IEC 60870-5-104

What is IEC 60870-5-104?

IEC 60870-5-104 (IEC 104 for short) is an international telecontrol standard that defines how a SCADA system in a control centre exchanges measurements, indications and control commands over TCP/IP with RTUs and substation automation, mainly in electricity grids. It takes the application layer of the serial variant IEC 60870-5-101 and carries it over a standard network connection. As a result, IEC 104 is the prevailing protocol between European grid operators and their substations, including in the Netherlands, and a core part of critical infrastructure. The protocol has no built-in authentication or encryption, which makes security an explicit design task.

🧠 Where does IEC 104 come from?

IEC 104 belongs to the IEC 60870-5 series of IEC Technical Committee 57, the committee for power system communication. The series consists of base parts (frame formats, data structures, application functions) and four so-called companion standards:

The first edition of IEC 104 appeared in 2000. Edition 2 followed on 13 June 2006 and received an amendment in 2016; the current consolidated version is IEC 60870-5-104:2006+AMD1:2016. Conformance testing is covered by IEC TS 60870-5-604. In North America, DNP3 was developed from the same base parts and fills the same role there.

🔧 How does IEC 104 work technically?

An IEC 104 connection runs between a controlling station (the SCADA server or gateway in the control centre, acting as TCP client) and a controlled station (the RTU or substation computer, acting as TCP server on port 2404). Every message is an APDU that starts with the start byte 0x68, followed by a length byte and four control octets; together these six bytes form the APCI. The maximum APDU length is 253 bytes, of which at most 249 carry the actual data (the ASDU).

There are three frame formats:

• I-frames (information) - carry the ASDU with measurements or commands, plus send and receive sequence numbers
• S-frames (supervisory) - acknowledge received I-frames without carrying data
• U-frames (unnumbered) - control the link: STARTDT and STOPDT start or stop data transfer, TESTFR checks that the connection is still alive

Inside the ASDU you find the type (Type Identification), the reason for sending (Cause of Transmission), the station address (Common Address) and an Information Object Address per data point. In IEC 104 these fields have a fixed length of 2, 2 and 3 octets; in IEC 101 they are configurable.

Which data types are most common?

For real-time supervision, indications are usually sent spontaneously (Cause of Transmission 3) to the control centre as soon as something changes. After a connection is established, the control centre requests the complete picture with a general interrogation. Switching commands often use select-before-operate: select first, then execute, so that a corrupted message does not immediately cause a switching action. Seven-byte timestamps (CP56Time2a) provide millisecond resolution, which requires the RTU clock to be reliably synchronised, for example with NTP or GPS.

⏱️ Which parameters and typical values apply?

IEC 104 handles flow control and error detection with a small set of parameters. The default values from the standard are:

If t1 expires without acknowledgement, the station closes the connection and re-establishes it. On satellite links or slow mobile networks these time-outs are often extended. Edition 2 also describes redundant connections: a station can keep several TCP connections open, of which one per redundancy group is active. This fits redundant control centres and dual WAN routes.

🏭 Where is IEC 104 used?

• Transmission and distribution grids - telecontrol between a grid operator’s control centre and high- and medium-voltage substations
• Substations with IEC 61850 - inside the substation, IEDs talk IEC 61850, while a gateway or RTU passes the data on to the regional or national control centre via IEC 104
• Generation and storage - wind farms, solar parks, hydropower plants and battery storage exchanging measurements and setpoints with the grid operator, for example for energy management and load balancing
• Other utilities - gas, district heating and water networks that use the same SCADA packages

How does IEC 104 compare with DNP3, IEC 61850 and Modbus?

🔐 How do you secure IEC 104?

IEC 104 was designed for closed networks. Any system able to send a valid I-frame to port 2404 can, in principle, issue a switching command. Sandworm proved this is not theoretical: the Industroyer malware cut power to part of Kyiv in December 2016 using modules for IEC 101, IEC 104, IEC 61850 and OPC DA. Its successor Industroyer2 spoke IEC 104 only and was scheduled for 8 April 2022 against high-voltage substations of a Ukrainian energy provider; that attack was thwarted.

