IEC 104 Protocol: Architecture, Framing, and Security Gaps in Power Grid SCADA

IEC 60870-5-104 (IEC 104) is a TCP/IP-based protocol designed to transmit SCADA telemetry and control data across packet-switched networks, primarily in electrical power systems. It operates over TCP on port 2404 and structures communication through two core components: the APCI, which manages framing and sequencing, and the ASDU, which carries the actual telecontrol data. The protocol defines three frame types — I-format for application data, S-format for supervisory acknowledgments, and U-format for connection control — meaning an active TCP connection does not automatically equate to an active IEC 104 data-transfer session. Within each data frame, the ASDU conveys specifics such as the type of information, the cause of transmission, and the address of the relevant station or object. Understanding this layered architecture is considered essential groundwork before analyzing IEC 104 traffic or assessing its security boundaries in operational technology environments.