FTP client login failure record (subtype 102)

This SMF record is available only from the real-time TCP/IP network monitoring NMI's SMF interface, SYSTCPSM, and is not written to the MVS™ SMF data sets. See Real-time TCP/IP network monitoring NMI for more information about the SYSTCPSM interface.

Table 1 describes the FTP client login failure self-defining section of the SMF record.
Table 1. FTP client login failure self-defining section
Offset Name Length Format Description
0 (X'0') Standard SMF header 24 N/A Standard SMF header; subtype is 102 (X'66')
Self-defining section
24 (X'18') SMF119SD_TRN 2 Binary Number of triplets in this record Start of change(5)End of change
26 (X'1A') Reserved 2 N/A Reserved
28 (X'1C') SMF119IDOff 4 Binary Offset to TCP/IP identification section *
32 (X'20') SMF119IDLen 2 Binary Length of TCP/IP identification section *
34 (X'22') SMF119IDNum 2 Binary Number of TCP/IP identification sections *
36 (X'24') SMF119S1Off 4 Binary Offset to FTP client login failure section
40 (X'28') SMF119S1Len 2 Binary Length of FTP client login failure section
42 (X'2A') SMF119S1Num 2 Binary Number of FTP client login failure sections
44 (X'2C') SMF119S2Off 4 Binary Offset to FTP client SOCKS section
48 (X'30') SMF119S2Len 2 Binary Length of FTP client SOCKS section
50 (X'32') SMF119S2Num 2 Binary Number of FTP client SOCKS sections
52 (X'34') SMF119S3Off 4 Binary Offset to FTP client Security section
56 (X'38') SMF119S3Len 2 Binary Length of FTP client Security section
58 (X'3A') SMF119S3Num 2 Binary Number of FTP client Security sections
60 (X'3C') SMF119S4Off 4 Binary Offset to FTP client user name section (z/OS® version V1R8 and later)
64 (X'40') SMF119S4Len 2 Binary Length of FTP client user name section (z/OS version V1R8 and later)
66 (X'42') SMF119S4Num 2 Binary Number of FTP client user name sections (z/OS version V1R8 and later)
* See Common TCP/IP identification section for the contents of the TCP/IP identification section.

Table 2 shows the client login failure session section, which follows the TCP/IP identification section.

Table 2. Client login failure session section
Offset Name Length Format Description
0(X'0') SMF119FT_FCLRIP 16 Binary Remote IP address (server)
16(X'10') SMF119FT_FCLLIP 16 Binary Local IP address (client)
32(X'20') SMF119FT_FCLRPort 2 Binary Remote port number (server)
34(X'22') SMF119FT_FCLLPort 2 Binary Local port number (client)
36(X'24') SMF119FT_FCLUserID 8 EBCDIC Local user ID
44(X'2C') SMF119FT_FCLReason 4 Binary Login failure reason. The reason is a Client Error Code as documented in FTP Client Error Codes in z/OS Communications Server: IP User's Guide and Commands. Following list shows the client error codes most likely for login failures.
X'0A'FTP_SESSION_ERROR
Socket, send, or receive error.
X'0B' FTP_LOGIN_FAILED
User ID, password, or account information is not valid.
X'11' FTP_AUTHENTICATION
Security authentication or negotiation failed; incorrect specification of security keywords.
48 (X'30') SMF119FT_FCLCConnID 4 Binary TCP connection ID of FTP control connection

Table 3 describes the FTP client SOCKS section, which is present only if the connection passes through a SOCKS server.

Table 3. FTP client SOCKS section
Offset Name Length Description
0(X'0') SMF119FT_FCCIP 16 SOCKS server IP address
16(X'10') SMF119FT_FCCPort 2 SOCKS server port number
18(X'12') SMF119FT_FCCProt 1 SOCKS protocol version. Possible values are:
  • X'01': SOCKS Version 4
  • X'02': SOCKS Version 5

Table 4 defines the FTP client login failure security section.

