{
  "port": 259,
  "protocol": "tcp",
  "service": "ESRO (IANA) — in practice Check Point client authentication",
  "oneLiner": "Registered to ESRO, but on a real network it is usually Check Point FireWall-1 client authentication.",
  "whatItIs": "IANA assigns 259 to esro-gen, Efficient Short Remote Operations, a lightweight RPC-over-UDP scheme specified in RFC 2188 for low-bandwidth links; you will effectively never meet a live ESRO server. What you do meet is Check Point: TCP 259 carries FireWall-1 Client Authentication, where a user telnets to the firewall, logs in, and the firewall then opens rules for that source address. Nmap's list separately marks 259/udp as Check Point's proprietary RDP tunnelling protocol. An open 259 next to 256 and 264 is a Check Point gateway, not ESRO.",
  "exposure": {
    "verdict": "never",
    "note": "Check Point client authentication is an interactive login prompt on the firewall itself — a cleartext credential surface that also grants network access on success."
  },
  "checkCommand": "nmap -sV -p 259 TARGET",
  "links": [
    {
      "title": "RFC 2188 — AT&T/Neda's Efficient Short Remote Operations (ESRO)",
      "url": "https://www.rfc-editor.org/rfc/rfc2188.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 259",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=259",
      "kind": "iana"
    },
    {
      "title": "nmap-services — 259/udp firewall1-rdp",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "esro-gen"
}