the design, deployment, and operation of the legacy ISDN and POTS network at Chaos Communication Congress events. Welte is passionate about keeping "digital heritage alive," actively rescuing and operating historical telecommunications equipment like the Siemens EWSD switches. His work extends beyond mere operation; he is a vocal advocate for understanding the underlying technologies of communication, contributing to a broader community of enthusiasts focused on historical digital communications technology. His talks consistently blend deep technical detail with the cultural and historical significance of the projects he undertakes.