{
  "port": 264,
  "protocol": "tcp",
  "service": "Check Point FW1 topology (IANA: BGMP)",
  "oneLiner": "Check Point's SecuRemote topology download — the single most reliable fingerprint for a Check Point gateway.",
  "whatItIs": "IANA registered 264 for BGMP, the Border Gateway Multicast Protocol of RFC 3913, which was never deployed. The port's real occupant is Check Point's FW1_topo service: remote-access VPN clients connect here to fetch the gateway's encryption domain and network topology before building a tunnel. Because that exchange historically answered unauthenticated queries, 264 became a standard reconnaissance target — a scanner that gets a response can often read the firewall's hostname and internal network list. Seeing 264 open on a public IP identifies the vendor immediately.",
  "exposure": {
    "verdict": "never",
    "note": "The topology service has leaked gateway hostnames and internal network ranges to unauthenticated clients; if remote-access VPN does not need it, Check Point lets you disable the implied rule that opens it."
  },
  "checkCommand": "nmap -sV -p 264 TARGET",
  "links": [
    {
      "title": "RFC 3913 — Border Gateway Multicast Protocol (BGMP), the registered use",
      "url": "https://www.rfc-editor.org/rfc/rfc3913.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 264",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=264",
      "kind": "iana"
    },
    {
      "title": "nmap-services — 264/udp fw1-or-bgmp",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "bgmp"
}