# WHATPORT(6025)

## NAME

port 6025 — X11 display :25 — X11 display :25 — high display numbers like this usually mean many forwarded or virtual sessions.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA assigns the whole 6000-6063 range to X11, so 6025 is display :25. Display numbers this high normally come from a multi-user host: sshd hands each X11-forwarded session the next free display starting at :10, and Xvfb/Xvnc farms allocate them in bulk for headless browsers and test runners. Seeing it listening on a public interface means the X transport was left on TCP rather than confined to the loopback socket sshd normally uses.

## EXPOSURE

**Do not expose.** Forwarded and virtual displays carry real sessions; exposing them over TCP hands out screen contents and input injection with only a cookie in the way.

## CHECK

```sh
xdpyinfo -display TARGET:25
```

## SEE ALSO

- docs — [Xsecurity(7) — X display access control](https://xorg.freedesktop.org/archive/X11R7.7/doc/man/man7/Xsecurity.7.xhtml) (xorg.freedesktop.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 6000-6063 (x11)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6025) (iana.org)

---

HTML: <https://whatport.net/6025/> · JSON: <https://whatport.net/6025.json> · full dataset: <https://whatport.net/ports.json>