TCP connection termination record (subtype 2)
The TCP connection termination record is collected whenever a TCP connection is closed or aborted. The record is created only for connections that reached the established state. This record contains all pertinent information about the connection, such as elapsed time, bytes transferred, and other information.
- Because this information duplicates all of the information contained in the TCP connection initiation record, collect only the TCP connection termination record.
- Because this record is generated for every single TCP connection, this can generate significant load on a server and rapidly fill the SMF data sets. Use this record with care.
See Table 1 for the contents of the TCP/IP stack identification section. For the TCP/IP connection termination record, the TCP/IP stack identification section indicates TCP as the subcomponent and X'08' (event record) as the record reason.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0(X'0') | Standard SMF header | 24 | Standard SMF header | |
Self-defining section | ||||
24(X'18') | SMF119SD_TRN | 2 | Binary | Number of triplets in this record |
26(X'1A') | 2 | Binary | Reserved | |
28(X'1C') | SMF119IDOff | 4 | Binary | Offset to TCP/IP identification section |
32(X'20') | SMF119IDLen | 2 | Binary | Length of TCP/IP identification section |
34(X'22') | SMF119IDNum | 2 | Binary | Number of TCP/IP identification sections |
36(X'24') | SMF119S1Off | 4 | Binary | Offset to TCP connection termination section |
40(X'28') | SMF119S1Len | 2 | Binary | Length of TCP connection termination section |
42(X'2A') | SMF119S1Num | 2 | Binary | Number of TCP connection termination sections |
44 (X'2C') | SMF119S2Off | 4 | Binary | Offset to TCP connection termination Telnet information section |
48 (X'30') | SMF119S2Len | 2 | Binary | Length of TCP connection termination Telnet information section |
50 (X'32') | SMF119S2Num | 2 | Binary | Number of TCP connection termination Telnet information sections |
52 (X'34') | SMF119S3Off | 4 | Binary | Offset to TCP connection termination Application Transparent Transport Layer Security (AT-TLS) information section |
56 (X'38') | SMF119S3Len | 2 | Binary | Length of TCP connection termination AT-TLS information section |
58 (X'3A') | SMF119S3Num | 2 | Binary | Number of TCP connection termination AT-TLS information sections |
60 (X'3C') | SMF119S4Off | 4 | Binary | Offset to TCP connection termination ApplData section |
64 (X'40') | SMF119S4Len | 2 | Binary | Length of TCP connection termination ApplData section |
66 (X'42') | SMF119S4Num | 2 | Binary | Number of TCP connection termination ApplData sections |
68 (X'44') | SMF119S5Off | 4 | Binary | Offset to TCP connection termination IP filter information section |
72 (X'48') | SMF119S5Len | 2 | Binary | Length of TCP connection termination IP filter information section |
74 (X'4A') | SMF119S5Num | 2 | Binary | Number of TCP connection termination IP filter information sections |
Table 2 shows the TCP connection termination specific section of this SMF record.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0(X'0') | SMF119AP_TTRName | 8 | EBCDIC | TCP socket resource name (Address space name of address space that closed this TCP connection) |
8(X'8') | SMF119AP_TTConnID | 4 | Binary | TCP socket resource ID (connection ID) |
12(X'C') | SMF119AP_TTTTLSCS | 1 | Binary | AT-TLS connection status:
|
13(X'D') | SMF119AP_TTTTLSPS | 1 | Binary | AT-TLS Policy Status:
|
14(X'E') | SMF119AP_TTTermCode | 1 | Binary | Reason code for connection termination:
|
14(X'E') (continued) |
|
|||
15(X'F') | SMF119AP_TTSMCStatus | 1 | Binary | SMC-R status:
|
16(X'10') | SMF119AP_TTSubtask | 4 | Binary | Subtask Name (Address of MVS™ TCB for the task that owns this connection. This is not the subtask value specified on an INITAPI call.) |
20(X'14') | SMF119AP_TTSTime | 4 | Binary | Time of day of connection establishment in 1/100 seconds since midnight (using Coordinated Universal Time (UTC)) |
24(X'18') | SMF119AP_TTSDate | 4 | Packed | Date of connection establishment |
