TCP connection termination record (subtype 2)

The TCP connection termination record is collected whenever a TCP connection is closed or aborted. The record is created only for connections that reached the established state. This record contains all pertinent information about the connection, such as elapsed time, bytes transferred, and other information.

Guidelines:
  • Because this information duplicates all of the information contained in the TCP connection initiation record, collect only the TCP connection termination record.
  • Because this record is generated for every single TCP connection, this can generate significant load on a server and rapidly fill the SMF data sets. Use this record with care.

See Table 1 for the contents of the TCP/IP stack identification section. For the TCP/IP connection termination record, the TCP/IP stack identification section indicates TCP as the subcomponent and X'08' (event record) as the record reason.

Table 1 shows the TCP connection termination self-defining section:
Table 1. TCP connection termination self-defining section
Offset Name Length Format Description
0(X'0') Standard SMF header 24   Standard SMF header
Self-defining section
24(X'18') SMF119SD_TRN 2 Binary Number of triplets in this record
26(X'1A')   2 Binary Reserved
28(X'1C') SMF119IDOff 4 Binary Offset to TCP/IP identification section
32(X'20') SMF119IDLen 2 Binary Length of TCP/IP identification section
34(X'22') SMF119IDNum 2 Binary Number of TCP/IP identification sections
36(X'24') SMF119S1Off 4 Binary Offset to TCP connection termination section
40(X'28') SMF119S1Len 2 Binary Length of TCP connection termination section
42(X'2A') SMF119S1Num 2 Binary Number of TCP connection termination sections
44 (X'2C') SMF119S2Off 4 Binary Offset to TCP connection termination Telnet information section
48 (X'30') SMF119S2Len 2 Binary Length of TCP connection termination Telnet information section
50 (X'32') SMF119S2Num 2 Binary Number of TCP connection termination Telnet information sections
52 (X'34') SMF119S3Off 4 Binary Offset to TCP connection termination Application Transparent Transport Layer Security (AT-TLS) information section
56 (X'38') SMF119S3Len 2 Binary Length of TCP connection termination AT-TLS information section
58 (X'3A') SMF119S3Num 2 Binary Number of TCP connection termination AT-TLS information sections
60 (X'3C') SMF119S4Off 4 Binary Offset to TCP connection termination ApplData section
64 (X'40') SMF119S4Len 2 Binary Length of TCP connection termination ApplData section
66 (X'42') SMF119S4Num 2 Binary Number of TCP connection termination ApplData sections
68 (X'44') SMF119S5Off 4 Binary Offset to TCP connection termination IP filter information section
72 (X'48') SMF119S5Len 2 Binary Length of TCP connection termination IP filter information section
74 (X'4A') SMF119S5Num 2 Binary Number of TCP connection termination IP filter information sections

Table 2 shows the TCP connection termination specific section of this SMF record.

Table 2. TCP connection termination section
Offset Name Length Format Description
0(X'0') SMF119AP_TTRName 8 EBCDIC TCP socket resource name (Address space name of address space that closed this TCP connection)
8(X'8') SMF119AP_TTConnID 4 Binary TCP socket resource ID (connection ID)
12(X'C') SMF119AP_TTTTLSCS 1 Binary AT-TLS connection status:
  • X'01': Connection is not secure
  • X'02': Connection handshake in progress
  • X'03': Connection is secure
13(X'D') SMF119AP_TTTTLSPS 1 Binary AT-TLS Policy Status:
  • X'00': Policy status is not known
  • X'01': AT-TLS function off
  • X'02': No policy defined for connection
  • X'03': Policy defined for connection; AT-TLS not enabled
  • X'04': Policy defined for connection; AT-TLS enabled
  • X'05': Policy defined for connection; AT-TLS enabled and Application Controlled
14(X'E') SMF119AP_TTTermCode 1 Binary Reason code for connection termination:
  • X'11': Error occurred during a send using FRCA(AFPA), possibly because the stack is terminating.
  • X'12': A persistent socket used by FRCA (AFPA) was closed by a FIN.
  • X'21': The connection was terminated because the stack was terminating.
  • X'22': Last stack that can own the dynamic VIPA bound to the socket is terminating
  • X'31': Intrusion detection found the connection to be malicious and closed the connection.
  • X'32': Connection was denied because of a NetAccess rule.
  • X'33': ACK received in lastack state.
  • X'41': The connection was terminated because of an administrator action (for example, using Netstat DRop/-D command or the NMI API).
  • X'42': The connection was terminated because the local IP address bound by the application has been deleted from the stack.
  • X'51': The connection from a client was terminated because the application closed the socket before performing an accept().
  • X'52': The application using the socket, closed the connection using a close().
  • X'53': A pascal routine issued an orderly close request.
  • X'54': A pascal routine issued a disconnect.
  • X'55': An error occurred during a pascal accept.
  • X'61': The connection was terminated because the client sent a reset.
14(X'E') (continued)      
  • X'71': The connection was closed because the same packet was being re-transmitted multiple times.
  • X'72': The connection was closed because the TCP window was reduced to 0 and multiple window probes were not acknowledged.
  • X'73': The connection was closed because multiple keepalive probes were not acknowledged.
  • X'74': The connection was terminated because the stack timed out waiting for a fin in the finwait-2 state.
  • X'75': The connection was terminated because a global TCP stall attack was detected.
  • X'76': The connection was terminated because a TCP queue size attack was detected.
15(X'F') SMF119AP_TTSMCStatus 1 Binary SMC-R status:
  • X'00': This connection does not use an SMC-R link.

