Internet-Security raven logo internet-security.com

TCP 6005

ProtocolTCP
Port6005
LabelsBMC Software Control-M/Server

Synopsis

  • TCP port 6005 is used by the X Window System (X11) for display number 5 (ports 6000–6063 map to X11 displays).
  • Real software that can listen here includes the X.Org X server on Linux/Unix, OpenText/Hummingbird Exceed and Xming on Windows, and XQuartz on macOS (when TCP listening is enabled).
  • It also appears on legacy Unix workstations (e.g., Sun/Solaris CDE, HP-UX, AIX) during remote X sessions.
  • Network scanners (e.g., Nmap) commonly report this as “X11:5.”
  • Security note: Open X11 servers on 6000–6063 are frequently targeted; misconfigurations (xhost + or weak MIT-MAGIC-COOKIE) allow attackers to capture keystrokes/screens or inject input.

Observed activity

Last 30 days Detailed chart

More information