FTP client session record (subtype 103)

This SMF record is available only from the real-time TCP/IP network monitoring NMI's SMF interface, SYSTCPSM, and is not written to the MVS™ SMF data sets. See Real-time TCP/IP network monitoring NMI for more information about the SYSTCPSM interface.

Table 1 shows the FTP client session record self-defining section.
Table 1. FTP client session record self-defining section
Offset Name Length Format Description
0 (X'0') Standard SMF header 24 N/A Standard SMF header; subtype is 103 (X'67')
Self-defining section
24 (X'18') SMF119SD_TRN 2 Binary Number of triplets in this record
26 (X'1A') Reserved 2 N/A Reserved
28 (X'1C') SMF119IDOff 4 Binary Offset to TCP⁄IP identification section *
32 (X'20') SMF119IDLen 2 Binary Length of TCP⁄IP identification section *
34 (X'22') SMF119IDNum 2 Binary Number of TCP⁄IP identification sections *
36 (X'24') SMF119S1Off 4 Binary Offset to FTP client session section
40 (X'28') SMF119S1Len 2 Binary Length of FTP client session section
42 (X'2A') SMF119S1Num 2 Binary Number of FTP client session sections
44 (X'2C') SMF119S2Off 4 Binary Offset to FTP client SOCKS section
48 (X'32) SMF119S2Len 2 Binary Length of FTP client SOCKS section
50 (X'34') SMF119S2Num 2 Binary Number of FTP client SOCKS sections
52 (X'34') SMF119S3Off 4 Binary Offset to FTP client security section
56 (X'38') SMF119S3Len 2 Binary Length of FTP client security section
58 (X'3A') SMF119S3Num 2 Binary Number of FTP client security sections
60 (X'3C') SMF119S4Off 4 Binary Offset to FTP client session user name section
64 (X'40') SMF119S4Len 2 Binary Length of FTP client session user name section
66 (X'42') SMF119S4Num 2 Binary Number of FTP client session user name section
*See Common TCP/IP identification section for the contents of the TCP⁄IP identification section.

Table 2 shows the FTP client session section.

Table 2. FTP client session section
Offset Name Length Format Description
0 (X'0') SMF119FT_FCNRIP 16 Binary Remote IP address (server)
16 (X'10') SMF119FT_FCNLIP 16 Binary Local IP address (client)
32 (X'20') SMF119FT_FCNRPort 2 Binary Remote port number (server)
34 (X'22') SMF119FT_FCNLPort 2 Binary Local port number (Client)
36 (X'24') SMF119FT_FCNUserID 8 EBCDIC Local User ID
44 (X'2C') SMF119FT_FCNReason 4 Binary Session end reason. The reason is a client error code as documented in FTP Client Error Codes in z/OS Communications Server: IP User's Guide and Commands. If no error occurred, the value of this field is 0.

This field is defined only when the value of the SMF119FT_FCNEvent field is T.
48 (X'30') SMF119FT_FCNEvent 1 EBCDIC
  • I: Session has started; client is logged into the server
  • T: Session has ended
49 (X'31') Reserved 3 Binary Reserved
52 (X'34') SMF119FT_FCNSTime 4 Binary Session start time, in one hundreths of a second, since midnight [using Coordinated Universal Time (UTC)].
56 (X'38') SMF119FT_FCNSDate 4 Binary Session start date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'.
60 (X'3C') SMF119FT_FCNETime 4 Binary Session end time, in one hundreths of a second, since midnight [using Coordinated Universal Time (UTC)].

This field is defined only when the value of SMF119FT_FCNEvent is T.

64 (X'40') SMF119FT_FCNEDate 4 Binary Session end date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'.

This field is defined only when the value of SMF119FT_FCNEvent is T.
68 (X'44') SMF119FT_FCNCConnID 4 Binary TCP connection ID of FTP control connection

Table 3 shows the FTP client SOCKS section, which is present only if the connection passes through a SOCKS server.

Table 3. FTP client SOCKS section
Offset Name Length Description
0(X'0') SMF119FT_FCCIP 16 SOCKS server IP address
16(X'10') SMF119FT_FCCPort 2 SOCKS server port number
18(X'12') SMF119FT_FCCProt 1 SOCKS protocol version. Possible values are:
  • X'01' SOCKS Version 4
  • X'02' SOCKS Version 5

Table 4 shows the FTP client security section:

Table 4. FTP client security section
Offset Name Length Format Description
0 (X'0') SMF119FT_FCMechanism 1 EBCDIC Protection mechanism. Possible values are:
  • N: None
  • T: TLS
  • G: GSSAPI
  • A: AT-TLS
1 (X'1') SMF119FT_FCCProtect 1 EBCDIC Control connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
2 (X'2') SMF119FT_FCDProtect 1 EBCDIC Data connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
3 (X'3') SMF119FT_FCLoginMech 1 EBCDIC Login method. Possible values are:
  • P: Password
  • C: Certificate
4 (X'4') SMF119FT_FCProtoLevel 8 EBCDIC Protocol level (present only if Protocol Mechanism value is TLS or AT-TLS). Possible values are:
  • SSLV2
  • SSLV3
  • TLSV1
  • TLSV1.1
  • TLSV1.2
12 (X'C') SMF119FT_FCCipherSpec 20 EBCDIC Cipher specification (present only if Protocol Mechanism value is TLS or AT-TLS).
Possible values when Protocol Level is SSLV2 are:
  • RC4 US
  • RC4 Export
  • RC2 US
  • RC2 Export
  • DES 56-bit
  • Triple-DES US
Possible values when Protocol Level value is SSLV3, TLSV1, TLSV1.1, or TLSV1.2 are:
  • SSL_NULL_MD5
  • SSL_NULL_SHA
  • SSL_RC4_MD5_EX
  • SSL_RC4_MD5
  • SSL_RC4_SHA
  • SSL_RC2_MD5_EX
  • SSL_DES_SHA
  • SSL_3DES_SHA
  • SSL_AES_128_SHA
  • SSL_AES_256_SHA
32 (X'20') SMF119FT_FCProtBuffSize 4 Binary Negotiated protection buffer size
36 (X'24') SMF119FT_FCCipher 2 EBCDIC Hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS). If the value is 4X, the Cipher Specification must be obtained from the SMF119FT_FCNCipher4 field.
38 (X'26') SMF119FT_FCFips140 1 Binary FIPS 140 status
  • X'00': FIPS 140 off
  • X'01': FIPS 140 on
  • X'02': FIPS 140 level 1
  • X'03': FIPS 140 level 2
  • X'04': FIPS 140 level 3
39 (X'27') SMF119FT_FCCipher4 4 EBCDIC Four byte hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS).
43(X'2B') SMF119FT_FCSessReuse 1 EBCDIC SSL session reuse:
  • N: None
  • A: Allowed
  • R: Required
44(X'2C') SMF119FT_FCCSSLSessIDLen 2 Binary Length of the SSL session ID of FTP control connection
46(X'2E') SMF119FT_FCCSSLSessID 32 Binary SSL session ID of FTP control connection
78(X'4E') SMF119FT_FCDSSLSessIDLen 2 Binary Length of the SSL session ID of FTP data connection
80(X'50') SMF119FT_FCDSSLSessID 32 Binary SSL session ID of FTP data connection

Table 5 shows the FTP client session user name section.

Table 5. FTP client session user name section
Offset Name Length Format Description
0(X'0') SMF119FT_FCNXUserID n EBCDIC User name or user ID used to log into the FTP server.