The second X display — very often an Xvnc or Xvfb server rather than a physical screen.
6001 is display :1 inside IANA's 6000-6063 x11 range. On a workstation it is the second X server; far more often it belongs to a headless one — Xvfb for CI screenshot jobs, or the X server side of a VNC session started as vncserver :1, which pairs it with RFB on 5901. Scan data shows it open slightly more often than 6000, which fits the headless-server pattern.
Do not expose
Same protocol, same problem: a connected client can screenshot and inject input. Bind the X server to localhost and reach it over SSH forwarding or through the VNC layer, not directly.
$ xdpyinfo -display TARGET:1Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.