    If SMF119AP_TTSMCReason is also X'0000', SMC-R link establishment was not attempted.

  • X'01': This connection uses an SMC-R link.
16(X'10') SMF119AP_TTSubtask 4 Binary Subtask Name (Address of MVS™ TCB for the task that owns this connection. This is not the subtask value specified on an INITAPI call.)
20(X'14') SMF119AP_TTSTime 4 Binary Time of day of connection establishment in 1/100 seconds since midnight (using Coordinated Universal Time (UTC))
24(X'18') SMF119AP_TTSDate 4 Packed Date of connection establishment
28(X'1C') SMF119AP_TTETime 4 Binary Time connection entered TIMEWAIT or LASTACK state in 1/100 seconds since midnight (using Coordinated Universal Time (UTC))
32(X'20') SMF119AP_TTEDate 4 Packed Date connection entered TIMEWAIT or LASTACK state.
36(X'24') SMF119AP_TTRIP 16 Binary Remote IP address at time of connection close.
52(X'34') SMF119AP_TTLIP 16 Binary Local IP address at time of connection close.
68(X'44') SMF119AP_TTRPort 2 Binary Remote port number at time of connection close.
70(X'46') SMF119AP_TTLPort 2 Binary Local port number at time of connection close.
72(X'48') SMF119AP_TTInBytes 8 Binary Inbound byte count.
80(X'50') SMF119AP_TTOutBytes 8 Binary Outbound byte count.
88(X'58') SMF119AP_TTSWS 4 Binary Send window size at time of connection close.
92(X'5C') SMF119AP_TTMSWS 4 Binary Maximum send window size.
96(X'60') SMF119AP_TTCWS 4 Binary Congestion window size at time of connection close.
100(X'64') SMF119AP_TTSMS 4 Binary Send segment size at time of connection close.
104(X'68') SMF119AP_TTRTT 4 Binary Round trip time in milliseconds at time of connection close.
108(X'6C') SMF119AP_TTRVA 4 Binary Round trip time variance estimator at time of connection close, in milliseconds.
112(X'70') SMF119AP_TTStatus 1 Binary Socket status:
  • X'00': Passive Open (this is a server socket)
  • X'01': Active Open (this is a client socket)
113(X'71') SMF119AP_TTTOS 1 Binary Type of Service (ToS) used by this connection.
114(X'72') SMF119AP_TTXRT 2 Binary This field is deprecated. It has a maximum value of 65535. If the actual count exceeds 65535, this value does not wrap and remains at 65535. Use field SMF119AP_TTXRT32 to obtain the actual count.
116(X'74') SMF119AP_TTProf 32 EBCDIC Service profile name.
148(X'94') SMF119AP_TTPol 32 EBCDIC Service Policy name at the time of connection close.
180(X'B4') SMF119AP_TTInSeg 8 Binary Inbound segment count.
188(X'BC') SMF119AP_TTOutSeg 8 Binary Outbound segment count.
196(X'C4') SMF119AP_TTSSTCK 8 Binary MVS TOD clock value at time of connection establishment.
204(X'CC') SMF119AP_TTESTCK 8 Binary MVS TOD clock value at time connection entered TIMEWAIT or LASTACK state.
212(X'D4') SMF119AP_TTDupAcksRcvd 4 Binary Total Number of DUP ACKs received on the connection.
216(X'D8') SMF119AP_TTLclSMCLinkId 4 Binary
  • Local SMC-R link ID when the SMF119AP_TTSMCStatus value is X'01'.
  • Local SMC-D link ID when the SMF119AP_TTSMCDStatus value is X'01'.
220(X'DC') SMF119AP_TTRmtSMCLinkId 4 Binary
  • Remote SMC-R link ID when the SMF119AP_TTSMCStatus value is X'01'.
  • Remote SMC-D link ID when the SMF119AP_TTSMCDStatus value is X'01'.
224(X'E0') SMF119AP_TTSMCReason 4 Binary Reason code for SMC-R link establishment failure if not an internal error:
  • X'5013': RDMA connectivity failure
  • X'5203': Insufficient virtual storage.
  • X'5204': The SMCR FIXEDMemory parameter limit was reached.
  • X'5205': TCP connection limit was reached.
  • X'5206': The Virtual LAN (VLAN) ID was not found.
  • X'5209': There are no qualifying active "RoCE Express®" interfaces.
  • X'5219': Peer is out of synchronization.
  • X'521E': Peer subnet or prefix mismatches.
  • X'5301': Peer did not accept SMC-R request.
  • X'5302': The route is not eligible for SMC-R.
  • X'5303': There are no active "RoCE Express" interfaces for the PnetID.
  • X'5304': The connection is local.
  • X'5306': No storage for SMC negotiation.
  • X'5307': The connection uses IPSec.
  • X'5308': The connection is used by a Fast Response Cache Accelerator (FRCA) server.
