# WHATPORT(6009)

## NAME

port 6009 — X11 display :9 — X11 display :9 — the last display number below where SSH X11 forwarding starts.

Protocol: TCP  
IANA registry

## DESCRIPTION

TCP 6009 is X display :9 under IANA's 6000-6063 x11 registration. It is worth knowing because sshd's X11DisplayOffset defaults to 10, so forwarded X sessions begin at :10 (port 6010) precisely to avoid colliding with real local displays like this one. A listener on 6009 therefore means a genuine X server with TCP transport enabled, not an SSH forwarding artifact. That is unusual on a current system, where X normally runs with -nolisten tcp.

## EXPOSURE

**Do not expose.** Unauthenticated or xhost-permissive X over TCP gives an attacker the display, the keyboard, and the clipboard; tunnel X through SSH instead of opening the port.

## CHECK

```sh
nc -vz TARGET 6009
```

## SEE ALSO

- docs — [Xserver(1) — display numbers and -nolisten](https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man1/Xserver.1.xhtml) (xorg.freedesktop.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 6000-6063 (x11)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6009) (iana.org)

---

HTML: <https://whatport.net/6009/> · JSON: <https://whatport.net/6009.json> · full dataset: <https://whatport.net/ports.json>