# WHATPORT(256)

## NAME

port 256 — Check Point FireWall-1 (IANA: RAP) — Almost always a Check Point firewall or management server, despite the IANA registration reading "RAP".

Protocol: TCP  
IANA: rap

## DESCRIPTION

IANA assigned 256 to "RAP" in the early 1990s and nothing public ever implemented it. In practice the port belongs to Check Point: the FWD daemon on a Security Gateway and Security Management Server uses TCP 256 for policy and log traffic between gateway and manager, which is why Nmap's service list names it fw1-secureremote. If 256 answers, you have found a Check Point firewall or its management console, and the rest of the low-256-to-265 block usually answers too. This is a management plane, not a user-facing service.

## EXPOSURE

**Do not expose.** This is the firewall's own control channel between gateway and management server; reaching it from the internet means the device managing your perimeter is itself on the perimeter.

## CHECK

```sh
nmap -sV -p 256,257,259,264 TARGET
```

## SEE ALSO

- iana — [IANA Service Name and Transport Protocol Port Number Registry — 256](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=256) (iana.org)
- source — [nmap-services — 256/tcp fw1-secureremote](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/256/> · JSON: <https://whatport.net/256.json> · full dataset: <https://whatport.net/ports.json>