Telnet AO (Abort Output) was chosen as the SYSREQ mechanism because, like the real SNA SYSREQ key, it signals that the host application should stop sending output to the terminal while the user's process continues to execute.

The ASSOCIATE command was introduced to allow a client to request the printer device that is paired with a terminal, without needing prior knowledge of the printer's device-name, supporting host applications that derive the print destination from the terminal's LU name.

The device-type list was deliberately minimized to only a few well-known designations rather than enumerating every IBM model, and the '-E' suffix and DYNAMIC type rely on Read Partition Query/Query Reply to communicate actual capabilities to host applications—decoupling hardware model numbers from data stream feature support.

3270 Read and Write command codes have different values depending on whether the server is connected locally or remotely, and via SNA or non-SNA. Clients must check for all possible values to maintain compatibility with the widest range of servers.

If an unrecognized function code is received during FUNCTIONS negotiation, the recipient should remove that code from the list and continue negotiation normally rather than aborting.

If either side does not support TN3270E, both sides fall back to traditional tn3270 (negotiating Terminal-Type, Binary Transmission, and EOR options separately). A TN3270E-capable implementation should attempt TN3270E first and only fall back if the peer refuses.

Agreement to support TN3270E automatically implies support for bi-directional binary transmission and EOR; these are not separately negotiated when TN3270E is in use.

Clients negotiating a terminal device-type with the '-E' suffix, the DYNAMIC type, or any printer device-type must be able to accept and respond to both Read Partition Query (Type 02) and all forms of Read Partition Query List (Type 03).

During FUNCTIONS negotiation, neither party may add to the function-list it receives any function that it previously added and the other side has already removed, preventing infinite negotiation loops.

For printer sessions, either SCS-CTL-CODES or DATA-STREAM-CTL, or both, must be negotiated so the server knows which host application session types to accept on behalf of the client.

The ASSOCIATE command may only be used when requesting a printer device-type, and the specified device-name must be that of a terminal previously returned by the server in a DEVICE-TYPE IS CONNECT command; the server must deny the request otherwise.

The client must make use of the reason-code in any DEVICE-TYPE REJECT command to minimize further negotiation; for example, if UNSUPPORTED-REQ is received for a CONNECT request, the client must make no further specific session requests.

The FUNCTIONS IS command must contain a function-list identical to the one received in the preceding FUNCTIONS REQUEST command; any deviation constitutes a rejection rather than acceptance.

The SEQ-NUMBER field must be sent in network byte order (big endian), and any byte containing 0xff must be doubled to 0xffff before sending and stripped back to 0xff upon receipt, following standard IAC escaping rules.

The server must accept or reject the client's DEVICE-TYPE REQUEST as a whole; it cannot, for example, accept the DEVICE-TYPE portion while denying the CONNECT portion.

TN3270E sub-negotiation must follow a strict order: DEVICE-TYPE negotiation must complete successfully before FUNCTIONS negotiation can begin, and both must complete before any 3270 data stream transmission can occur.

Five TN3270E functions may be negotiated: BIND-IMAGE (0x00), DATA-STREAM-CTL (0x01), RESPONSES (0x02), SCS-CTL-CODES (0x03), and SYSREQ (0x04). All functions not present in the agreed-upon list are considered unsupported for the session.

The 3270 ATTN key is implemented via the Telnet IP command: clients map a key to ATTN and transmit IAC IP; SNA servers translate this to an SNA SIGNAL RU sent to the host application. Non-SNA servers must ignore IAC IP.

The BIND-IMAGE function requires the server to send a BIND-IMAGE data message (containing the exact SNA Bind RU) after accepting a Bind and Start Data Traffic from the host, and an UNBIND data message (with reason code or 0x01 for normal end) when the SNA session terminates. Before the first BIND-IMAGE is received, only SSCP-LU-DATA and NVT-DATA may carry user data.

The DATA-TYPE field (1 byte) specifies message interpretation: 0x00=3270-DATA, 0x01=SCS-DATA, 0x02=RESPONSE, 0x03=BIND-IMAGE, 0x04=UNBIND, 0x05=NVT-DATA, 0x06=REQUEST (no data portion), 0x07=SSCP-LU-DATA, 0x08=PRINT-EOJ (server-only, printer sessions only).

The RESPONSE-FLAG field (1 byte) has dual meaning: for outbound 3270-DATA/SCS-DATA it indicates response expectations (0x00=NO-RESPONSE, 0x01=ERROR-RESPONSE, 0x02=ALWAYS-RESPONSE); for RESPONSE messages it conveys the actual outcome (0x00=POSITIVE-RESPONSE, 0x01=NEGATIVE-RESPONSE). It must be ignored and set to 0x00 for all other DATA-TYPE values.

The SEQ-NUMBER field (2 bytes) is used only when the RESPONSES function is active. The sender maintains a per-session counter starting at 0, incrementing by 1 per 3270-DATA or SCS-DATA message, wrapping at 32767, independent of SNA sequence numbers and not reset on Bind/Unbind.

The TN3270E Message Header is a mandatory 5-byte prefix on every data message, consisting of DATA-TYPE (1 byte), REQUEST-FLAG (1 byte), RESPONSE-FLAG (1 byte), and SEQ-NUMBER (2 bytes). Every TN3270E data message has the form: <TN3270E Header><data><IAC EOR>.

TN3270E defines eight reason codes for DEVICE-TYPE REJECT: CONN-PARTNER (0x00), DEVICE-IN-USE (0x01), INV-ASSOCIATE (0x02), INV-NAME (0x03), INV-DEVICE-TYPE (0x04), TYPE-NAME-ERROR (0x05), UNKNOWN-ERROR (0x06), UNSUPPORTED-REQ (0x07).

Valid terminal device-types are IBM-3278-2, IBM-3278-2-E, IBM-3278-3, IBM-3278-3-E, IBM-3278-4, IBM-3278-4-E, IBM-3278-5, IBM-3278-5-E, and IBM-DYNAMIC; the sole printer device-type is IBM-3287-1. Device-names and resource-names must not exceed 8 bytes.

TN3270E provides no security features beyond those of ordinary Telnet; a TN3270E session is no more secure than a standard Telnet session. Authentication mechanisms defined for Telnet could in principle be applied to TN3270E, including controlling which users may access specific terminal or printer device-names.

security

A TN3270E connection operates in either '3270 mode' or 'NVT mode'. The connection starts in 3270 mode. Sending a DATA-TYPE mismatched to the current mode triggers a mode switch. A mode switch causes the client to perform a 3270 Erase/Reset operation at the default partition size; no attributes from the previous environment are preserved.

SYSREQ processing introduces a 'suspended mode': receipt of Telnet AO by a server that agreed to SYSREQ causes the server to enter suspended mode, during which host-application data is rejected with sense code 0x082D ('LU Busy') and all client-server exchange uses DATA-TYPE SSCP-LU-DATA. A second AO from the client exits suspended mode, sending LUSTAT 0x082B to the host.

A TN3270E data message is structured as <5-byte TN3270E Header><optional data><IAC EOR>. The value 0xff (decimal 255) anywhere in the data stream must be doubled to 0xffff; a single 0xff is interpreted as IAC.

The RESPONSE message data portion consists of exactly 1 byte encoding the processing result: for POSITIVE-RESPONSE, 0x00 (Device End); for NEGATIVE-RESPONSE, 0x00 (Command Reject), 0x01 (Intervention Required), 0x02 (Operation Check), 0x03 (Component Disconnected).