# WHATPORT(264)

## NAME

port 264 — Check Point FW1 topology (IANA: BGMP) — Check Point's SecuRemote topology download — the single most reliable fingerprint for a Check Point gateway.

Protocol: TCP  
IANA: bgmp

## DESCRIPTION

IANA registered 264 for BGMP, the Border Gateway Multicast Protocol of RFC 3913, which was never deployed. The port's real occupant is Check Point's FW1_topo service: remote-access VPN clients connect here to fetch the gateway's encryption domain and network topology before building a tunnel. Because that exchange historically answered unauthenticated queries, 264 became a standard reconnaissance target — a scanner that gets a response can often read the firewall's hostname and internal network list. Seeing 264 open on a public IP identifies the vendor immediately.

## EXPOSURE

**Do not expose.** The topology service has leaked gateway hostnames and internal network ranges to unauthenticated clients; if remote-access VPN does not need it, Check Point lets you disable the implied rule that opens it.

## CHECK

```sh
nmap -sV -p 264 TARGET
```

## SEE ALSO

- spec — [RFC 3913 — Border Gateway Multicast Protocol (BGMP), the registered use](https://www.rfc-editor.org/rfc/rfc3913.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 264](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=264) (iana.org)
- source — [nmap-services — 264/udp fw1-or-bgmp](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/264/> · JSON: <https://whatport.net/264.json> · full dataset: <https://whatport.net/ports.json>