IEC 104 Explained: Protocol Stack, Frames, and Security
IEC 60870-5-104 (IEC 104) is the TCP/IP-based member of the IEC 60870-5 telecontrol family. It was designed to carry SCADA telemetry and control information across packet-switched networks, particularly within electrical power systems.
Before getting into raw packets, it is worth understanding how IEC 104 is structured, how its communication state is maintained, and where its security boundaries actually exist..
Protocol Stack
IEC 104 operates over TCP, commonly using port 2404.
Two protocol components are particularly important:
- APCI : Application Protocol Control Information
- ASDU : Application Service Data Unit
The APCI handles framing, sequencing, acknowledgments, and connection control.
The ASDU carries the actual telecontrol information.
+-------------------------------------------------------------+| ASDU || Type ID | VSQ | COT | CA | IOA | Information Objects |+-------------------------------------------------------------+| APCI || 0x68 | Length | Control 1 | Control 2 | Control 3 | Ctrl 4 |+-------------------------------------------------------------+| TCP / IP |+-------------------------------------------------------------+
Every APDU begins with the 0x68...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
