Internet-Security raven logo internet-security.com

TCP 5900

ProtocolTCP
Port5900
LabelsRemote Frame Buffer protocol (RFB)

Synopsis

  • TCP 5900 is the default port for the RFB protocol used by VNC remote desktop servers.
  • RealVNC Server, TightVNC, UltraVNC, TigerVNC, x11vnc, and Raspberry Pi VNC Server listen on 5900 for display :0 (with display :1 on 5901, etc.).
  • Apple macOS Screen Sharing/Apple Remote Desktop (VNC-compatible) and GNOME “Screen Sharing” accept connections on 5900.
  • Virtualization platforms expose guest consoles via VNC on this port, including QEMU/KVM/libvirt (per-VM on 5900+n) and optionally VMware ESXi’s VNC console (often 5900–5964 when enabled).
  • Many KVM-over-IP devices (e.g., Raritan, Lantronix Spider, ATEN) provide a VNC service on 5900.
  • Intel AMT’s KVM feature offers a VNC-compatible listener on 5900 when enabled.
  • Security note: attackers commonly scan and brute-force exposed VNC services on 5900, and older VNC implementations have had authentication bypass or weakness vulnerabilities, making it a frequent initial-access target when left open.

Observed activity

Last 30 days Detailed chart

More information