TCP connection termination record (subtype 2)

The TCP connection termination record is collected whenever a TCP connection is closed or aborted. This record contains all pertinent information about the connection, such as elapsed time, bytes transferred, and so on.

Guidelines:

Because this information duplicates all of the information contained in the TCP connection initiation record, collect only the TCP connection termination record.
Because this record is generated for every single TCP connection, this can generate significant load on a server and rapidly fill the SMF data sets. Use this record with care.

See Table 1 for the contents of the TCP/IP stack identification section. For the TCP/IP connection termination record, the TCP/IP stack identification section indicates TCP as the subcomponent and X'08' (event record) as the record reason.

Table 1 shows the TCP connection termination self-defining section:

Table 1. TCP connection termination self-defining section
Offset	Name	Length	Format	Description
0(X'0')	Standard SMF header	24		Standard SMF header
Self-defining section
24(X'18')	SMF119SD_TRN	2	Binary	Number of triplets in this record
26(X'1A')		2	Binary	Reserved
28(X'1C')	SMF119IDOff	4	Binary	Offset to TCP/IP identification section
32(X'20')	SMF119IDLen	2	Binary	Length of TCP/IP identification section
34(X'22')	SMF119IDNum	2	Binary	Number of TCP/IP identification sections
36(X'24')	SMF119S1Off	4	Binary	Offset to TCP connection termination section
40(X'28')	SMF119S1Len	2	Binary	Length of TCP connection termination section
42(X'2A')	SMF119S1Num	2	Binary	Number of TCP connection termination sections
44 (X'2C')	SMF119S2Off	4	Binary	Offset to TCP connection termination Telnet information section
48 (X'30')	SMF119S2Len	2	Binary	Length of TCP connection termination Telnet information section
50 (X'32')	SMF119S2Num	2	Binary	Number of TCP connection termination Telnet information sections
52 (X'34')	SMF119S3Off	4	Binary	Offset to TCP connection termination Application Transparent Transport Layer Security (AT-TLS) information section
56 (X'38')	SMF119S3Len	2	Binary	Length of TCP connection termination AT-TLS information section
58 (X'3A')	SMF119S3Num	2	Binary	Number of TCP connection termination AT-TLS information sections
60 (X'3C')	SMF119S4Off	4	Binary	Offset to TCP connection termination ApplData section
64 (X'40')	SMF119S4Len	2	Binary	Length of TCP connection termination ApplData section
66 (X'42')	SMF119S4Num	2	Binary	Number of TCP connection termination ApplData sections

Table 2 shows the TCP connection termination specific section of this SMF record.