28(X'1C') | SMF119AP_TTETime | 4 | Binary | Time connection entered TIMEWAIT or LASTACK state in 1/100 seconds since midnight (using Coordinated Universal Time (UTC)) |
32(X'20') | SMF119AP_TTEDate | 4 | Packed | Date connection entered TIMEWAIT or LASTACK state. |
36(X'24') | SMF119AP_TTRIP | 16 | Binary | Remote IP address at time of connection close. |
52(X'34') | SMF119AP_TTLIP | 16 | Binary | Local IP address at time of connection close. |
68(X'44') | SMF119AP_TTRPort | 2 | Binary | Remote port number at time of connection close. |
70(X'46') | SMF119AP_TTLPort | 2 | Binary | Local port number at time of connection close. |
72(X'48') | SMF119AP_TTInBytes | 8 | Binary | Inbound byte count. |
80(X'50') | SMF119AP_TTOutBytes | 8 | Binary | Outbound byte count. |
88(X'58') | SMF119AP_TTSWS | 4 | Binary | Send window size at time of connection close. |
92(X'5C') | SMF119AP_TTMSWS | 4 | Binary | Maximum send window size. |
96(X'60') | SMF119AP_TTCWS | 4 | Binary | Congestion window size at time of connection close. |
100(X'64') | SMF119AP_TTSMS | 4 | Binary | Send segment size at time of connection close. |
104(X'68') | SMF119AP_TTRTT | 4 | Binary | Round trip time in milliseconds at time of connection close. |
108(X'6C') | SMF119AP_TTRVA | 4 | Binary | Round trip time variance estimator at time of connection close, in milliseconds. |
112(X'70') | SMF119AP_TTStatus | 1 | Binary | Socket status:
|
113(X'71') | SMF119AP_TTTOS | 1 | Binary | Type of Service (ToS) used by this connection. |
114(X'72') | SMF119AP_TTXRT | 2 | Binary | This field is deprecated. It has a maximum value of 65535. If the actual count exceeds 65535, this value does not wrap and remains at 65535. Use field SMF119AP_TTXRT32 to obtain the actual count. |
116(X'74') | SMF119AP_TTProf | 32 | EBCDIC | Service profile name. |
148(X'94') | SMF119AP_TTPol | 32 | EBCDIC | Service Policy name at the time of connection close. |
180(X'B4') | SMF119AP_TTInSeg | 8 | Binary | Inbound segment count. |
188(X'BC') | SMF119AP_TTOutSeg | 8 | Binary | Outbound segment count. |
196(X'C4') | SMF119AP_TTSSTCK | 8 | Binary | MVS TOD clock value at time of connection establishment. |
204(X'CC') | SMF119AP_TTESTCK | 8 | Binary | MVS TOD clock value at time connection entered TIMEWAIT or LASTACK state. |
212(X'D4') | SMF119AP_TTDupAcksRcvd | 4 | Binary | Total Number of DUP ACKs received on the connection. |
216(X'D8') | SMF119AP_TTLclSMCLinkId | 4 | Binary |
|
220(X'DC') | SMF119AP_TTRmtSMCLinkId | 4 | Binary |
|
224(X'E0') | SMF119AP_TTSMCReason | 4 | Binary | Reason code for SMC-R link establishment failure
if not an internal error:
|
224(X'E0') (continued) |
|
|||
228(X'E4') | SMF119AP_TTSMCFlags | 1 | Binary | Flags:
|
229(X'E5') | SMF119AP_TTSMCDStatus | 1 | Binary | SMC-D link status:
|
230(X'E6') | SMF119AP_TTrsv | 1 | Binary | Reserved |
231(X'E7') | SMF119AP_TTIPsecurityFlags | 1 | Binary | IP security Flags:
|
232(X'E8') | SMF119AP_TTLclSMCBufSz | 4 | Binary |
|
236(X'EC') | SMF119AP_TTRmtSMCBufSz | 4 | Binary |
|
240(X'F0') | SMF119AP_TTXRT32 | 4 | Binary | Number of times retransmission was required for this connection. |
244(X'F4') | SMF119AP_TTSMCDReason | 4 | Binary | Reason code for SMC-D link establishment failure if not an internal error:
|
244(X'F4') (continued) |
|
Table 3 shows the TCP connection termination Telnet specific section of this SMF record. This section is present only when the given TCP connection represented a TN3270 Telnet connection.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0(X'0') | SMF119AP_TTTelLUName | 8 | EBCDIC | LU name |
8(X'8') | SMF119AP_TTTelAppl | 8 | EBCDIC | Target application name |
16(X'10') | SMF119AP_TTTelLogmode | 8 | EBCDIC | Logmode name |
24(X'18') | SMF119AP_TTTelStatus | 4 | Binary | Status word:
|
28(X'1C') | SMF119AP_TTTelTermCode | 1 | Binary | Reason code for closing connection. The socket must be accessible to the TN3270 server to record a reason. (for example, SMF119AP_TTTermCode for this record is X'52'.) See the description of EZZ6034I in z/OS Communications Server: IP Messages Volume 4 (EZZ, SNM) for a list of reason codes and their descriptions. |
