Internet-Security raven logo internet-security.com

TCP 6022

ProtocolTCP
Port6022
LabelsX11—used between an X client and server over the network

Synopsis

  • TCP port 6022 is assigned to the X Window System (X11); it represents X11 display :22 (X11 uses TCP 6000–6063 for displays :0–:63).
  • You’ll see it on Unix-like systems (Linux with Xorg/Xvfb, Solaris, AIX, HP-UX) and macOS with XQuartz when X11 is configured to listen on TCP, e.g., for remote X sessions or XDMCP-based logins.
  • Real examples include legacy thin-client environments connecting to Linux display managers over X11 TCP, CI servers launching Xvfb :22 with -listen tcp, and SSH X11 forwarding using localhost TCP ports (e.g., DISPLAY=localhost:22.0 maps to local TCP 6022).
  • Exposed X11 TCP ports have been abused: if access controls are lax, attackers can capture keystrokes/screens or inject input, which is why many systems disable X11 TCP listening by default.

Observed activity

Last 30 days Detailed chart

More information