# WHATPORT(5901)

## NAME

port 5901 — VNC (RFB) display :1 — A VNC server on display :1 — the standard first per-user desktop on a Linux box.

Protocol: TCP  
IANA registry

## DESCRIPTION

RFB uses 5900 plus the display number, so 5901 is display :1. On Linux this is the most common VNC port of all, because `vncserver` allocates :1 to the first user who starts a session, ahead of :0 which is usually the physical console. TigerVNC, TightVNC, and x11vnc all land here. The server answers every connection with a plaintext version banner such as `RFB 003.008` before authentication, so it is trivial to identify.

## EXPOSURE

**Do not expose.** VNC authentication is a challenge-response over a DES key truncated to 8 characters, with the session itself unencrypted, and many servers are configured with no auth at all. Bind it to localhost and forward it over SSH.

## CHECK

```sh
nc -w 3 TARGET 5901 | head -c 12; echo
```

## SEE ALSO

- spec — [RFC 6143 — The Remote Framebuffer Protocol](https://datatracker.ietf.org/doc/html/rfc6143) (datatracker.ietf.org)
- source — [TigerVNC/tigervnc](https://github.com/TigerVNC/tigervnc) (github.com)
- iana — [IANA port registry — 5901 (unassigned; 5900 is rfb)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5901) (iana.org)

---

HTML: <https://whatport.net/5901/> · JSON: <https://whatport.net/5901.json> · full dataset: <https://whatport.net/ports.json>