An X server accepting TCP connections on display :0 — the classic "your desktop is open" finding.
IANA assigns 6000-6063 to x11, the X Window System, one port per display: 6000 is display :0, 6001 is :1, and so on. An X server that has not been told otherwise listens on TCP as well as its Unix socket, and access is decided by a host list (xhost) or a MIT-MAGIC-COOKIE-1 token in ~/.Xauthority. Modern distributions start the server with -nolisten tcp, so an open 6000 means someone explicitly re-enabled TCP — usually to make remote GUI apps work without SSH X forwarding.
Do not expose
An X client can read the whole screen, grab the clipboard, and inject synthetic keystrokes. With xhost + there is no authentication at all, and the protocol is cleartext regardless — use ssh -X instead.
$ xdpyinfo -display TARGET:0Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.