1. Ports
  2. Port 3235

What Port 3235 Does

Port 3235 is registered with IANA for MDAP — a protocol developed by Alcatel for managing DSL routers from software on the same local network. 1

MDAP uses UDP and the multicast address 224.0.0.103. When a management application wants to find routers, it doesn't need to know their IP addresses. It just sends a multicast message to 224.0.0.103:3235 and waits for routers to answer. Every MDAP-capable device on the network hears the call and responds. 2

From there, the protocol lets software retrieve system information from the router and execute commands — essentially a remote management session, all over multicast UDP.

The Security Problem

Every byte MDAP sends is unencrypted. Login credentials, commands, responses — all of it travels across the local network in plaintext, readable by anyone monitoring the wire. 2

This wasn't an oversight that got fixed. It's just how the protocol worked, and it shipped in Alcatel/Speedtouch/Thomson/Technicolor DSL routers that went to millions of homes and small offices. If you were on the same network segment as one of these routers — a shared DSL line, a poorly segmented office network — you could watch the management traffic. All of it.

Who Registered It

IANA registered port 3235 for MDAP on February 1, 2002. The registrant was Johan Deleu at Alcatel. No RFC was ever published for the protocol. 1

This is fairly common for proprietary vendor protocols of that era: register the port with IANA (which is the right thing to do), build the implementation, ship it — but skip the part where you publish a standard that the world can scrutinize.

A Note on Conflicting Sources

Some port databases label port 3235 as "Galaxy Network Service" used by Gateway Ticketing Systems, a ticketing software vendor for attractions like zoos and museums. This appears to be an unofficial or conflated listing. The authoritative IANA registry assigns this port to MDAP. 1

Unofficial port reuse like this is common. If Gateway Ticketing or any other software happens to use port 3235, that's a private convention layered on top of — or ignorant of — the IANA assignment.

Checking What's on This Port

To see if anything is listening on port 3235 on your machine:

Linux/macOS:

ss -ulnp | grep 3235
# or
lsof -i UDP:3235

Windows:

netstat -ano | findstr :3235

If you see this port active on a device and you're not running MDAP-capable router management software, it's worth investigating. Any service can bind to any port — an open 3235 could be routine, or it could be something unexpected.

What the Registered Port Range Means

Port 3235 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific applications and protocols, but unlike well-known ports (0–1023), they don't require root/administrator privileges to bind. 3

Registered ports represent the middle ground of port space: not reserved for OS-level services, not ephemeral throwaway ports, but documented for specific purposes. When software wants a consistent, recognizable port for a protocol, registering in this range is the path.

此页面对您有帮助吗?

😔
🤨
😃