Almost always a Check Point firewall or management server, despite the IANA registration reading "RAP".
IANA assigned 256 to "RAP" in the early 1990s and nothing public ever implemented it. In practice the port belongs to Check Point: the FWD daemon on a Security Gateway and Security Management Server uses TCP 256 for policy and log traffic between gateway and manager, which is why Nmap's service list names it fw1-secureremote. If 256 answers, you have found a Check Point firewall or its management console, and the rest of the low-256-to-265 block usually answers too. This is a management plane, not a user-facing service.
Do not expose
This is the firewall's own control channel between gateway and management server; reaching it from the internet means the device managing your perimeter is itself on the perimeter.
$ nmap -sV -p 256,257,259,264 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.