SNA and VTAM basics, and troubleshooting connectivity

Why SNA still matters

Before TCP/IP was common, mainframe networks used SNA (Systems Network Architecture). Many applications were written for it, especially CICS and IMS terminal programs and program-to-program links. Most physical SNA networks have gone, but the concepts remain: every 3270 session, including those arriving through TN3270, is still an SNA session inside z/OS, and some partners still talk SNA, usually carried over IP.

VTAM and its resources

VTAM (Virtual Telecommunications Access Method) is the SNA half of Communications Server and runs as a started task (commonly NET). It manages resources, defined in major nodes (members in VTAM's definition library, VTAMLST) and activated when needed.

APPN and Enterprise Extender

APPN (Advanced Peer-to-Peer Networking) replaced hand-built SNA routing with dynamic discovery: network nodes find resources and compute routes. HPR (High-Performance Routing) improved it further. Enterprise Extender (EE) carries HPR traffic inside UDP over an IP network, so SNA applications keep working while the network underneath is pure IP. EE uses UDP ports 12000 to 12004, which matters when firewalls are involved.

VTAM commands

VTAM messages begin with IST. TCP/IP stack messages use prefixes beginning with EZ (such as EZA, EZB, EZD and EZZ). Knowing the prefix tells you which half of Communications Server is talking.

Troubleshooting connectivity, layer by layer

1. Name: does the host name resolve to the address you expect? A wrong DNS entry looks like a network failure.
2. Reachability: PING the address from z/OS and from the client side. No reply may be normal if ICMP is blocked, so do not stop there.
3. Path: TRACERTE shows where packets stop. A break outside the mainframe belongs to the network team.
4. Listener: NETSTAT CONN (or D TCPIP,,NETSTAT,CONN) shows whether the server is in Listen state on the right port and stack.
5. Port reservation: a PORT statement may reserve the port for a different job name, so the server cannot bind.
6. Security: firewalls, z/OS IP filtering, AT-TLS policy or RACF access to the port can all refuse a connection that otherwise looks healthy.
7. SNA side: for 3270 or LU 6.2 problems, check the application with D NET,ID=applid,E and whether it accepts logons.

USER ID  CONN     STATE
ZCONSRV  0000004A LISTEN
  LOCAL SOCKET:   ::..9443
  FOREIGN SOCKET: ::..0
TN3270A  00000031 LISTEN
  LOCAL SOCKET:   ::..23
  FOREIGN SOCKET: ::..0

For deeper problems, network specialists use packet and component traces (the TCP/IP packet trace runs under component trace as SYSTCPDA) and SMF records for connection statistics. These are usually started on request, under change or incident control, because they can affect performance and capture sensitive data.