# WHATPORT(5801)

## NAME

port 5801 — VNC over HTTP (display :1) — The same VNC web-viewer port as 5800, one display up: display :1.

Protocol: TCP  
IANA registry

## DESCRIPTION

VNC servers place their HTTP viewer listener at 5800 plus the display number, so 5801 is display :1 — the first display a Linux `vncserver` normally creates for a user. The page it serves is a Java applet that connects onward to the matching RFB port, 5901. IANA has never assigned 5801; seeing it open means a VNC server with a per-user display is running, and 5901 is almost certainly open too.

## EXPOSURE

**Do not expose.** Same problem as 5800: it publicly identifies a VNC server whose RFB authentication is weak and unencrypted. Keep both this and 5901 on the loopback or behind an SSH tunnel.

## CHECK

```sh
curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5801/
```

## SEE ALSO

- source — [x11vnc — -http option, Java vncviewer download on the 5800+display port](https://github.com/LibVNC/x11vnc/blob/master/src/help.c) (github.com)
- source — [TigerVNC — the VNC/RFB server most Linux distributions ship](https://github.com/TigerVNC/tigervnc) (github.com)
- iana — [IANA port registry — 5801 (unassigned)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5801) (iana.org)

---

HTML: <https://whatport.net/5801/> · JSON: <https://whatport.net/5801.json> · full dataset: <https://whatport.net/ports.json>