WHATPORT(5900) whatport.net WHATPORT(5900)
5900

VNC (RFB)

A VNC server — someone's desktop is available for remote control on display :0.

TCP IANA registry

Description

RFB is the wire protocol behind VNC, and 5900 is display :0 (5901 is :1, and so on up). You will find it on macOS with Screen Sharing enabled, on Linux hosts running TigerVNC, x11vnc, or a Raspberry Pi with RealVNC, and on hypervisor consoles from QEMU/KVM, Proxmox, and ESXi. The server greets every connection with a plaintext version banner such as RFB 003.008 before any authentication happens, which makes it trivial to fingerprint.

Exposed to the internet?

Do not expose

Classic VNC authentication is a challenge-response over a DES key truncated to 8 characters with no transport encryption, and many servers permit no auth at all — tunnel it over SSH or a VPN instead.

Check it yourself

$ nc -w 3 TARGET 5900 | head -c 12; echo

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.