Internet-Security raven logo internet-security.com

TCP 6003

ProtocolTCP
Port6003
LabelsX11—used between an X client and server over the network

Synopsis

  • X Window System (X11) uses TCP port 6003 for display :3 (X11 listens on 6000 + display number).
  • Real-world servers that can listen on this port include X.Org X server on Linux/Unix, XQuartz on macOS, and Windows X servers like VcXsrv, Xming, Cygwin/X, and OpenText (Hummingbird) Exceed when TCP listening is enabled.
  • You’ll commonly see 6003/tcp open when an X server is running with display number 3 and not started with the “-nolisten tcp” option (or equivalent).
  • XDMCP-based setups (e.g., XDM/GDM/KDM) may result in X11 data flowing over 6003 for display :3 after initial UDP 177 discovery.
  • Some legacy Unix workstations (e.g., older Solaris or HP-UX with Xsun/Xorg) also use this port in networked X11 environments.
  • Security note: Open X11 ports (6000–6063, including 6003) have historically been abused to capture keystrokes, screenshots, or inject input when access control is misconfigured (e.g., “xhost +”), so they are frequent scan targets.

Observed activity

Last 30 days Detailed chart

More information