FTP server session record (subtype 104)

This SMF record is available only from the real-time TCP/IP network monitoring NMI's SMF interface, SYSTCPSM, and is not written to the MVS™ SMF data sets. See Real-time TCP/IP network monitoring NMI for more information about the SYSTCPSM interface.

Table 1 describes the FTP server session record.
Table 1. FTP server session record
Offset Name Length Format Description
0 (X'0') Standard SMF header 24 N/A Standard SMF header; subtype is 104 (X'68')
Self-defining section
24 (X'18') SMF119SD_TRN 2 Binary Number of triplets in this record
26 (X'1A')   2 Binary Reserved
28 (X'1C') SMF119IDOff 4 Binary Offset to TCP⁄IP identification section. *
32 (X'20') SMF119IDLen 2 Binary Length of TCP⁄IP identification section. *
34 (X'22') SMF119IDNum 2 Binary Number of TCP⁄IP identification sections. *
36 (X'24') SMF119S1Off 4 Binary Offset to FTP server session section
40 (X'28') SMF119S1Len 2 Binary Length of FTP server session section
42 (X'2A') SMF119S1Num 2 Binary Number of FTP server session sections
44 (X'2C') SMF119S2Off 4 Binary Offset to FTP server security section
48 (X'30') SMF119S2Len 2 Binary Length of FTP server security section
50 (X'32') SMF119S2Num 2 Binary Number of FTP server security sections.
* See Common TCP/IP identification section for the contents of the TCP⁄IP identification section.

Table 2 describes the server session section.

Table 2. Server session section
Offset Name Length Format Description
0 (X'0') SMF119FT_FSRRIP 16 Binary Remote IP address
16 (X'10') SMF119FT_FSRLIP 16 Binary Local IP address
32 (X'20') SMF119FT_FSRRPort 2 Binary Remote port number (client)
34 (X'22') SMF119FT_FSRLPort 2 Binary Local port number (server)
36 (X'24') SMF119FT_FSRUserID 8 Binary Client user ID
44 (X'2C') SMF119FT_FSRReason 4 Binary Session end reason.
  • X'00': Normal session end; QUIT or REIN command received
  • X'01': Security authentication or negotiation failed; incorrect specification of security keywords; possible security handshake deadlock
  • X'02': Control connection socket error; network error
  • X'03': Control connection closed prematurely
  • X'04': Sequence received on control connection was not valid

This field is valid only when the value of the SMF119FT_FSREvent field is T.
48 (X'30') SMF119FT_FSREvent 1 Binary Session event
  • I: Session start; client is logged into server
  • T: Session has ended
49 (X'31') Reserved 3 Binary Reserved
52(X'34') SMF119FT_FSRSTime 4 Binary Session start time in hundreths of a second since midnight [using Coordinated Universal Time (UTC)].
56 (X'38') SMF119FT_FSRSDate 4 Binary Session start date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'. (FTP sessions start date).
60 (X'3C') SMF119FT_FSRETime 4 Binary Session end time in hundreths of a second since midnight [using Coordinated Universal Time (UTC)]. This field is defined only when the value of the SMF119FT_FSREvent field is T.
64 (X'40') SMF119FT_FSREDate 4 Binary Session end date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'. This field is defined only when the value of the SMF119FT_FSREvent field is T.
68 (X'44') SMF119FT_FSRCConnID 4 Binary TCP connection ID of FTP control connection
72 (X'48') SMF119FT_FSRSessionID 15 EBCDIC FTP activity logging session ID
87 (X'57')   1 N/A Reserved

Table 3 describes the FTP server security section.

Table 3. FTP server security section
Offset Name Length Format Description
0 (X'0') SMF119FT_FSMechanism 1 EBCDIC Possible values are:
  • N: None
  • T: TLS
  • G: GSSAPI
  • A: AT-TLS
1 (X'1') SMF119FT_FSCProtect 1 EBCDIC Control connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
2 (X'2') SMF119FT_FSDProtect 1 EBCDIC Data connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
3 (X'3') SMF119FT_FSLoginMech 1 EBCDIC Login method:
  • P: Password
  • C: Certificate
  • T: Kerberos ticket
4 (X'4') SMF119FT_FSProtoLevel 8 EBCDIC Protocol level (present only if Protocol Mechanism is TLS or AT-TLS).
Possible values are:
  • SSLV2
  • SSLV3
  • TLSV1
  • TLSV1.1
  • TLSV1.2
12 (X'C') SMF119FT_FSCipherSpec 20 EBCDIC Cipher specification (present only if the value of Protocol Mechanism is TLS or AT-TLS).
Possible values when Protocol Level is SSLV2:
  • RC4 US
  • RC4 Export
  • RC2 US
  • RC2 Export
  • DES 56-Bit
  • Triple DES US
Possible values when Protocol Level is SSLV3, TLSV1, TLSV1.1, or TLSV1.2:
  • SSL_NULL_MD5
  • SSL_NULL_SHA
  • SSL_RC4_MD5_EX
  • SSL_RC4_MD5
  • SSL_RC4_SHA
  • SSL_RC2_MD5_EX
  • SSL_DES_SHA
  • SSL_3DES_SHA
  • SSL_AES_128_SHA
  • SSL_AES_256_SHA
32 (X'20') SMF119FT_FSProtBuffSize 4 Binary Negotiated protection buffer size
36 (X'24') SMF119FT_FSCipher 2 EBCDIC Hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS). If the value is 4X, the Cipher Specification must be obtained from the SMF119FT_FSNCipher4 field.
38 (X'26') SMF119FT_FSFips140 1 Binary FIPS 140 status
  • X'00': FIPS 140 off
  • X'01': FIPS 140 on
  • X'02': FIPS 140 level 1
  • X'03': FIPS 140 level 2
  • X'04': FIPS 140 level 3
39 (X'27') SMF119FT_FSCipher4 4 EBCDIC Four byte hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS).
43(X'2B') SMF119FT_FSSessReuse 1 EBCDIC SSL session reuse:
  • A: Allowed
  • R: Required
44(X'2C') SMF119FT_FSCSSLSessIDLen 2 Binary Length of the SSL session ID of FTP control connection
46(X'2E') SMF119FT_FSCSSLSessID 32 Binary SSL session ID of FTP control connection
78(X'4E') SMF119FT_FSDSSLSessIDLen 2 Binary Length of the SSL session ID of FTP data connection
80(X'50') SMF119FT_FSDSSLSessID 32 Binary SSL session ID of FTP data connection