IEC-104 Server Test Suite Data Sheet

Test Suite: IEC-104 Server Test Suite

Direction: Server

IEC 60870-5 defines a set of standards used for SCADA in electrical engineering and power system automation applications. IEC 60870-5-101 (IEC-101) is the standard for power system monitoring and control over serial connection. IEC 60870-5-104 (IEC-104) is an extension of IEC-101, which defines the use of IEC-101 data types on top of TCP/IP. The data types are basically the same as IEC-101, though some types are dropped (these are still tested by the test suite). IEC-104 also adds sequence numbering to control fields for network data synchronization. Defensics IEC-104 Server Test Suite has been designed to act as a malicious IEC-104 master that sends anomalized messages to a tested IEC-104 substation, searching for any security-related robustness flaws, thus improving overall software quality and reliability. In addition to the premade test sequence, the test suite features an option for generating test sequence from a pcap file.

Used specifications

Specification Title
IEC 60870-5-104 Telecontrol equipment and systems – Part 5-104: Transmission protocols – Network access for IEC 60870-5-101 using standard transport profiles
IEC 60870-5-101 Telecontrol equipment and systems – Part 5-101: Transmission protocols – Companion standard for basic telecontrol tasks

Tool-specific information

Tested messages Notes Specifications
C_SC_TA_1 Single command with time tag CP56Time2a IEC 60870-5-104
C_DC_TA_1 Double command with time tag CP56Time2a IEC 60870-5-104
C_RC_TA_1 Regulating step command with time tag CP56Time2a IEC 60870-5-104
C_SE_TA_1 Set-point command with time tag CP56Time2a, normalized value IEC 60870-5-104
C_SE_TB_1 Set-point command with time tag CP56Time2a, scaled value IEC 60870-5-104
C_SE_TC_1 Set-point command with time tag CP56Time2a, short floating point number IEC 60870-5-104
C_BO_TA_1 Bitstring of 32 bit with time tag CP56Timea2a IEC 60870-5-104
C_TS_TA_1 Test command with time tag CP56Time2a IEC 60870-5-104
F_SC_NB_1 Request archive file IEC 60870-5-104
M_SP_NA_1 Single-point information IEC 60870-5-101
M_SP_TA_1 Single-point information with time tag IEC 60870-5-101
M_DP_NA_1 Double-point information IEC 60870-5-101
M_DP_TA_1 Double-point information with time tag IEC 60870-5-101
M_ST_NA_1 Step position information IEC 60870-5-101
M_ST_TA_1 Step position information with time tag IEC 60870-5-101
M_BO_NA_1 Bitstring of 32 bit IEC 60870-5-101
M_BO_TA_1 Bitstring of 32 bit with time tag IEC 60870-5-101
M_ME_NA_1 Measured value, normalized value IEC 60870-5-101
M_ME_TA_1 Measured value, normalized value with time tag IEC 60870-5-101
M_ME_NB_1 Measured value, scaled value IEC 60870-5-101
M_ME_TB_1 Measured value, scaled value with time tag IEC 60870-5-101
M_ME_NC_1 Measured value, short floating point number IEC 60870-5-101
M_ME_TC_1 Measured value, short floating point number with time tag IEC 60870-5-101
M_IT_NA_1 Integrated totals IEC 60870-5-101
M_IT_TA_1 Integrated totals with time tag IEC 60870-5-101
M_EP_TA_1 Event of protection equipment with time tag IEC 60870-5-101
M_EP_TB_1 Packed start events of protection equipment with time tag IEC 60870-5-101
M_EP_TC_1 Packed output circuit information of protection equipment with time tag IEC 60870-5-101
M_PS_NA_1 Packed single-point information with status change detection IEC 60870-5-101
M_ME_ND_1 Measured value, normalized value without quality descriptor IEC 60870-5-101
M_SP_TB_1 Single-point information with time tag CP56Time2a IEC 60870-5-101
M_DP_TB_1 Double-point information with time tag CP56Time2a IEC 60870-5-101
M_ST_TB_1 Step position information with time tag CP56Time2a IEC 60870-5-101
M_BO_TB_1 Bitstring of 32 bits with time tag CP56Time2a IEC 60870-5-101
M_ME_TD_1 Measured value, normalized value with time tag CP56Time2a IEC 60870-5-101
M_ME_TE_1 Measured value, scaled value with time tag CP56Time2a IEC 60870-5-101
M_ME_TF_1 Measured value, short floating point number with time tag CP56Time2a IEC 60870-5-101
M_IT_TB_1 Integrated totals with time tag CP56Time2a IEC 60870-5-101
M_EP_TD_1 Event of protection equipment with time tag CP56Time2a IEC 60870-5-101
M_EP_TE_1 Packed start events of protection equipment with time tag CP56Time2a IEC 60870-5-101
M_EP_TF_1 Packed output circuit information of protection equipment with time tag CP56Time2a IEC 60870-5-101
C_SC_NA_1 Single command IEC 60870-5-101
C_DC_NA_1 Double command IEC 60870-5-101
C_RC_NA_1 Regulating step command IEC 60870-5-101
C_SE_NA_1 Set point command, normalized value IEC 60870-5-101
C_SE_NB_1 Set point command, scaled value IEC 60870-5-101
C_SE_NC_1 Set point command, short floating point number IEC 60870-5-101
C_BO_NA_1 Bitstring of 32 bits IEC 60870-5-101
M_EI_NA_1 End of initialization IEC 60870-5-101
C_IC_NA_1 Interrogation command IEC 60870-5-101
C_CI_NA_1 Counter interrogation command IEC 60870-5-101
C_RD_NA_1 Read command IEC 60870-5-101
C_CS_NA_1 Clock synchronization command IEC 60870-5-101
C_TS_NA_1 Test command IEC 60870-5-101
C_RP_NA_1 Reset process command IEC 60870-5-101
C_CD_NA_1 Delay acquisition command IEC 60870-5-101
P_ME_NA_1 Parameter of measured value, normalized value IEC 60870-5-101
P_ME_NB_1 Parameter of measured value, scaled value IEC 60870-5-101
P_ME_NC_1 Parameter of measured value, short floating point number IEC 60870-5-101
P_AC_NA_1 Parameter activation IEC 60870-5-101
F_FR_NA_1 File ready IEC 60870-5-101
F_SR_NA_1 Section ready IEC 60870-5-101
F_SC_NA_1 Call directory, select file, call file, call section IEC 60870-5-101
F_LS_NA_1 Last section, last segment IEC 60870-5-101
F_AF_NA_1 Ack file, ack section IEC 60870-5-101
F_SG_NA_1 Segment IEC 60870-5-101
F_DR_TA_1 Directory IEC 60870-5-101