  • X'5309': The connection is used by a Pascal API application.
  • X'530A': The server port was configured with the NOSMC option.
  • X'530B': The peer had an invalid MTU size for this SMC-R link.
  • X'530C': No valid IPv6 prefixes existed for the associated OSD interface.
  • X'530D': AUTOSMC monitoring detected that SMC-R communications cannot be used for this connection.
224(X'E0') (continued)      
  • Other non-zero reason code values:
    • Internal error, if the SMF119AP_TTSMCRSNRMT (X'80') bit is off in SMF119AP_TTSMCFlags.
    • Remote peer set the value, if the SMF119AP_TTSMCRSNRMT (X'80') bit is on in SMF119AP_TTSMCFlags. See the documentation of the peer product for more information.
228(X'E4') SMF119AP_TTSMCFlags 1 Binary Flags:
  • X'80': SMC-R reason set by peer
  • X'40': Route cached to not use SMC-R
  • X'20': SMC-D reason set by peer
  • X'10': Route cached to not use SMC-D
229(X'E5') SMF119AP_TTSMCDStatus 1 Binary SMC-D link status:
  • X'00': The SMC-D link is inactive. If the SMF119AP_TTSMCDReason value is also X'0000', SMC-D link establishment has not been attempted.
  • X'01': The SMC-D link is active.
230(X'E6') SMF119AP_TTrsv 1 Binary Reserved
231(X'E7') SMF119AP_TTIPsecurityFlags 1 Binary IP security Flags:
  • x'80': IP security is enabled (SMF119AP_TTIPsecurityEnbl)
  • x'40': IPv6 security is enabled (SMF119AP_TTIPv6securityEnbl)
  • x'20': IP filtering done for connection (SMF119AP_TTIPFltrIncl)
232(X'E8') SMF119AP_TTLclSMCBufSz 4 Binary
  • The size of the RMB element that the local host uses to receive data on this connection from the remote host. The value is in KB and is valid only when the SMF119AP_TTSMCStatus value is X'01'.
  • The size of the DMB element that the local host uses to receive data on this connection from the remote host. The value is in KB and is valid only when the SMF119AP_TTSMCDStatus value is X'01'.
236(X'EC') SMF119AP_TTRmtSMCBufSz 4 Binary
  • The size of the RMB element that the remote host uses to receive data on this connection from the local host. The value is in KB and is valid only when the SMF119AP_TTSMCStatus value is X'01'.
  • The size of the DMB element that the remote host uses to receive data on this connection from the local host. The value is in KB and is valid only when the SMF119AP_TTSMCDStatus value is X'01'.
240(X'F0') SMF119AP_TTXRT32 4 Binary Number of times retransmission was required for this connection.
244(X'F4') SMF119AP_TTSMCDReason 4 Binary Reason code for SMC-D link establishment failure if not an internal error:
  • X'5302': The route is not eligible for SMC-D.
  • X'5306': No storage exists for SMC negotiation.
  • X'5307': The connection uses IPSec.
  • X'5308': The connection is used by a Fast Response Cache Accelerator (FRCA) server.
  • X'5309': The connection is used by a Pascal API application.
  • X'530A': The server port was configured with the NOSMC option.
  • X'530C': No valid IPv6 prefixes existed for the associated OSD interface.
  • X'530D': AUTOSMC monitoring detected that SMC-D communications cannot be used for this connection.
  • X'530E': No active ISM interfaces exist for the PnetID.
  • X'530F': Peer did not accept SMC-D request.
  • X'5708': Peer is not reachable for SMC-D.
  • X'5803': Virtual storage is insufficient.
  • X'5804': The SMCD FIXEDMemory parameter limit was reached.
  • X'5805': TCP connection limit was reached. No LMBs are available.
  • X'5806': The Virtual LAN (VLAN) ID was not found.
  • X'5809': No qualifying active ISM interfaces exist.
  • X'5819': Peer is out of synchronization.
  • X'581E': Peer subnet or prefix mismatches.
244(X'F4') (continued)      
  • Other non-zero reason code values:
    • Internal error, if the SMF119AP_TTSMCDRSNRMT (X'20') bit is off in SMF119AP_TTSMCFlags.
    • Remote peer set the value, if the SMF119AP_TTSMCDRSNRMT (X'20') bit is on in SMF119AP_TTSMCFlags. See the peer product's documentation for more information. A reason code of FFFFFFFF indicates that the TCP/IP stack could not obtain the reason code from the peer.

