256

Port 256/tcp is registered with IANA under the service name rap, description "RAP," with both assignee and contact listed as [J_S_Greenfield]. The entry is dual-registered — 256/udp carries an identical service name, description, and assignee — and the IANA registry's Reference (RFC) column is blank for both rows, as are the Registration Date and Modification Date columns. This absence of a cited RFC is notable because the assignee name overlaps with J. S. Greenfield, co-author of RFC 1476, "RAP: Internet Route Access Protocol" (1993). However, RFC 1476 itself specifies TCP port 38 for the Route Access Protocol, not port 256, and no authoritative source reconciles that mismatch — IANA's own row cites nothing, and secondary mirrors (a vendor knowledge-base and a ports-reference site) simply repeat the "rap" label without resolving the discrepancy. No CVEs, malware families, or scanning campaigns specific to port 256 turned up in research, and it does not appear among commonly targeted or well-known ports in general references. On balance, port 256/tcp is best treated as a thinly documented legacy IANA assignment whose real-world protocol identity is unconfirmed, rather than as an active or notably risky service.

IANA assignment

rap — "RAP"; reference blank (no RFC cited); assignee/contact [J_S_Greenfield]; dual-registered 256/tcp + 256/udp with identical fields [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV, lines 576–577; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023)

Registration/modification dates

both blank in the IANA registry row for this entry — not fabricated [Confirmed] — IANA registry CSV

Related ports

none confirmed; 256/udp shares the identical IANA registration [Confirmed] — IANA registry CSV

Common software using this port

none identified; absent from Wikipedia's list of well-known TCP/UDP ports

Security implications / exposure notes

no CVEs, malware associations, or scanner/attacker-target signal found for this port

Typically seen on

Unknown — no current or historical deployment evidence found

Possible protocol identity

RFC 1476 "RAP: Internet Route Access Protocol" (J. S. Greenfield et al., 1993) shares the assignee name and the "RAP" label, but the RFC specifies TCP port 38, not 256, and IANA cites no reference for the port-256 entry — the relationship is plausible but unreconciled

[Likely] — https://www.rfc-editor.org/rfc/rfc1476.html, https://datatracker.ietf.org/doc/rfc1476/

Secondary mirrors

a vendor knowledge base and a ports-reference site list port 256 as "rap" but add no detail beyond the IANA label and do not address the port-38-vs-256 conflict [Likely] — https://kb.eventtracker.com/evtpass/evtPages/PortNo_256_rap_9499.asp, https://www.speedguide.net/port.php?port=256

Port 256/udp is registered with IANA under the service name rap, described simply as "RAP," with both the assignee and contact recorded as J. S. Greenfield. The Registration Date, Modification Date, Reference, Service Code, and Assignment Notes fields are all blank in the current registry — there is no RFC or other document backing this assignment, only the bare name-to-port mapping. The entry is dual-registered: the identical service name, description, assignee, and contact also appear for 256/tcp, with the same blank date and reference fields on that side too. This bare "RAP" label is a frequent source of confusion with RFC 1476's "Internet Route Access Protocol," which is an unrelated, actually-documented protocol assigned to port 38 — the two should not be conflated despite the shared acronym. Independent research turns up no UDP-specific real-world usage of port 256. The only substantive real-world association found for the port at all is on the TCP side: legacy Check Point FireWall-1/VPN-1 deployments (4.x product line) used TCP/256 for management-plane traffic such as rulebase downloads, topology fetches, and high-availability sync. Whether this Check Point convention extends to the UDP port is undocumented in any source reviewed. No malware or trojan association is confirmed for this port on either transport: port 256 does not appear at all on Gary Kessler's widely-cited bad-ports reference.

IANA service name

rap, description "RAP" — [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (cached, line 577); cross-checked against https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Registration Date / Modification Date / Reference / Service Code / Assignment Notes

all blank in the registry — no RFC or date exists to report — [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 577)

Malware/trojan association

none confirmed on either transport — port 256 is absent entirely from the widely-cited Gary Kessler bad-ports reference, and no CVE or named campaign was found —

Common software for UDP/256 specifically

none found — [Unknown]

Assignee / contact

[J_S_Greenfield] for both fields — [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (line 577)

Dual-registration

identical rap/RAP entry, same assignee/contact, also registered for 256/tcp (line 576), also with blank dates/reference — [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 576–577)

Not to be confused with

RFC 1476 "Internet Route Access Protocol" (also abbreviated RAP), which is a distinct, documented protocol assigned to port 38, not 256 — [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml

Real-world usage

no UDP-specific usage documented; Check Point FireWall-1/VPN-1 (legacy 4.x) used TCP/256 for management-plane traffic (rulebase download, topology fetch, HA sync) — a vendor/community convention, not an IANA-sanctioned assignment, and not confirmed to extend to the UDP port — [Likely, TCP side only] — https://dkcheckpoint.blogspot.com/2017/04/ports-use-by-checkpoint-fw.html, http://www.datadisk.co.uk/pdf_docs/firewall_ports.pdf