Table 2. TCP connection termination section
Offset	Name	Length	Format	Description
0(X'0')	SMF119AP_TTRName	8	EBCDIC	TCP socket resource name (Address space name of address space that closed this TCP connection)
8(X'8')	SMF119AP_TTConnID	4	Binary	TCP socket resource ID (connection ID)
12(X'C')	SMF119AP_TTTTLSCS	1	Binary	AT-TLS connection status: X'01': Connection is not secure X'02': Connection handshake in progress X'03': Connection is secure
13(X'D')	SMF119AP_TTTTLSPS	1	Binary	AT-TLS Policy Status: X'00': Policy status is not known X'01': AT-TLS function off X'02': No policy defined for connection X'03': Policy defined for connection; AT-TLS not enabled X'04': Policy defined for connection; AT-TLS enabled X'05': Policy defined for connection; AT-TLS enabled and Application Controlled
14(X'E')	SMF119AP_TTTermCode	1	Binary	Reason code for connection termination: X'11': Error occurred during a send using FRCA(AFPA), possibly because the stack is terminating. X'12': A persistent socket used by FRCA (AFPA) was closed by a FIN. X'21': The connection was terminated because the stack was terminating. X'22': Last stack that can own the dynamic VIPA bound to the socket is terminating X'31': Intrusion detection found the connection to be malicious and closed the connection. X'32': Connection was denied because of a NetAccess rule. X'33': ACK received in lastack state. X'41': The connection was terminated because of an administrator action (for example, using Netstat DRop/-D command or the NMI API). X'42': The connection was terminated because the local IP address bound by the application has been deleted from the stack. X'51': The connection from a client was terminated because the application closed the socket before performing an accept(). X'52': The application using the socket, closed the connection using a close(). X'53': A pascal routine issued an orderly close request. X'54': A pascal routine issued a disconnect. X'55': An error occurred during a pascal accept. X'61': The connection was terminated because the client sent a reset.
14(X'E') (continued)				X'71': The connection was closed because the same packet was being re-transmitted multiple times. X'72': The connection was closed because the TCP window was reduced to 0 and multiple window probes were not acknowledged. X'73': The connection was closed because multiple keepalive probes were not acknowledged. X'74': The connection was terminated because the stack timed out waiting for a fin in the finwait-2 state. X'75': The connection was terminated because a global TCP stall attack was detected. X'76': The connection was terminated because a TCP queue size attack was detected.
15(X'F')	SMF119AP_TTSMCStatus	1	Binary	SMC-R status: X'00': This connection does not use an SMC-R link. If SMF119AP_TTSMCReason is also X'0000', SMC-R link establishment was not attempted. X'01': This connection uses an SMC-R link.
16(X'10')	SMF119AP_TTSubtask	4	Binary	Subtask Name (Address of MVS™ TCB for the task that owns this connection. This is not the subtask value specified on an INITAPI call.)
20(X'14')	SMF119AP_TTSTime	4	Binary	Time of connection establishment
24(X'18')	SMF119AP_TTSDate	4	Packed	Date of connection establishment
28(X'1C')	SMF119AP_TTETime	4	Binary	Time connection entered TIMEWAIT or LASTACK state.
32(X'20')	SMF119AP_TTEDate	4	Packed	Date connection entered TIMEWAIT or LASTACK state.
36(X'24')	SMF119AP_TTRIP	16	Binary	Remote IP address at time of connection close.
52(X'34')	SMF119AP_TTLIP	16	Binary	Local IP address at time of connection close.
68(X'44')	SMF119AP_TTRPort	2	Binary	Remote port number at time of connection close.
70(X'46')	SMF119AP_TTLPort	2	Binary	Local port number at time of connection close.
72(X'48')	SMF119AP_TTInBytes	8	Binary	Inbound byte count.
80(X'50')	SMF119AP_TTOutBytes	8	Binary	Outbound byte count.
88(X'58')	SMF119AP_TTSWS	4	Binary	Send window size at time of connection close.
92(X'5C')	SMF119AP_TTMSWS	4	Binary	Maximum send window size.
96(X'60')	SMF119AP_TTCWS	4	Binary	Congestion window size at time of connection close.
100(X'64')	SMF119AP_TTSMS	4	Binary	Send segment size at time of connection close.
104(X'68')	SMF119AP_TTRTT	4	Binary	Round trip time in milliseconds at time of connection close.
108(X'6C')	SMF119AP_TTRVA	4	Binary	Round trip time variance estimator at time of connection close, in milliseconds.
112(X'70')	SMF119AP_TTStatus	1	Binary	Socket status: X'00': Passive Open (this is a server socket) X'01': Active Open (this is a client socket)
113(X'71')	SMF119AP_TTTOS	1	Binary	Type of Service (ToS) used by this connection.
114(X'72')	SMF119AP_TTXRT	2	Binary	Number of times retransmission was required for this connection.
116(X'74')	SMF119AP_TTProf	32	EBCDIC	Service profile name.
148(X'94')	SMF119AP_TTPol	32	EBCDIC	Service Policy name at the time of connection close.
180(X'B4')	SMF119AP_TTInSeg	8	Binary	Inbound segment count.
188(X'BC')	SMF119AP_TTOutSeg	8	Binary	Outbound segment count.
196(X'C4')	SMF119AP_TTSSTCK	8	Binary	MVS TOD clock value at time of connection establishment.
204(X'CC')	SMF119AP_TTESTCK	8	Binary	MVS TOD clock value at time connection entered TIMEWAIT or LASTACK state.
212(X'D4')	SMF119AP_TTDupAcksRcvd	4	Binary	Total Number of DUP ACKs received on the connection.
216(X'D8')	SMF119AP_TTLclSMCLinkId	4	Binary	Local SMC-R link ID.
220(X'DC')	SMF119AP_TTRmtSMCLinkId	4	Binary	Remote SMC-R link ID.
224(X'E0')	SMF119AP_TTSMCReason	4	Binary	Reason code for SMC-R link establishment failure if not an internal error: X'5013': RDMA connectivity failure X'5203': Insufficient virtual storage. X'5204': The SMCR FIXEDMemory parameter limit was reached. X'5205': TCP connection limit was reached. X'5206': The Virtual LAN (VLAN) ID was not found. X'5209': There are no qualifying active 10GbE RoCE Express® interfaces. X'5219': Peer is out of synchronization. X'521E': Peer subnet or prefix mismatches. X'5301': Peer did not accept SMC-R request. X'5302': The route is not eligible for SMC-R. X'5303': There are no active10GbE RoCE Express interfaces for the PnetID. X'5304': The connection is local. X'5306': No storage for SMC-R negotiation. X'5307': The connection uses IPSec. X'5308': The connection is used by a Fast Response Cache Accelerator (FRCA) server. X'5309': The connection is used by a Pascal API application. X'530A': The server port was configured with the NOSMCR option. X'530B': The peer had an invalid MTU size for this SMC-R link. X'530C': No valid IPv6 prefixes existed for the associated OSD interface.
224(X'E0') (continued)				Other non-zero reason code values: Internal error, if the SMF119AP_TTSMCRSNRMT (X'80') bit is off in SMF119AP_TTSMCFlags. Remote peer set the value, if the SMF119AP_TTSMCRSNRMT (X'80') bit is on in SMF119AP_TTSMCFlags. See the documentation of the peer product for more information.
228(X'E4')	SMF119AP_TTSMCFlags	1	Binary	Flag: X'80': SMC-R reason that the peer sets.

