X11 display :9 — the last display number below where SSH X11 forwarding starts.
TCP 6009 is X display :9 under IANA's 6000-6063 x11 registration. It is worth knowing because sshd's X11DisplayOffset defaults to 10, so forwarded X sessions begin at :10 (port 6010) precisely to avoid colliding with real local displays like this one. A listener on 6009 therefore means a genuine X server with TCP transport enabled, not an SSH forwarding artifact. That is unusual on a current system, where X normally runs with -nolisten tcp.
Do not expose
Unauthenticated or xhost-permissive X over TCP gives an attacker the display, the keyboard, and the clipboard; tunnel X through SSH instead of opening the port.
$ nc -vz TARGET 6009Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.