{
  "id": 2168391,
  "title": "IEC 104 Before the Wire: Understanding Its Architecture, Framing, and Security Boundaries",
  "url": "https://urgent.news/2026/08/20/iec-104-before-the-wire-understanding-its-architecture-framing-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-20T15:57:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/null_saint/iec-104-before-the-wire-understanding-its-architecture-framing-and-security-boundaries-nc5"
  },
  "original_language": "en",
  "account": "IEC 60870-5-104 (IEC 104) is an integral part of the IEC 60870-5 telecontrol family, designed to transmit SCADA telemetry and control information over packet-switched networks in electrical power systems. To grasp its inner workings before delving into raw packets, it's essential to comprehend how IEC 104 is structured, how its communication state is managed, and where its security boundaries lie.\n\nIEC 104 communicates over TCP, typically using port 2404. Two key protocol components are crucial: APCI (Application Protocol Control Information) and ASDU (Application Service Data Unit). APCI manages framing, sequencing, acknowledgments, and connection control, while ASDU carries actual telecontrol information.\n\nEach APDU (Application Protocol Data Unit) starts with a 0x68 start byte, followed by a length field and four control bytes. The length indicates the number of bytes that follow, encompassing the four control bytes and, if present, the ASDU. This fixed structure forms the basis for understanding IEC 104 traffic.\n\nIEC 104 defines three APDU formats:\n1. I-Format: Carries application information, containing an ASDU, and two sequence numbers: N(S) (send sequence number) and N(R) (receive sequence number). These numbers facilitate ordered transmission and acknowledgment state across stations.\n2. S-Format: Supervisory frames that do not carry an ASDU. They serve to transmit receive acknowledgments independently of application data.\n3. U-Format: Handles connection-control functions, including STARTDT (Start data transfer), STOPDT (Stop data transfer), and TESTFR (Test the communication relationship).\n\nA critical distinction exists between a TCP connection and an IEC 104 data-transfer session. TCP connection establishes transport connectivity, while IEC 104 manages application-level communication state.\n\nWhen an I-format frame carries application data, the ASDU defines its meaning. A simplified ASDU structure includes:\n- Type Identification\n- Variable Structure Qualifier\n- Cause of Transmission\n- Common Address\n- Information Object\n- Information Elements\n\nThe Type ID identifies the information type being transmitted, while the VSQ indicates the number of information objects present and whether their addressing follows a sequential structure. The COT provides context for why the ASDU is transmitted, potentially indicating events such as spontaneous transmission, interrogation responses, activation, activation confirmation, or termination. Finally, the CA and IOA fields define the addressing model for identifying telemetry and control points.\n\nThe base IEC 104 protocol lacks cryptographic security features, such as cryptographic peer authentication, confidentiality, and integrity protection. Historically, this responsibility fell on the network architecture. However, IEC 62351 defines security mechanisms for power-system communication, including TLS-based profiles for TCP/IP protocols, providing confidentiality, integrity protection, and message-level authentication.\n\nThe security question arises: What security profile does the deployed implementation support, and is it actually enabled and correctly configured? The protocol architecture presents several areas for investigation, including session state handling (STARTDT and STOPDT), sequence state synchronization (N(S) and N(R) values), and the potential attack surface resulting from these architectural decisions.",
  "summary": "By RUGERO Tesla ( @404Saint ). IEC 60870-5-104 (IEC 104) is the TCP/IP-based member of the IEC 60870-5 telecontrol family. It was designed to carry SCADA telemetry and control information across packet-switched networks, particularly within electrical power systems. Before getting into raw packets, it is worth understanding how IEC 104 is structured, how its communication state is maintained, and…",
  "key_points": [
    "IEC 104 is a SCADA telecontrol protocol for packet-switched networks in electrical power systems",
    "APCI manages framing, sequencing, acknowledgments, and connection control in IEC 104",
    "IEC 104 security relies on network architecture, not built-in cryptographic features"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}