> iec_60870-5-104:2016
IEC 60870-5-104:2016
Telecontrol Equipment and Systems — Part 5-104: Network Access for IEC 60870-5-101 Using Standard Transport Profiles
IEC 60870-5-104 ('IEC 104') adapts the serial IEC 101 telecontrol standard to TCP/IP Ethernet networks. Used universally across power distribution, gas pipeline, and water SCADA grids, it manages master-substation communications, Application Service Data Units (ASDUs), cyclic analog measurements, spontaneous event alarms, clock synchronizations, and command controls over TCP port 2404.
Scope & Applicability
Wide area network (WAN) telecontrol links connecting Central Dispatch SCADA systems with remote terminal units (RTUs) and distribution substations.
Non-Coverage Boundaries
Does not define internal digital substation bus mechanisms (which use IEC 61850) or North American DNP3-based implementations.
Key Clauses & Control Requirements
Application Protocol Control Information (APCI)
Four-byte control field structuring frame transmission: I-format (Information transfer with sequence counters), S-format (Supervisory acknowledgment), and U-format (Unnumbered control: STARTDT, STOPDT, TESTFR).
Application Service Data Unit (ASDU) Profiles
Standardized data types: Single-point information (M_SP_NA_1), Measured value normalized (M_ME_NA_1), and Single command (C_SC_NA_1) with timestamping.
Cybersecurity Integration (IEC 62351-3 TLS)
Securing legacy cleartext IEC 104 sessions with mandatory TLS 1.3 encryption, mutual certificate authentication, and cryptographic session renewal.
Required Regulatory & Audit Evidence Artifacts
- [✓]RTU Point-to-Point Commissioning Signal Test Logbook
- [✓]Network Firewall Rule Review verifying restricted TCP port 2404 routing between authorized IPs
- [✓]Wireshark protocol dissector traces showing APCI STARTDT handshakes and ASDU traffic
“Legacy IEC 104 runs in cleartext without authentication by default; an attacker on the telemetry network can inject fake breaker open commands. Implement IEC 62351-3 TLS or encrypted IPsec tunnels across all utility WAN circuits.”
Cross-Surface Ecosystem Relationships
- IEC 60870-5-104 Telecontrol equipment and systems ↗(International Electrotechnical Commission)
Frequently Asked Questions
What port does IEC 60870-5-104 use?
IEC 104 uses standard IANA TCP port 2404.