Internet-Security raven logo internet-security.com

TCP 6000

ProtocolTCP
Port6000
LabelsX11—used between an X client and server over the network

Synopsis

  • TCP port 6000 is the standard port for the X Window System (X11) display server (6000 + display number).
  • On Unix/Linux, Xorg and Xvfb use it for remote GUI display; e.g., Xorg on display :0 listens on 6000, :1 on 6001.
  • On macOS, XQuartz provides an X11 server that can listen on 6000+ for networked X clients.
  • On Windows, third‑party X servers such as VcXsrv, Xming, Cygwin/X, and OpenText Exceed accept X11 connections on 6000+.
  • OpenSSH’s X11 forwarding creates localhost‑only listeners on 6010+ on the server side to tunnel X11 over SSH.
  • Historically, Solaris/OpenWindows and SGI IRIX desktops used X11 over TCP 6000 for remote applications.
  • Security: Exposed X11 on 6000 is a common target; attackers can connect to misconfigured X servers to capture keystrokes/screens or inject input, so many systems disable X over TCP by default.

Observed activity

Last 30 days Detailed chart

More information