{
  "port": 256,
  "protocol": "tcp",
  "service": "Check Point FireWall-1 (IANA: RAP)",
  "oneLiner": "Almost always a Check Point firewall or management server, despite the IANA registration reading \"RAP\".",
  "whatItIs": "IANA assigned 256 to \"RAP\" in the early 1990s and nothing public ever implemented it. In practice the port belongs to Check Point: the FWD daemon on a Security Gateway and Security Management Server uses TCP 256 for policy and log traffic between gateway and manager, which is why Nmap's service list names it fw1-secureremote. If 256 answers, you have found a Check Point firewall or its management console, and the rest of the low-256-to-265 block usually answers too. This is a management plane, not a user-facing service.",
  "exposure": {
    "verdict": "never",
    "note": "This is the firewall's own control channel between gateway and management server; reaching it from the internet means the device managing your perimeter is itself on the perimeter."
  },
  "checkCommand": "nmap -sV -p 256,257,259,264 TARGET",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 256",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=256",
      "kind": "iana"
    },
    {
      "title": "nmap-services — 256/tcp fw1-secureremote",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "rap"
}