IEC 60870-5-104 and IEC 61850 Analysis with Wireshark

IEC 60870-5-104 and IEC 61850 cover different operational models and transport patterns. Treating them as one generic UDP capture problem hides the evidence needed for a safe diagnosis.

• IEC 60870-5-104 (IEC 104) carries telecontrol messages over TCP, commonly on port 2404.
• IEC 61850 MMS commonly runs over TCP port 102.
• GOOSE and Sampled Values (SV) are Layer-2 Ethernet traffic and may not cross a router.

Your capture point is therefore part of the finding. A SPAN at a routed uplink may contain IEC 104 and MMS while missing local GOOSE/SV exchanges entirely.

Analyze IEC 104

A focused capture filter is:

tcp port 2404

Then apply the display filter:

iec104

Inspect the APDU type and control fields before interpreting the application data. For I-format messages, follow send and receive sequence numbers across both directions. Gaps, duplicate sequence state, repeated STARTDT/STOPDT/TESTFR exchanges, resets, or long acknowledgment delays provide stronger evidence than an aggregate packet count.

For application semantics, correlate:

• Type Identification
• Cause of Transmission
• Common Address of ASDU
• Information Object Address
• value, timestamp, and quality flags
• command versus confirmation direction

A command frame alone does not prove that field equipment executed the operation. Look for the expected confirmation, subsequent indication, and operational logs.

Analyze IEC 61850 MMS

MMS traffic can be located with:

tcp port 102

and filtered with:

mms

Follow the TCP and session establishment first, then correlate confirmed request/response pairs, invoke IDs, object names, access errors, and timing. A slow MMS transaction may result from TCP recovery, server processing, authorization, or an application timeout; the packet sequence should separate those stages.

Analyze GOOSE and Sampled Values

Use display filters:

goose
sv

Because these are Layer-2 multicast protocols, capture on the correct VLAN and switch path. For GOOSE, track state and sequence counters, retransmission cadence, dataset identity, configuration revision, time allowed to live, and quality values. A repeated message is often expected reliability behavior after a state change—not automatically a broadcast storm.

For Sampled Values, verify stream identity, sequence continuity, timing, VLAN priority, and whether the capture system itself can sustain the packet rate without dropping frames.

Investigation checklist

1. Record topology, VLAN, time synchronization, and capture point.
2. Separate IEC 104, MMS, GOOSE, and SV; do not use one broad port-range filter.
3. Identify the exact device pair, dataset, or control point involved.
4. Follow protocol sequence/counter state and request-response timing.
5. Compare the affected interval with a known-good operational cycle.
6. Correlate packet evidence with IED, SCADA, protection, and switch telemetry.
7. Preserve uncertainty when the capture cannot see execution inside the device.

Critical-infrastructure captures may contain sensitive addressing, device behavior, and control data. The on-premises private AI deployment keeps storage, identity, model routing, and packet processing inside the customer boundary. The packet-understanding workflow shows how PacketSafari preserves exact protocol evidence instead of reducing the result to an alert count.

Bottom line

IEC troubleshooting succeeds when the capture point matches the protocol. Use TCP stream evidence for IEC 104 and MMS, Layer-2 visibility and counters for GOOSE/SV, and operational telemetry to distinguish network symptoms from device or control logic.