29(X'1D') | SMF119AP_TTTelRsv | 3 | Binary | Reserved |
Table 4 shows the TCP connection termination AT-TLS-specific section of this SMF record.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0 (X'0') | SMF119AP_TTTTLSSP | 2 | Binary | AT-TLS SSL Protocol:
|
2(X'2') | SMF119AP_TTTTLSNC | 2 | EBCDIC | AT-TLS Negotiated Cipher. If the value is 4X, the cipher must be obtained from SMF119AP_TTTTLSNC4. |
4(X'4') | SMF119AP_TTTTLSST | 1 | Binary | AT-TLS Security Type:
|
5(X'5') | SMF119AP_TTTTLSFP | 1 | Binary | FIPS 140 status
|
6(X'6') | SMF119AP_TTTTLSRSV1 | 2 | Binary | Reserved |
8(X'8') | SMF119AP_TTTTLSUID | 8 | EBCDIC | AT-TLS Partner UserID |
16(X'10') | SMF119AP_TTTTLSNC4 | 4 | EBCDIC | AT-TLS Negotiated Four Byte Cipher |
20(X'14') | SMF119AP_TTTTLSSESSID | 32 | Binary | AT-TLS session ID |
52(X'34') | SMF119AP_TTTTLSSESSIDLEN | 2 | Binary | Length of the AT-TLS session ID |
54(X'36') | SMF119AP_TTTTLSSRU | 1 | Binary | SSL session reuse
|
Table 5 shows the TCP connection termination application-specific section of this SMF record. The ApplData section provides the application-specific information that is associated with a TCP connection. See SIOCSAPPLDATA IOCTL for information about how applications can use the SIOCSAPPLDATA ioctl to associate application-specific data with a TCP connection.
This section is present only when the given TCP connection has application data associated with it.
The content of this field is determined by the application that owns the connection. For z/OS® Communications Server applications, see the information about Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application. This field typically contains all printable EBCDIC characters, although some applications might include some binary data.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0 (X'0') | SMF119AP_TTAPPLDATA | 40 | Varies | For z/OS Communications Server applications, see Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application. |
Table 6 shows the TCP connection termination IP filter section of this SMF record.
- This section is present if IP filtering is active and an IP filter rule applies to the traffic (SMF119AP_TTIPFltrIncl flag is set). The IP filter section is not included for intra-host connections because IP filtering is not done for those connections.
- The filter rule information reflects the IP filter rules in place at the time that the connection is terminated. If IP filter policy changes while a connection is active, only the names of the IP filter rules in place at the time of the termination are included.
- In certain cases, only outbound filter information is provided. For example, when the AES-GCM algorithm is used and the connection is distributed to a target TCP/IP stack, IP filtering of inbound traffic occurs on the distributing stack and is not available to the target stack where the SMF record is generated. Another example is when the DVLOCALFLTR keyword is configured in the TCP/IP profile. In this case, IP filtering is done on outbound for traffic destined to a DVIPA but if it is determined that it is intra-host traffic, IP filtering is bypassed on inbound.
Offset | Name | Length | Format | Description |
---|---|---|---|---|
0(X'0') | SMF119AP_TTFLTROUTACT | 1 | Binary | Action for the matching outbound filter rule specified by SMF119AP_TTFLTROUTNAME and SMF119AP_TTFLTROUTEXT
|
1(X'1') | SMF119AP_TTFLTRINACT | 1 | Binary | Action for the matching inbound filter rule specified by SMF119AP_TTFLTRINNAME and SMF119AP_TTFLTRINEXT
|
2(X'2') | SMF119AP_TTFLTRRsv | 2 | Binary | Reserved |
4(X'4') | SMF119AP_TTFLTROUTNAME | 40 | EBCDIC | Matching outbound filter rule name. |
44(X'2C') | SMF119AP_TTFLTROUTEXT | 8 | EBCDIC | Matching outbound filter rule name extension. |
52(X'34') | SMF119AP_TTFLTRINNAME | 40 | EBCDIC | Matching inbound filter rule name. |
92(X'5C') | SMF119AP_TTFLTRINEXT | 8 | EBCDIC | Matching inbound filter rule name extension. |