# WHATPORT(6003)

## NAME

port 6003 — X11 (display :3) — X display :3 — and the one number in the X11 range IANA flags for known unauthorized use.

Protocol: TCP  
IANA registry

## DESCRIPTION

6003 is display :3 in IANA's 6000-6063 x11 assignment, and the registry attaches an explicit note to it: "Known Unauthorized Use on port 6003". That flag reflects backdoors and trojans that historically chose this port precisely because a listener there looks like an ordinary X display to a casual scan. A genuine X server here behaves exactly like 6000; the difference is that you should not assume it is one.

## EXPOSURE

**Do not expose.** Confirm the listening process rather than trusting the port name — IANA itself records unauthorized use here. A real X display is still never safe to expose.

## CHECK

```sh
sudo lsof -nP -iTCP:6003 -sTCP:LISTEN
```

## SEE ALSO

- iana — [IANA port registry — 6000-6063 (x11), incl. the unauthorized-use note](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=x11) (iana.org)
- docs — [X.Org — Xserver(1) manual page](https://xorg.freedesktop.org/archive/current/doc/man/man1/Xserver.1.xhtml) (xorg.freedesktop.org)

---

HTML: <https://whatport.net/6003/> · JSON: <https://whatport.net/6003.json> · full dataset: <https://whatport.net/ports.json>