IEC 104 Before the Wire: Understanding Its Architecture, Framing, and Security Boundaries

By RUGERO Tesla (@404Saint).

IEC 60870-5-104 (IEC 104) is the TCP/IP-based member of the IEC 60870-5 telecontrol family. It was designed to carry SCADA telemetry and control information across packet-switched networks, particularly within electrical power systems.

Before getting into raw packets, it is worth understanding how IEC 104 is structured, how its communication state is maintained, and where its security boundaries actually exist.

This is the map before we meet the protocol on the wire.

Protocol Stack