A VNC server on display :1 — the standard first per-user desktop on a Linux box.
RFB uses 5900 plus the display number, so 5901 is display :1. On Linux this is the most common VNC port of all, because vncserver allocates :1 to the first user who starts a session, ahead of :0 which is usually the physical console. TigerVNC, TightVNC, and x11vnc all land here. The server answers every connection with a plaintext version banner such as RFB 003.008 before authentication, so it is trivial to identify.
Do not expose
VNC authentication is a challenge-response over a DES key truncated to 8 characters, with the session itself unencrypted, and many servers are configured with no auth at all. Bind it to localhost and forward it over SSH.
$ nc -w 3 TARGET 5901 | head -c 12; echoSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.