435
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No confirmed real-world deployment or independent evidence of use exists for 435/tcp, and even its likely Mobile IPv4 mobile-node role is control-plane signaling meant for trusted mobility infrastructure rather than public reachability, so a listener today is unusual and worth investigating rather than routine.
- // analyst note
- with no documented current deployment, treat an open 435/tcp as anomalous and investigate rather than assume a legitimate Mobile IP service.
- // if you see it open
- No CVE, malware family, or honeypot writeup ties to 435/tcp specifically, and no independent evidence of active real-world deployment was found as of an August 2026 search. Mobile IPv4 is largely obsolete, superseded by Mobile IPv6 and other mobility mechanisms, so there is no established baseline of normal traffic to compare against; an open 435/tcp should be treated as anomalous and investigated.
About port 435/tcp.
Port 435/tcp carries mobilip-mn, IANA's registration for an obscure Mobile IPv4 signaling role, and it has no legitimate reason to be reachable from the public internet — no confirmed real-world deployment is documented as of an August 2026 search, so an open 435/tcp today reads as anomalous rather than expected infrastructure.
IANA's Service Name and Transport Protocol Port Number Registry lists 435 under service name mobilip-mn, described only as "MobilIP-MN," dual-registered on both TCP and UDP under assignee Kannan Alagappan. The Reference column is blank — no RFC is cited for this specific assignment — and no registration or modification date is recorded, a pattern also seen on its neighbor, 434/tcp (mobileip-agent).
The service name's "MN" most plausibly abbreviates "Mobile Node," the roaming-client role in Mobile IPv4 (RFC 2002, 1996; RFC 3344, 2002; RFC 5944, 2010), where a mobile node keeps a stable home address with help from home and foreign agents. That reading matches the already-documented 434/tcp entry, which registers the agent side of the same architecture — though IANA itself never spells the abbreviation out.
No independent evidence of active deployment on 435/tcp is documented as of an August 2026 search. Mobile IPv4 itself is largely obsolete, superseded by Mobile IPv6 and by carrier-network mobility mechanisms that don't depend on this port pair, and general port-lookup sites yielded no port-435-specific content to corroborate any current usage — the IANA row documents a reservation, not confirmed traffic.
- IANA assignment
mobilip-mn— description "MobilIP-MN"; Reference column blank; assignee[Kannan_Alagappan_2]; dual-registered 435/tcp + 435/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mobilip-mn 435/tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mobilip-mn 435/tcp
- Prevalence
- nmap-services open-frequency 435/tcp = 0.000013 (~0.0013%); 435/udp = 0.000511 (~0.0511%) [Confirmed] — this site's own tooling
- Related ports
- 434/tcp (
mobileip-agent— the agent side of the same Mobile IP naming pair) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mobileip-agent 434/tcp
Primary use
Likely Mobile IPv4 mobile-node ("MN") signaling — the Mobile Node role in RFC 3344's Home Agent/Foreign Agent/Mobile Node architecture — as the companion registration to 434/tcp's agent side; IANA's own entry never spells out what "MN" stands for [Likely] — the IANA Service Name and Transport Protocol Port Number Registry mobilip-mn 435/tcp; the IANA Service Name and Transport Protocol Port Number Registry mobileip-agent 434/tcp
Other/unofficial uses
none found in vendor docs, blogs, or forums as of an August 2026 search [Unknown]
Security implications
no CVE, malware family, or honeypot writeup ties to 435/tcp specifically as of an August 2026 search; no independent evidence of active real-world deployment; Mobile IPv4 itself is largely obsolete [Unknown/Likely]
Typically seen on
Unknown — no vendor or deployment attribution found; if the underlying protocol were ever active, only trusted Mobile IP infrastructure (home/foreign agents and mobile nodes on a private or carrier network) [Unknown]
- Analyst note
- with no documented current deployment, treat an open 435/tcp as anomalous and investigate rather than assume a legitimate Mobile IP service.
About port 435/udp.
Port 435/udp carries IANA's mobilip-mn (Mobile IP Mobile Node) registration, but no confirmed application or vendor implementation is known to actually run on it, so it should not be exposed to the public internet and any traffic seen on it merits investigation rather than being assumed benign.
IANA's service-names-port-numbers registry lists 435 (both tcp and udp) as mobilip-mn (description "MobilIP-MN"), assignee [Kannan_Alagappan_2]; the Reference column is blank, so no RFC documents port-435-specific behavior, and the Registration and Modification Date fields are blank as well.
The label pairs with neighboring port 434/udp's mobileip-agent (home/foreign-agent registration) in IANA's Mobile IP naming convention — 434 as the agent side, 435 as the mobile-node side. Mobile IPv4 itself is defined across RFC 2002, RFC 3344, and RFC 5944, but none is cited against port 435, and documented Mobile IP signaling activity is associated with port 434 rather than 435.
No vendor documentation, blog post, forum thread, or scanning write-up describes real software using 435/udp as of an August 2026 search; two secondary aggregator lookups were also checked but proved unusable (one now redirects to an unrelated domain, the other returned an access error), so neither is cited. No malware or CVE association is recorded for this port either. Its nmap-services open-frequency is 0.000511 for UDP — low but nonzero.
- IANA assignment
mobilip-mn— "MobilIP-MN"; Reference column blank (no RFC cited); assignee [Kannan_Alagappan_2]; dual-registered 435/tcp + 435/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mobilip-mn 435/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 435/udp = 0.000511 (~0.05%); 435/tcp = 0.000013 [Confirmed] — this site's own tooling
- Related ports
- 434/udp (
mobileip-agent— home/foreign-agent registration, the agent-side counterpart) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mobileip-agent 434/udp
Primary use
read as the mobile-node-side counterpart to sibling port 434/udp's mobileip-agent (home/foreign-agent registration) within IANA's Mobile IP naming family; no RFC or reference document ties port 435 itself to confirmed protocol behavior
Other/unofficial uses
none found in vendor docs, blogs, or forums as of an August 2026 search [Unknown]
Security implications
no CVE, malware, or Trojan association found; no port-435-specific exposure/scanning telemetry beyond the prevalence figure [Unknown]
Typically seen on
Unknown — no software or vendor attribution found; if genuinely active, would presumably co-occur with Mobile IP infrastructure alongside port 434, but this is not independently confirmed [Unknown]
- Analyst note
- treat an open 435/udp as anomalous — no confirmed legitimate implementation exists, and documented Mobile IP activity runs on sibling port 434 instead; investigate rather than assume routine traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mobilip-mn | UDP | — | 0.05% |
| mobilip-mn | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.