Real-time SMF NMI: FTP client session record (subtype 103)

Table 1 shows the FTP client session record self-defining section.

Table 1. FTP client session record self-defining section
Offset	Name	Length	Format	Description
0 (x'0')	Standard SMF header	24	N/A	Standard SMF header; subtype is 103 (x'67')
Self-defining section
24 (x'18')	SMF119SD_TRN	2	Binary	Number of triplets in this record
26 (x'1A')	Reserved	2	N/A	Reserved
28 (x'1C')	SMF119IDOff	4	Binary	Offset to TCP⁄IP identification section *
32 (x'20')	SMF119IDLen	2	Binary	Length of TCP⁄IP identification section *
34 (x'22')	SMF119IDNum	2	Binary	Number of TCP⁄IP identification sections *
36 (x'24')	SMF119S1Off	4	Binary	Offset to FTP client session section
40 (x'28')	SMF119S1Len	2	Binary	Length of FTP client session section
42 (x'2A')	SMF119S1Num	2	Binary	Number of FTP client session sections
44 (x'2C')	SMF119S2Off	4	Binary	Offset to FTP client SOCKS section
48 (X'32)	SMF119S2Len	2	Binary	Length of FTP client SOCKS section
50 (X'34')	SMF119S2Num	2	Binary	Number of FTP client SOCKS sections
52 (x'34')	SMF119S3Off	4	Binary	Offset to FTP client security section
56 (x'38')	SMF119S3Len	2	Binary	Length of FTP client security section
58 (x'3A')	SMF119S3Num	2	Binary	Number of FTP client security sections
60 (x'3C')	SMF119S4Off	4	Binary	Offset to FTP client session user name section
64 (x'40')	SMF119S4Len	2	Binary	Length of FTP client session user name section
66 (x'42')	SMF119S4Num	2	Binary	Number of FTP client session user name section
*See Common TCP/IP identification section for the contents of the TCP⁄IP identification section.

Table 2 shows the FTP client session section.

Table 2. FTP client session section
Offset	Name	Length	Format	Description
0 (X'0')	SMF119FT_FCNRIP	16	Binary	Remote IP address (server)
16 (X'10')	SMF119FT_FCNLIP	16	Binary	Local IP address (client)
32 (X'20')	SMF119FT_FCNRPort	2	Binary	Remote port number (server)
34 (X'22')	SMF119FT_FCNLPort	2	Binary	Local port number (Client)
36 (X'24')	SMF119FT_FCNUserID	8	EBCDIC	Local User ID
44 (X'2C')	SMF119FT_FCNReason	4	Binary	Session end reason. The reason is a client error code as documented in FTP Client Error Codes in z/OS Communications Server: IP User's Guide and Commands. If no error occurred, the value of this field is 0. This field is defined only when the value of the SMF119FT_FCNEvent field is T.
48 (X'30')	SMF119FT_FCNEvent	1	EBCDIC	I: Session has started; client is logged into the server T: Session has ended
49 (X'31')	Reserved	3	Binary	Reserved
52 (X'34')	SMF119FT_FCNSTime	4	Binary	Session start time, in one hundreths of a second, since midnight [using Coordinated Universal Time (UTC)].
56 (X'38')	SMF119FT_FCNSDate	4	Binary	Session start date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'.
60 (X'3C')	SMF119FT_FCNETime	4	Binary	Session end time, in one hundreths of a second, since midnight [using Coordinated Universal Time (UTC)]. This field is defined only when the value of SMF119FT_FCNEvent is T.
64 (X'40')	SMF119FT_FCNEDate	4	Binary	Session end date (format: 0cyydddF). If the date is not available, the value specified is X'0000000F'. This field is defined only when the value of SMF119FT_FCNEvent is T.
68 (X'44')	SMF119FT_FCNCConnID	4	Binary	TCP connection ID of FTP control connection

Table 3 shows the FTP client SOCKS section, which is present only if the connection passes through a SOCKS server.

Table 3. FTP client SOCKS section
Offset	Name	Length	Description
0	SMF119FT_FCNIP	16	SOCKS server IP address
16	SMF119FT_FCNPort	2	SOCKS server port number
18	SMF119FT_FCNProt	1	SOCKS protocol version. Possible values are: X'01' SOCKS Version 4 X'02' SOCKS Version 5

Table 4 shows the FTP client security section:

Table 4. FTP client security section
Offset	Name	Length	Format	Description
0 (X'0')	SMF119FT_FCNMechanism	1	EBCDIC	Protection Mechanism. Possible values are: N: None T: TLS G: GSSAPI A: AT-TLS
1 (X'1')	SMF119FT_FCNCProtect	1	EBCDIC	Control Connection Protection Level. Possible values are: N: None C: Clear S: Safe P: Private
2 (X'2')	SMF119FT_FCNDProtect	1	EBCDIC	Data Connection Protection Level. Possible values are: N: None C: Clear S: Safe P: Private
3 (X'3')	SMF119FT_FCNLoginMech	1	EBCDIC	Login Method. Possible values are: P: Password C: Certificate
4 (X'4')	SMF119FT_FCNProtoLevel	8	EBCDIC	Protocol level (present only if Protocol Mechanism value is TLS or AT-TLS). Possible values are: SSLV2 SSLV3 TLSV1 TLSV1.1 TLSV1.2
12 (X'C')	SMF119FT_FCNCipherSpec	20	EBCDIC	Cipher specification (present only if Protocol Mechanism value is TLS or AT-TLS). Possible values when Protocol Level is SSLV2 are: RC4 US RC4 Export RC2 US RC2 Export DES 56-bit Triple-DES US Possible values when Protocol Level value is SSLV3, TLSV1, TLSV1.1, or TLSV1.2 are: SSL_NULL_MD5 SSL_NULL_SHA SSL_RC4_MD5_EX SSL_RC4_MD5 SSL_RC4_SHA SSL_RC2_MD5_EX SSL_DES_SHA SSL_3DES_SHA SSL_AES_128_SHA SSL_AES_256_SHA
32 (X'20')	SMF119FT_FCNProtoBufSize	4	Binary	Negotiated protection buffer size
36 (X'24')	SMF119FT_FCNCipher	2	EBCDIC	Hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS). If the value is 4X, the Cipher Specification must be obtained from the SMF119FT_FCNCipher4 field.
38 (X'26')	SMF119FT_FCNFips140	1	Binary	FIPS 140 status X'00': FIPS 140 off X'01': FIPS 140 on
39 (X'27')	SMF119FT_FCNCipher4	4	EBCDIC	Four byte hexadecimal value of Cipher Specification (present only if Protocol Mechanism is TLS or AT-TLS).

Table 5 shows the FTP client session user name section.

Table 5. FTP client session user name section
Offset	Name	Length	Format	Description
0(x'0')	SMF119FT_FCNUserID	n	EBCDIC	User name or user ID used to log into the FTP server.