From: Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol
Variable
vlan-id
IP
TCP
x104 rest
TCP-pdu-size
expert-severity
% missing
1.5%
3.7%
18.6%
71.3%
56.7%
97.8%