Table 3 shows the TCP connection termination Telnet specific section of this SMF record. This section is present only when the given TCP connection represented a TN3270 Telnet connection.

Table 3. TCP connection termination Telnet section
Offset	Name	Length	Format	Description
0(X'0')	SMF119AP_TTTelLUName	8	EBCDIC	LU name
8(X'8')	SMF119AP_TTTelAppl	8	EBCDIC	Target application name
16(X'10')	SMF119AP_TTTelLogmode	8	EBCDIC	Logmode name
24(X'18')	SMF119AP_TTTelStatus	4	Binary	Status word: x80000000: Definite response mode x40000000: The connection is being performance monitored x00000004: TN3270E mode x00000002: TN3270 mode x00000001: Line mode
28(X'1C')	SMF119AP_TTTelTermCode	1	Binary	Reason code for closing connection. The socket must be accessible to the TN3270 server to record a reason. (for example, SMF119AP_TTTermCode for this record is X'52'.) See the description of EZZ6034I in z/OS Communications Server: IP Messages Volume 4 (EZZ, SNM) for a list of reason codes and their descriptions.
29(X'1D')	SMF119AP_TTTelRsv	3	Binary	Reserved

Table 4 shows the TCP connection termination AT-TLS-specific section of this SMF record.

Restriction: This section is present only when the given TCP connection was secured by AT-TLS (SMF119AP-TTTTLSCS is X'03').

Table 4. TCP connection termination AT-TLS section
Offset	Name	Length	Format	Description
0 (X'0')	SMF119AP_TTTTLSSP	2	Binary	AT-TLS SSL Protocol: X'0200': SSL Version 2 X'0300': SSL Version 3 X'0301': TLS Version 1.0 X'0302': TLS Version 1.1 X'0303': TLS Version 1.2
2(X'2')	SMF119AP_TTTTLSNC	2	EBCDIC	AT-TLS Negotiated Cipher. If the value is 4X, the cipher must be obtained from SMF119AP_TTTTLSNC4.
4(X'4')	SMF119AP_TTTTLSST	1	Binary	AT-TLS Security Type: X'01': Client X'02': Server X'03': Server with client authentication, ClientAuthType = PassThru X'04': Server with client authentication, ClientAuthType = Full X'05': Server with client authentication, ClientAuthType = Required X'06': Server with client authentication, ClientAuthType = SAFCheck
5(X'5')	SMF119AP_TTTTLSFP	1	Binary	FIPS 140 status X'00': FIPS 140 off X'01': FIPS 140 on
6(X'6')	SMF119AP_TTTTLSRSV1	2	Binary	Reserved
8(X'8')	SMF119AP_TTTTLSUID	8	EBCDIC	AT-TLS Partner UserID
16(X'10')	SMF119AP_TTTTLSNC4	4	EBCDIC	AT-TLS Negotiated Four Byte Cipher

Table 5 shows the TCP connection termination application-specific section of this SMF record. The ApplData section provides the application-specific information that is associated with a TCP connection. See SIOCSAPPLDATA IOCTL for information about how applications can use the SIOCSAPPLDATA ioctl to associate application-specific data with a TCP connection.

This section is present only when the given TCP connection has application data associated with it.

The content of this field is determined by the application that owns the connection. For z/OS® Communications Server applications, see the information about Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application. This field typically contains all printable EBCDIC characters, although some applications might include some binary data.

Table 5. TCP connection termination ApplData section
Offset	Name	Length	Format	Description
0 (X'0')	SMF119AP_TTAPPLDATA	40	Varies	For z/OS Communications Server applications, see Application data for an explanation of the layout, format, and meaning of this field. For other applications, see the documentation that is supplied by the application.