What This Port Does
Port 1235 has an official IANA registration for a service called mosaicsyssvc1, registered by Brian Matthews.1 The problem: nobody knows what mosaicsyssvc1 actually does. The IANA registry lists the name and nothing else. No description. No documentation. No RFC. The service appears to have vanished, leaving only its port number behind.
In practice, port 1235 is used by N-able Take Control for testing peer-to-peer remote desktop connections. When you connect to a remote computer through Take Control, the software tests ports 1234 and 1235 with UDP traffic to see if it can establish a direct connection between viewer and agent—bypassing the relay server for faster performance.23
The Registered Port Range
Port 1235 sits in the registered port range (1024–49151). These ports are registered with IANA for specific services, but registration doesn't mean exclusive use. Anyone can technically run any service on these ports—the registry is more suggestion than law.
The difference from well-known ports (0–1023): those require root privileges on Unix systems and carry the weight of decades of convention. Registered ports like 1235 have official assignments but less enforcement, which is how they end up repurposed when their original services disappear.
The Ghost Service
What was mosaicsyssvc1? The only clue is a single forum post suggesting it had something to do with RAM optimization.4 That's it. The service was registered at some point, presumably for a commercial product or internal tool, and then faded away as the software died or the company moved on.
This happens more than you'd think. The IANA port registry contains hundreds of services that no longer exist—products that failed, protocols that were never implemented, experimental projects that got abandoned. The port numbers remain, like digital tombstones.
Real-World Use: N-able Take Control
While mosaicsyssvc1 sleeps, port 1235 works. N-able's Take Control remote desktop software uses both UDP ports 1234 and 1235 to test connectivity. Here's how it works:
When you start a remote session, Take Control first tries to establish a peer-to-peer (P2P) connection directly between your viewer and the remote agent. If both sides can reach each other on UDP ports 1234 and 1235, the traffic flows directly—lower latency, better performance.
If the P2P test fails (blocked by firewall, NAT issues, etc.), Take Control falls back to routing everything through its relay servers. The connection works either way, but P2P is faster when it succeeds.
The UDP traffic on 1235 is bidirectional and optional—the software doesn't require it, but performance suffers without it.2
Why This Matters
Port 1235 perfectly illustrates the gap between IANA's registry and reality. The official service is a mystery. The actual use is documented, active, and serving real users every day.
This is how the Internet actually works. Port assignments provide order—a starting point for avoiding conflicts—but they don't control what happens on real networks. Services die. Software gets repurposed. Ports outlive their original assignments and find new purposes.
The registry is a map, not the territory. And port 1235 is a reminder that the territory always wins.
How to Check What's Using Port 1235
On Linux or macOS:
On Windows:
If you see traffic on 1235 and you're running N-able Take Control, that's expected. If you see something else—especially if you're not running remote desktop software—it's worth investigating.
Frequently Asked Questions About Port 1235
Nakatulong ba ang pahinang ito?