Internet-Security raven logo internet-security.com

TCP 6009

ProtocolTCP
Port6009
LabelsJD Edwards EnterpriseOne ERP system

Synopsis

  • TCP port 6009 is used by the X Window System (X11) for display number 9 (i.e., X11 listens on 6000 + display).
  • Real-world X servers that can listen on 6009 include X.Org on Linux/BSD/Unix, Solaris (Xsun/Xorg), and X servers on HP-UX and AIX when TCP listening is enabled.
  • Windows X server software such as Xming, VcXsrv, OpenText Exceed, and MobaXterm’s X server can also use port 6009 for display :9.
  • Practical use: running remote X11 applications (e.g., xterm, MATLAB, xclock) over TCP when the DISPLAY is set to host:9.0.
  • Security note: Exposed X11 ports (6000–6063, including 6009) are frequently targeted for unauthorized display access, keystroke sniffing, and screen/clipboard capture; attackers and tools (e.g., Metasploit modules, xspy, xwd) scan for open X servers lacking proper MIT-MAGIC-COOKIE authentication.
  • Many modern systems disable X11 TCP listening by default, so port 6009 is typically unused unless explicitly enabled.

Observed activity

Last 30 days Detailed chart

More information