{
  "port": 5911,
  "protocol": "tcp",
  "service": "ats-acars (IANA) / VNC display :11",
  "oneLiner": "Registered to an aeronautical ACARS service you will never meet; in practice it is VNC display :11.",
  "whatItIs": "IANA assigns TCP/UDP 5911 to `ats-acars`, \"Air Traffic Services applications using ACARS\" (the SCTP side of the same number is `cpdlc`, Controller Pilot Data Link Communication). Those are ICAO datalink registrations for aviation ground/air networks and they do not appear on the public internet. What actually answers here is a VNC server: RFB maps display :N to port 5900+N, so 5911 is display :11, handed out by QEMU/KVM, VirtualBox VRDE, or a multi-user Linux host running one Xvnc per user.",
  "exposure": {
    "verdict": "never",
    "note": "If it is VNC it inherits VNC's problems — a plaintext RFB version banner before auth, and a legacy DES challenge-response capped at 8 password characters. Reach it over SSH or a VPN, not directly."
  },
  "checkCommand": "nc -w 3 TARGET 5911 | head -c 12; echo",
  "links": [
    {
      "title": "IANA port registry — 5911 (ats-acars, cpdlc)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5911",
      "kind": "iana"
    },
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    },
    {
      "title": "TigerVNC/tigervnc",
      "url": "https://github.com/TigerVNC/tigervnc",
      "kind": "github"
    }
  ]
}