# WHATPORT(259)

## NAME

port 259 — ESRO (IANA) — in practice Check Point client authentication — Registered to ESRO, but on a real network it is usually Check Point FireWall-1 client authentication.

Protocol: TCP  
IANA: esro-gen

## DESCRIPTION

IANA assigns 259 to esro-gen, Efficient Short Remote Operations, a lightweight RPC-over-UDP scheme specified in RFC 2188 for low-bandwidth links; you will effectively never meet a live ESRO server. What you do meet is Check Point: TCP 259 carries FireWall-1 Client Authentication, where a user telnets to the firewall, logs in, and the firewall then opens rules for that source address. Nmap's list separately marks 259/udp as Check Point's proprietary RDP tunnelling protocol. An open 259 next to 256 and 264 is a Check Point gateway, not ESRO.

## EXPOSURE

**Do not expose.** Check Point client authentication is an interactive login prompt on the firewall itself — a cleartext credential surface that also grants network access on success.

## CHECK

```sh
nmap -sV -p 259 TARGET
```

## SEE ALSO

- spec — [RFC 2188 — AT&T/Neda's Efficient Short Remote Operations (ESRO)](https://www.rfc-editor.org/rfc/rfc2188.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 259](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=259) (iana.org)
- source — [nmap-services — 259/udp firewall1-rdp](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/259/> · JSON: <https://whatport.net/259.json> · full dataset: <https://whatport.net/ports.json>