Table 4. FTP client login failure security section
Offset Name Length Format Description
0 (X'0') SMF119FT_FCMechanism 1 EBCDIC Protection mechanism. Possible values are:
  • N: None
  • T: TLS
  • G: GSSAPI
  • A: AT-TLS
1 (X'1') SMF119FT_FCCProtect 1 EBCDIC Control connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
2 (X'2') SMF119FT_FCDProtect 1 EBCDIC Data connection protection level. Possible values are:
  • N: None
  • C: Clear
  • S: Safe
  • P: Private
3 (X'3') SMF119FT_FCLoginMech 1 EBCDIC Login method. Possible values are:
  • U: Undefined; the login method is not defined for the client.
  • P: Password
  • C: Certificate
4 (X'4') SMF119FT_FCProtoLevel 8 EBCDIC Protocol level (present only if protection mechanism is TLS or AT-TLS). Possible values are:
  • SSLV2
  • SSLV3
  • TLSV1
  • TLSV1.1
  • TLSV1.2
  • Start of changeTLSV1.3End of change
12 (X'C') SMF119FT_FCCipherSpec 20 EBCDIC Cipher specification (present only if protection mechanism is TLS or AT-TLS). Possible values when Protocol Level is SSLV2 are:
  • RC4 US
  • RC4 Export
  • RC2 US
  • RC2 Export
  • DES 56-bit
  • Triple-DES US
Possible values when Protocol Level is SSLV3, TLSV1, TLSV1.1, or TLSV1.2 are:
  • SSL_NULL_MD5
  • SSL_NULL_SHA
  • SSL_RC4_MD5_EX
  • SSL_RC4_MD5
  • SSL_RC4_SHA
  • SSL_RC2_MD5_EX
  • SSL_DES_SHA
  • SSL_3DES_SHA
  • SSL_AES_128_SHA
  • SSL_AES_256_SHA

Start of changeIf this field is blank, see SMF119FT_FCCipher for the cipher used for the connection.End of change
32 (X'20') SMF119FT_FCProtBuffSize 4 Binary Negotiated protection buffer size
36(xX'24') SMF119FT_FCCipher 2 EBCDIC Hexadecimal value of Cipher Specification (present only if protection mechanism is TLS or AT-TLS). If the value is 4X, the Cipher Specification must be obtained from the SMF119FT_FCLCipher4 field.
38 (X'26') SMF119FT_FCFips140 1 Binary FIPS 140 status
  • X'00': FIPS 140 off
  • X'01': FIPS 140 on
  • X'02': FIPS 140 level 1
  • X'03': FIPS 140 level 2
  • X'04': FIPS 140 level 3
39 (X'27') SMF119FT_FCCipher4 4 EBCDIC Four byte hexadecimal value of Cipher Specification (present only if protection mechanism is TLS or AT-TLS).
43(X'2B') SMF119FT_FCSessReuse 1 EBCDIC SSL session reuse:
  • N: None
  • A: Allowed
  • R: Required
44(X'2C') SMF119FT_FCCSSLSessIDLen 2 Binary Length of the SSL session ID of FTP control connection
46(X'2E') SMF119FT_FCCSSLSessID 32 Binary SSL session ID of FTP control connection
78(X'4E') SMF119FT_FCDSSLSessIDLen 2 Binary Length of the SSL session ID of FTP data connection
80(X'50') SMF119FT_FCDSSLSessID 32 Binary SSL session ID of FTP data connection
Start of change112(X’70’)End of change Start of changeSMF119FT_FCKeyShareEnd of change Start of change4End of change Start of changeEBCDICEnd of change Start of changeAT-TLS Negotiated Key Share (present only if protection mechanism is AT-TLS and protocol level is TLSV1.3)End of change

Table 5 shows the FTP client user name section.

Table 5. FTP client user name section
Offset Name Length Format Description
0(X'0') SMF119FT_FCLXUserID n EBCDIC User name or user ID used to log on to the FTP server