IEC 104 provides the network access to IEC 60870-5-101 (aka IEC 101) using standard transport profiles. In simple terms, it delivers IEC 101 messages as application data (L7) over TCP, port 2404. IEC 104 enables communication between control station and a substation via a standard TCP/IP network. The communication is based on the client-server model.

In this report we give a short overview of related standards and describe IEC 104 communication model. The main part of this report is description of the IEC 104 protocol, especially APCI and ASDU format. As other monitoring protocols, IEC 104 transmits ASDU containing information objects and information elements which build the basic part of IEC 104 monitoring.  The report is a part of IRONSTONE research project focused on security monitoring of IoT networks.

@TECHREPORT{
   author = {Petr Matou{\v{s}}ek},
   title = {Description and analysis of IEC 104 Protocol},
   pages = {38},
   year = {2017},
   location = {FIT-TR-2017-12, Brno, CZ},
   publisher = {Faculty of Information Technology BUT},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php?id=11570}
}