TCP 2404
Synopsis
- TCP port 2404 is used by IEC 60870-5-104 (IEC 104), a telecontrol protocol widely deployed in electric power SCADA systems.
- Siemens SIPROTEC protection relays and SICAM A8000 RTUs expose IEC 104 servers on 2404 for control center connections.
- ABB RTU560 and many ABB Relion IEDs, as well as ABB MicroSCADA Pro SYS600 (acting as an IEC 104 master), communicate via TCP 2404.
- Schneider Electric Easergy T300 distribution RTUs and EcoStruxure/Power SCADA Operation through its IEC 104 driver use port 2404.
- GE D20/D400 substation gateways and other utility RTUs/IEDs implement IEC 104 listeners on 2404.
- Software stacks and tools such as MatrikonOPC Server for IEC 60870-5-104, OpenMUC j60870, and MZ Automation’s lib60870 default to TCP 2404.
- Siemens WinCC OA includes an IEC 104 driver that connects to field devices on port 2404.
- Security note: the Industroyer/CrashOverride malware abused IEC 104 over TCP 2404 during the 2016 Ukraine grid attack to issue unauthorized switch commands, making exposed 2404 services a known target in ICS.
Observed activity
Last 30 days
Detailed chart