Table 3 shows the TCP connection termination Telnet specific section of this SMF record. This section is present only when the given TCP connection represented a TN3270 Telnet connection.

Table 3. TCP connection termination Telnet section
Offset Name Length Format Description
0(X'0') SMF119AP_TTTelLUName 8 EBCDIC LU name
8(X'8') SMF119AP_TTTelAppl 8 EBCDIC Target application name
16(X'10') SMF119AP_TTTelLogmode 8 EBCDIC Logmode name
24(X'18') SMF119AP_TTTelStatus 4 Binary Status word:
  • x80000000: Definite response mode
  • x40000000: The connection is being performance monitored
  • x00000004: TN3270E mode
  • x00000002: TN3270 mode
  • x00000001: Line mode
28(X'1C') SMF119AP_TTTelTermCode 1 Binary Reason code for closing connection. The socket must be accessible to the TN3270 server to record a reason. (for example, SMF119AP_TTTermCode for this record is X'52'.) See the description of EZZ6034I in z/OS Communications Server: IP Messages Volume 4 (EZZ, SNM) for a list of reason codes and their descriptions.
29(X'1D') SMF119AP_TTTelRsv 3 Binary Reserved

Table 4 shows the TCP connection termination AT-TLS-specific section of this SMF record.

Restriction: This section is present only when the given TCP connection was secured by AT-TLS (SMF119AP_TTTTLSCS is X'03').
Table 4. TCP connection termination AT-TLS section
Offset Name Length Format Description
0 (X'0') SMF119AP_TTTTLSSP 2 Binary AT-TLS SSL Protocol:
  • X'0200': SSL Version 2
  • X'0300': SSL Version 3
  • X'0301': TLS Version 1.0
  • X'0302': TLS Version 1.1
  • X'0303': TLS Version 1.2
2(X'2') SMF119AP_TTTTLSNC 2 EBCDIC AT-TLS Negotiated Cipher. If the value is 4X, the cipher must be obtained from SMF119AP_TTTTLSNC4.
4(X'4') SMF119AP_TTTTLSST 1 Binary AT-TLS Security Type:
  • X'01': Client
  • X'02': Server
  • X'03': Server with client authentication, ClientAuthType = PassThru
  • X'04': Server with client authentication, ClientAuthType = Full
  • X'05': Server with client authentication, ClientAuthType = Required
  • X'06': Server with client authentication, ClientAuthType = SAFCheck
5(X'5') SMF119AP_TTTTLSFP 1 Binary FIPS 140 status
  • X'00': FIPS 140 off
  • X'01': FIPS 140 on
  • X'02': FIPS 140 level 1
  • X'03': FIPS 140 level 2
  • X'04': FIPS 140 level 3
6(X'6') SMF119AP_TTTTLSRSV1 2 Binary Reserved
8(X'8') SMF119AP_TTTTLSUID 8 EBCDIC AT-TLS Partner UserID
16(X'10') SMF119AP_TTTTLSNC4 4 EBCDIC AT-TLS Negotiated Four Byte Cipher
20(X'14') SMF119AP_TTTTLSSESSID 32 Binary AT-TLS session ID
52(X'34') SMF119AP_TTTTLSSESSIDLEN 2 Binary Length of the AT-TLS session ID
54(X'36') SMF119AP_TTTTLSSRU 1 Binary SSL session reuse
  • X'00': Reuse session required off
  • X'01': Reuse session required on

Table 5 shows the TCP connection termination application-specific section of this SMF record. The ApplData section provides the application-specific information that is associated with a TCP connection. See SIOCSAPPLDATA IOCTL for information about how applications can use the SIOCSAPPLDATA ioctl to associate application-specific data with a TCP connection.