Key measures:

• Network segmentation - place RTUs and gateways in their own zones following the zones and conduits model from IEC 62443, and never make them reachable from the internet (see Internet-Exposed OT)
• Firewalls with protocol filtering - allow only known IP addresses and filter on Type ID with an industrial firewall or DPI, so that only the control centre can send commands
• Encrypted transport - use TLS according to IEC 62351-3 or a VPN tunnel over WAN links; TCP port 19998 is registered with IANA for secure IEC 104 and is the default in, for example, the open-source library lib60870
• Application-level authentication - IEC 62351-5 and IEC TS 60870-5-7 add message authentication, although much of the installed equipment does not support it
• Network monitoring - passive OT IDSs detect unusual commands, new stations or abnormal general interrogations and forward alerts to the SIEM
• Key and certificate management - TLS requires sound certificate management over the entire life of a substation

Grid operators and large energy producers fall under NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026. Many organisations also use ISO 27001 as their management system and demonstrate compliance through it. An unsecured IEC 104 link to an external park or maintenance contractor is then a risk you must demonstrably control.

🧭 How do you set up an IEC 104 link step by step?

1. Create a signal list - record the Information Object Address, Type ID, unit and direction of every data point. This document is the basis of every link.
2. Agree on the interoperability profile - the standard contains an interoperability checklist in which both parties tick which types, functions and parameters they support.
3. Configure time and time-outs - choose the clock source, check t0–t3, k and w, and test behaviour when the WAN link fails.
4. Design the security - define zones and conduits, firewall rules, TLS or VPN and the rights per station, for example through a risk assessment according to IEC 62443-3-2.
5. Test with tooling - analyse traffic with Wireshark, which has a built-in IEC 104 dissector, and run factory and site acceptance tests with the real signal list.
6. Monitor in operation - continuously watch connection drops, unwanted commands and new connections.

❓ Frequently asked questions

Which port does IEC 60870-5-104 use?

IEC 60870-5-104 uses TCP port 2404 by default, with the controlled station (the RTU) listening as server. For variants with TLS according to IEC 62351-3, IANA has registered the separate port 19998. Firewalls should open port 2404 only for known control centre systems.

What is the difference between IEC 101 and IEC 104?

IEC 101 is the serial version of the telecontrol protocol and uses FT1.2 frames over, for example, RS-232 or modems. IEC 104 uses the same application functions and data types but transports them over TCP/IP with fixed field lengths. A gateway can therefore convert between the two relatively easily.

Is IEC 104 encrypted?

IEC 104 is not encrypted by itself and does not verify who sends a command. Encryption and authentication come from IEC 62351-3 (TLS) and IEC 62351-5 or IEC TS 60870-5-7 (application-level authentication). Where equipment does not support these, you protect IEC 104 with segmentation, VPN tunnels and protocol filtering.

Is IEC 104 still used alongside IEC 61850?

IEC 104 remains widely used for the link between control centre and substation, even where the substation uses IEC 61850 internally. A gateway then translates the IEC 61850 data into IEC 104. Replacement is slow because grid operators have thousands of existing stations and signal lists.

What is a general interrogation in IEC 104?

A general interrogation (Type ID 100, C_IC_NA_1) is the command with which the control centre requests all current indications and measured values from a station. It is sent after a connection is established and often periodically. After that, only changes arrive spontaneously.

Why is IEC 104 attractive to attackers?

IEC 104 sends switching commands to substations without built-in authentication, so anyone with network access can affect the power supply. The Industroyer malware of 2016 and Industroyer2 of 2022 exploited exactly that. Segmentation and monitoring of IEC 104 traffic are therefore core measures for grid operators.

📌 In summary

IEC 60870-5-104 is the European standard for telecontrol between control centre and substation, carrying the functions of IEC 101 over IP networks on TCP port 2404. The protocol is efficient, event-driven and widely supported, but without IEC 62351 it has no authentication or encryption. Segmentation according to IEC 62443, protocol filtering, encrypted tunnels and monitoring are therefore essential in any modern OT environment.