Port 435: MobilIP-MN — The Roaming Protocol

Port 435 is the well-known port assigned to MobilIP-MN (Mobile IP Mobile Node), a protocol that solves one of the Internet's most fundamental mobility problems: how to let a device change networks without changing its identity.

What It Does

Mobile IP lets devices roam between networks while keeping the same IP address. Port 435 carries the registration messages that mobile nodes (your phone, your laptop, any roaming device) send to maintain their connection as they move.¹²

Without Mobile IP, changing networks means changing IP addresses, which means breaking every active connection. Mobile IP creates a permanent home address that follows you, with a temporary care-of address that shows where you actually are right now.

How Mobile IP Works

The protocol operates through three key phases:³

Agent Discovery: Mobile nodes discover Foreign Agents and Home Agents using ICMP Router Discovery Protocol. Agents advertise their services, and the mobile node figures out whether it's home or visiting a foreign network.

Registration: The mobile node registers its current location (care-of address) with both the Foreign Agent and Home Agent. This registration happens over port 435. These messages are cryptographically authenticated—Mobile IP mandates strong authentication for all registration traffic.⁴

Tunneling: The Home Agent creates a tunnel to the care-of address. Packets destined for the mobile node's home address are intercepted at the home network, tunneled to the current location, decapsulated, and delivered.

The Mobile IP Architecture

Mobile IP defines three entities:⁵

• Mobile Node (MN): The device that's moving. It has a permanent home address and a temporary care-of address that changes as it roams.
• Home Agent (HA): A router on the home network that intercepts packets for mobile nodes and tunnels them to their current location.
• Foreign Agent (FA): A router on the visited network that receives tunneled packets, decapsulates them, and delivers them to the mobile node.

Port 435 handles the communication between these entities—specifically the registration messages that keep the Home Agent updated about where the Mobile Node currently lives.

The Standards

Mobile IP for IPv4 is defined in RFC 5944 (which obsoleted the earlier RFC 3344).⁶ The protocol was designed by the IETF to enable transparent routing of IP datagrams to mobile nodes anywhere on the Internet.

The key insight: each mobile node is always identified by its home address, regardless of where it's actually attached. The care-of address is just routing information, not identity.

Why Port 435 Matters

Port 435 exists in the well-known ports range (0-1023), reserved for fundamental Internet services. Mobile IP was important enough to warrant a reserved port because mobility was becoming essential to the Internet's architecture.

Today, with billions of mobile devices, the problem Mobile IP solved is more relevant than ever. While modern cellular networks often use variations and extensions of the protocol, the core principle remains: devices need to roam without losing their identity or breaking their connections.

Security Considerations

All Mobile IP registration messages exchanged over port 435 must be cryptographically authenticated.⁷ This prevents attackers from:

• Registering false care-of addresses to hijack traffic
• Impersonating mobile nodes
• Redirecting packets to malicious destinations

The authentication requirement is built into the protocol specification, not optional.

Related Ports

Mobile IP is part of a broader ecosystem of mobility protocols:

• Port 434: MobileIP-Agent (for Home Agent and Foreign Agent communication)
• Port 500: ISAKMP/IKE (for IPsec VPN tunnels that Mobile IP can traverse)

Checking Port 435

To see if anything is listening on port 435:

# Linux/macOS
sudo lsof -i :435
sudo netstat -an | grep 435

# Windows
netstat -an | findstr :435

If you see traffic on port 435, you're likely running Mobile IP infrastructure or testing mobility protocols.