Internet-Security raven logo internet-security.com

TCP 6001

ProtocolTCP
Port6001
LabelsX11—used between an X client and server over the network

Synopsis

  • TCP port 6001 is used by the X Window System (X11) for display :1 (X servers listen on 6000 + display number).
  • Real-world software that can listen on 6001 includes Xorg on Linux/Unix, XQuartz on macOS, and Windows X servers such as Xming and VcXsrv when TCP listening is enabled.
  • Thin-client and remote-login setups using XDMCP (e.g., older GNOME/CDE environments, Sun Ray/NCD terminals) can expose X11 on ports like 6001.
  • Some remote-desktop appliances or terminal servers that present Unix desktops over X11 may also open 6001 for the second display.
  • Security note: Open or misconfigured X11 servers on 6001 have been widely abused for unauthorized screen/keyboard capture and window injection, and are commonly scanned by attackers.
  • Outside X11, there is no widely adopted, default service known to use TCP 6001.

Observed activity

Last 30 days Detailed chart

More information