Port reference
Port 2404 (TCP) – IEC 60870-5-104
IEC 60870-5-104 telecontrol protocol — monitors and commands RTUs and substations over TCP/IP in power grids.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on RTUs, substation gateways, and SCADA front ends speaking IEC-104, with no authentication on the protocol.
What is port 2404 used for?
Port 2404 carries IEC 60870-5-104 (IEC-104), the TCP/IP telecontrol protocol used in electric power systems. Control centers and SCADA software exchange messages with RTUs and substation gateways to read telemetry such as voltages and breaker status, and to send commands like opening or closing breakers. It is the networked version of the older serial IEC 60870-5-101 standard, used by utility equipment and SCADA platforms.
When would you open it?
You only deal with 2404 if you run power-grid or substation automation gear that speaks IEC-104. It is opened on a dedicated, isolated operational-technology (OT) network between authorized control centers and field devices, never on a normal office network or the internet.
Is it safe to open?
IEC-104 has no authentication or encryption, so anyone who can reach 2404 could read grid data or send control commands. Keep it on an isolated OT network behind firewalls, and use VPN/IPsec or IEC 62351 where supported. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2404
nmap -p 2404 <target>netstat -ano | findstr :2404
Test-NetConnection <host> -Port 2404lsof -i :2404
nmap -p 2404 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2404 to your device's local IP, internal port 2404, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2404/tcpsudo firewall-cmd --permanent --add-port=2404/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2404 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2404" -Direction Inbound -Protocol TCP -LocalPort 2404 -Action AllowSecurity & risks
Common attacks
- Unauthenticated control commands (breaker open/close) injected to RTUs
- Reading telemetry and ASDU data to map the grid
- Spoofing and replay of monitoring/command APDUs
- Denial of service against substation gateways
Hardening
- Never expose port 2404 to the internet — isolate telecontrol on an OT WAN
- Segment with firewalls/DMZ and restrict to authorized control centers
- Wrap links in IPsec/VPN or use IEC 62351 security extensions
- Monitor with an ICS IDS for unexpected control ASDUs
How to block this port
sudo ufw deny 2404/tcpsudo firewall-cmd --permanent --remove-port=2404/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2404 -j DROPNew-NetFirewallRule -DisplayName "Block 2404" -Direction Inbound -Protocol TCP -LocalPort 2404 -Action Blocknmap snippet
nmap -p2404 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does IEC-104 have authentication?
- No. IEC 60870-5-104 has no built-in authentication or encryption. Any host that reaches port 2404 can read telemetry and inject control commands such as opening or closing breakers. IEC 62351 adds optional security on top.
- Why is IEC-104 considered critical infrastructure?
- IEC-104 is the telecontrol protocol used between control centers and electrical substations. Manipulating it can trip breakers and disrupt power delivery, so exposed RTUs are treated as a national-security-grade risk.