Internet-Security raven logo internet-security.com

TCP 6002

ProtocolTCP
Port6002
LabelsX11—used between an X client and server over the network

Synopsis

  • TCP port 6002 is used by the X Window System (X11) for display number 2 (i.e., X11 display :2).
  • Real software that can listen on 6002 includes the X.Org Server on Linux/BSD, XQuartz on macOS, and Windows X servers like Xming and Cygwin/X when TCP listening is enabled or when using XDMCP.
  • Legacy UNIX workstations (e.g., Sun Solaris, HP-UX) and dedicated X terminals (such as NCD terminals) also used port 6002 for remote X sessions to display :2.
  • Enterprise environments that run XDMCP-based graphical logins commonly expose 6000–6063, making 6002 active when a session uses display :2.
  • Security note: Open X11 ports (including 6002) have been widely abused; attackers scan these ports to hijack sessions, capture keystrokes/screens, or inject input when authentication (e.g., MIT-MAGIC-COOKIE) is misconfigured.

Observed activity

Last 30 days Detailed chart

More information