Port 3517: IAPP — The Port Assigned to a Dead Standard

What Port 3517 Is

Port 3517 is registered in the IANA database as 802-11-iapp, assigned in 2002 to the Inter-Access Point Protocol (IAPP) — part of the IEEE 802.11F trial-use standard for Wi-Fi roaming between access points.¹

It is not unassigned. It is something more interesting: assigned to a protocol that was formally withdrawn in 2006, leaving a permanent placeholder in the port registry for a technology the industry decided not to build.²

What IAPP Was Supposed to Do

Early Wi-Fi had a gap. The 802.11 standard defined how devices connect to individual access points, but deliberately left out how access points should talk to each other. When a laptop roamed from one AP to another, the two access points had no standardized way to hand off the connection, transfer security context, or synchronize state.

IEEE 802.11F was supposed to fix this. It defined a protocol — IAPP — that access points from different vendors could use to coordinate roaming. The goal was multi-vendor interoperability: a Cisco AP and a 3Com AP should be able to hand a client off to each other cleanly, without proprietary agreements.

IAPP ran on port 3517 over both TCP and UDP.

Why It Failed

IEEE 802.11F was a trial-use standard with a built-in two-year review period. When that period ended, the IEEE asked whether anyone wanted to extend it. No one did.

The working group noted that there was "no interest in deploying systems using IEEE 802.11F." Vendors had already built proprietary roaming solutions. Enterprise Wi-Fi was moving toward centralized controllers that made peer-to-peer AP coordination unnecessary. IAPP solved a problem that the market was solving differently.

On February 6, 2006, the IEEE formally withdrew the standard.³

The IANA port assignment was never reclaimed. Port 3517 remains listed as 802-11-iapp — registered to a protocol that no longer exists.

Who Is Actually Listening on Port 3517

Almost certainly nobody, at least not for IAPP. Some scanning activity appears in security research databases⁴, which is typical for any registered port — scanners probe everything.

If you see traffic on port 3517, it is not IAPP. It is more likely:

• A custom application that happened to pick this port
• A misconfigured or non-standard service
• Network scanning or reconnaissance

How to Check What's Listening

To see if anything on your system is bound to port 3517:

macOS / Linux:

# Show process listening on port 3517 (TCP)
sudo lsof -i TCP:3517

# Or with ss on Linux
ss -tlnp | grep 3517

Windows:

netstat -ano | findstr :3517

To identify a remote service:

nmap -sV -p 3517 <target-ip>

What Registered Ports Mean

Port 3517 sits in the registered port range (1024-49151). These ports are not reserved for operating system use (that's 0-1023), but they are tracked by IANA to prevent collisions between applications. Registration means a vendor or standards body submitted a request and got the port officially recorded.

Registration does not mean the port is actively used, maintained, or even that the registering organization still exists. The registry is full of entries like port 3517: formally correct, practically empty.⁵