If you have activated GSK trace via the environment variable someone mentioned earlier, the grace will be written to a file in the /tmp directory. It will have gsk somewhere in the name, and some kind of numeric qualifier to make it unique. I forget exactly what it looks like, but you should be able to find it by browsing the directory.
The file needs to be formatted with the gsktrace command. gsktrace writes to stdout, so you'll probably want to redirect it to a file for browsing. gsktrace tracefile > outputfile Then you'll probably have to find somebody else to interpret it. Any time I had to look at one, I shipped it to IBM for help. If you're specifying firewallfriendly (passive mode), that means your server needs to allow incoming connections to ports higher than 1024. Is the server behind a firewall? If so, you may need firewall adjustments. The z/OS FTP client is also very picky about server certificates. It doesn't like self-signed certs, or certs signed by an unknown CA. Many clients, when presented with such a cert, will prompt the user whether to accept it. The z/OS client will not. It just quits. I don't think it even issues any visible message to the user, unless tracing is turned on. The server cert must be signed by a CA acceptable to the client, meaning the CA cert must be in the keyring used by the client. When your handshake fails, does it fail quickly, or does it wait for a while and seem to timeout? If it fails quickly, then it's probably some kind of negotiation problem. If it times out, then it's probably a firewall problem, with the firewall throwing away the "offending" traffic so you never get a response. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