This section is present only when the given TCP connection has application data associated with it.

The content of this field is determined by the application that owns the connection. For z/OS® Communications Server applications, see the information about Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application. This field typically contains all printable EBCDIC characters, although some applications might include some binary data.

Table 5. TCP connection termination ApplData section
Offset Name Length Format Description
0 (X'0') SMF119AP_TTAPPLDATA 40 Varies For z/OS Communications Server applications, see Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application.

Table 6 shows the TCP connection termination IP filter section of this SMF record.

Restriction:
  • This section is present if IP filtering is active and an IP filter rule applies to the traffic (SMF119AP_TTIPFltrIncl flag is set). The IP filter section is not included for intra-host connections because IP filtering is not done for those connections.
  • The filter rule information reflects the IP filter rules in place at the time that the connection is terminated. If IP filter policy changes while a connection is active, only the names of the IP filter rules in place at the time of the termination are included.
  • In certain cases, only outbound filter information is provided. For example, when the AES-GCM algorithm is used and the connection is distributed to a target TCP/IP stack, IP filtering of inbound traffic occurs on the distributing stack and is not available to the target stack where the SMF record is generated. Another example is when the DVLOCALFLTR keyword is configured in the TCP/IP profile. In this case, IP filtering is done on outbound for traffic destined to a DVIPA but if it is determined that it is intra-host traffic, IP filtering is bypassed on inbound.
Table 6. TCP connection termination IP filter section
Offset Name Length Format Description
0(X'0') SMF119AP_TTFLTROUTACT 1 Binary Action for the matching outbound filter rule specified by SMF119AP_TTFLTROUTNAME and SMF119AP_TTFLTROUTEXT
  • X'01': Outbound traffic is permitted in the clear
  • X'02': Outbound traffic is protected by IPsec
  • X'03': Outbound traffic is denied
1(X'1') SMF119AP_TTFLTRINACT 1 Binary Action for the matching inbound filter rule specified by SMF119AP_TTFLTRINNAME and SMF119AP_TTFLTRINEXT
  • X'00': Inbound traffic is not filtered (SMF119AP_TTFLTRINNAME and SMF119AP_TTFLTRINEXT are blank)
  • X'01': Inbound traffic is permitted in the clear
  • X'02': Inbound traffic is protected by IPsec
  • X'03': Inbound traffic is denied
2(X'2') SMF119AP_TTFLTRRsv 2 Binary Reserved
4(X'4') SMF119AP_TTFLTROUTNAME 40 EBCDIC Matching outbound filter rule name.
44(X'2C') SMF119AP_TTFLTROUTEXT 8 EBCDIC Matching outbound filter rule name extension.
52(X'34') SMF119AP_TTFLTRINNAME 40 EBCDIC Matching inbound filter rule name.
92(X'5C') SMF119AP_TTFLTRINEXT 8 EBCDIC Matching inbound filter rule name extension.