Paul TimminsMadison Heights, Michigan
I’m a Principal Network Engineer of a Midwest regional ISP/telephone company and owner of Timmins Technologies. I build networks, work on telecom problems, and keep a basement lab for the questions that follow me home.
Explore my projects A little about me01 / Selected work
TelcoData / Timmins Technologies
I run TelcoData, a database of the North American telephone network. Look up exchanges, carriers, rate centers, and switches, or dig into numbering history and carrier footprints.
Explore TelcoDataA transmit-and-receive proof of concept using the Flipper Zero’s built-in CC1101 radio. It can detect and decode MeshCore Public and Meshtastic LongFast traffic, and experiment with transmitting; it also includes chat, local discovery, and logging.
Flipper-LoRa-DetectTurn Meshtastic over-the-air coverage reports from MQTT-connected nodes into a heatmap. A way to see how far your Meshtastic mesh reaches.
MeshtasticCoverageMapA userspace daemon that responds to Cisco GRE keepalives on Linux, allowing the originating router to track whether its tunnel is actually reachable.
linux-gre-keepaliveHome Assistant add-ons, including an MQTT bridge for JGY/inverteriot solar charge controllers. Connecting another piece of hardware to the rest of the house.
ha-addonsThis loads alongside OpenHop on the same Raspberry Pi, and bridges Public (or other channels) tx/rx, does wardriver detection, new node alerts, and has propogation tests and configurable node maintenance (logs node health telemetry, updates clock if the clock drifts or the node reboots)
OpenHop2Telegram02 / Talks & presentations
Technical ideas, practical lessons,
and the stories behind them.
Penguicon ↗ · 2026
Revisiting my original 2013 slide deck to show how the telephone network changed over 13 years: fiber and PON access, SIP-based voice and carrier interconnection, STIR/SHAKEN, and the shift of legacy TDM equipment toward the edges of the network.
Hackfest.ca ↗ · Nov 1, 2015
Why the telephone network’s trust model creates security problems, from caller ID spoofing and impersonation to toll fraud and call interception. A tour through physical infrastructure, carrier interconnection, and number portability connects how calls travel with where things go wrong. Covers vulnerable voicemail and PBX configurations, SIP signaling and media, and layered defenses against fraud, eavesdropping, and abuse.
Penguicon ↗ · 2013
Follow a landline call from the box on the side of your house through the copper local loop, central office, and onward to another caller. A tour of the physical telephone network: demarcation points, T1 smartjacks, cable vaults, switches, and transport, with a Detroit-area network map and diagrams showing how local and long-distance calls travel through tandems and carriers.
NOTACON 4 ↗ · 2007
An expert panel I organized for all things telecom, with an experienced central-office equipment installer, a PBX technician, and other industry practitioners. Entirely audience Q&A: bring your questions.
NOTACON 3 ↗ · 2006
A firsthand discussion of what a federal hacking case looks like from the inside, in the defendant’s chair. What to do if you find yourself caught up in a crime you had no part of, and what not to do.
Rubicon 5 ↗ · 2003
Where should the line be drawn on vulnerability disclosure? A panel examining developers’ responsibility to fix security flaws, whether publicizing vulnerabilities does more good than harm, and how publishing exploit scripts and tools changes that balance.
03 / Original work
Small discoveries, working experiments, and the details behind them.
Radio · Home lab · 2025
A Neptune R900 meter, an RTL-SDR, a decoder I wrote, and a small tool to send the readings into Home Assistant. Now the graph shows the rhythm of water use around the house.
Read the field note →Radio · Aviation · 2013-current
A practical index of antenna, RTL-SDR, dump1090, feed-format, MLAT, and aviation-data links from my ADS-B notes, plus stats from my receiver.
Read the field note →Radio · MeshCore · In progress
A working note on my MeshCore repeaters and CoreScope installation. I’m filling in the setup, coverage, and lessons learned.
Read the field note →04 / Behind the projects
Since 2006, my work has included the move from a resale-based operation to a facilities-based carrier and ISP: building network presence, deploying VoIP, and developing new services. My work spans IP routing, firewalls, SS7, MPLS, SONET, and the technical and regulatory sides of network interconnection.
Through Timmins Technologies, I do telecommunications consulting and contract programming, and run TelcoData. When I can get my hands on unfamiliar hardware, it goes in the basement lab. When I can’t, I study the protocols and how it works until I can.
I’m also an FAA Advanced Ground Instructor and Remote Pilot, and hold an FCC General Radiotelephone Operator License (GROL). Through Timmins Aviation, LLC, I’ve provided Part 107 drone services since 2017, including work involving airspace authorizations, waivers, and difficult locations.
For more than a decade, I’ve volunteered in Scouting as a unit, district, and council leader. I’ve also completed Wood Badge.
Licenses, certifications & training ↓
Get in touch: paul@timmins.net
05 / Licenses, certifications & training
These credentials have expired and are listed as professional history.