# WHATPORT(5902)

## NAME

port 5902 — VNC (RFB) display :2 — A second VNC desktop on the same host — display :2.

Protocol: TCP  
IANA registry

## DESCRIPTION

5902 is 5900 plus display 2. Finding it open means the host is running more than one VNC session at once: a second user on a shared Linux machine, a second virtual machine console on a KVM or Proxmox host, or a second `vncserver` instance for a different desktop environment. The protocol is identical to 5900 and 5901 — a plaintext RFB version banner, then authentication.

## EXPOSURE

**Do not expose.** Every additional VNC display multiplies the same weak, unencrypted authentication surface. Keep all of them on the loopback interface behind SSH or a VPN.

## CHECK

```sh
nc -w 3 TARGET 5902 | head -c 12; echo
```

## SEE ALSO

- spec — [RFC 6143 — The Remote Framebuffer Protocol](https://datatracker.ietf.org/doc/html/rfc6143) (datatracker.ietf.org)
- source — [TigerVNC/tigervnc](https://github.com/TigerVNC/tigervnc) (github.com)
- iana — [IANA port registry — 5902 (unassigned; 5900 is rfb)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5902) (iana.org)

---

HTML: <https://whatport.net/5902/> · JSON: <https://whatport.net/5902.json> · full dataset: <https://whatport.net/ports.json>