# WHATPORT(5900)

## NAME

port 5900 — VNC (RFB) — A VNC server — someone's desktop is available for remote control on display :0.

Protocol: TCP  
IANA registry

## DESCRIPTION

RFB is the wire protocol behind VNC, and 5900 is display :0 (5901 is :1, and so on up). You will find it on macOS with Screen Sharing enabled, on Linux hosts running TigerVNC, x11vnc, or a Raspberry Pi with RealVNC, and on hypervisor consoles from QEMU/KVM, Proxmox, and ESXi. The server greets every connection with a plaintext version banner such as RFB 003.008 before any authentication happens, which makes it trivial to fingerprint.

## EXPOSURE

**Do not expose.** Classic VNC authentication is a challenge-response over a DES key truncated to 8 characters with no transport encryption, and many servers permit no auth at all — tunnel it over SSH or a VPN instead.

## CHECK

```sh
nc -w 3 TARGET 5900 | head -c 12; echo
```

## SEE ALSO

- spec — [RFC 6143 — The Remote Framebuffer Protocol](https://datatracker.ietf.org/doc/html/rfc6143) (datatracker.ietf.org)
- iana — [IANA port registry — 5900 (rfb)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5900) (iana.org)
- source — [TigerVNC/tigervnc](https://github.com/TigerVNC/tigervnc) (github.com)

---

HTML: <https://whatport.net/5900/> · JSON: <https://whatport.net/5900.json> · full dataset: <https://whatport.net/ports.json>