2. IEC 60870-5-104ΒΆ

IEC 60870-5-104 is a protocol used mostly in electrical engineering and power system automation. This protocol is detected by ntopng and dissected overtime by detecting changes in behaviour for each network flow.

For each IEC flow, ntopng dissects flow communications

IEC Flows Detection

and reports in realtime traffic statistics. In addition to this, ntopng learns the protocol transitions as configured in preferences, this as each IEC flow has different peculiarities and transitions for which a model is created.

IEC Learning Duration

For the specified duration, ntopng builds a model for each flow in order to understand how it behaves overtime. When the learning period for a flow is over, ntopng matches the traffic agains the model and triggers an alert whenever

IEC 60870-5-104 Flow Transitions

Under the bahevioural checks page, you can enable specific protocol checks.

IEC 60870-5-104 Behavioural Checks

  • IEC Invalid Command Transition

    The transitions number is invalid (C-C > 10 and M-M/M-C/C-< == 0)

  • IEC Invalid Transition

    An alert is triggered when after the IEC learning perios, a new transiion (nor previously observed) is detected.

  • IEC Unexpected TypeID

    In the behavioural check it is possible to specify the list of IEC 60870-5-104 TypeIDs that are allowed. Any other TypeIDs will trigger an alert.

You can read more here for more information,