Port 6000 – X11

TCP

Port 6000 is the X11 (X Window System) display server port. Display :0 listens on port 6000, display :1 on 6001, and so on. X11 over TCP has no encryption and minimal authentication (xhost) – exposed X11 ports allow attackers to capture keystrokes and screen content. Modern systems disable TCP X11 and use Unix sockets.

Port Number

6000

Protocol

TCP

Service

X Window System

Range

IANA Registered (1024–49151)

Description

X Window System on port 6000 accepts remote display connections from X11 clients. Any application can connect to display :0 (port 6000) to render windows, capture keyboard input, and read the screen contents. The protocol predates modern security concerns – xhost-based access control provides IP-based allow/deny with no encryption. Modern Linux distributions disable X11 TCP listening by default (Xorg -nolisten tcp). Remote X11 should use SSH X forwarding (ssh -X), which tunnels the X11 protocol through the encrypted SSH connection. Wayland, the X11 successor, has no network transparency by design – applications cannot spy on other applications' input. If you find port 6000 open, it is almost certainly a misconfiguration.

Security risks

1xhost + vulnerability: running 'xhost +' disables all access control on the X11 display – any host on the network can connect to port 6000 and capture all keyboard input, mouse events, and screen contents. A single xhost + command exposes the entire session until reboot or explicit xhost - removal.
2Keystroke capture: the X11 protocol allows any connected client to register for all keyboard events via XSelectInput/XRecordExtension. An attacker connected to port 6000 silently captures passwords, SSH keys being typed, and private messages without any visible indicator to the user.
3Screen capture / screenshot theft: X11 clients can read the contents of any window (including other applications) via XGetImage. An attacker connected to port 6000 periodically screenshots the entire desktop, capturing credentials displayed in terminals, browser sessions, and documents.
4Keystroke injection: X11 allows connected clients to SEND synthetic keyboard/mouse events via XSendEvent or XTEST extension. An attacker injects commands into terminal windows, clicks buttons, or types malicious commands – the user sees their cursor moving on its own.
5No encryption: the X11 protocol on port 6000 transmits all data (pixels, keystrokes, clipboard contents) in cleartext. Any network observer between client and server reads everything. There is no TLS option for raw X11 – SSH tunneling is the only encryption path.

Firewall guidance

Block port 6000-6063 (entire X11 range) at the firewall unconditionally. Modern Linux distributions disable X11 TCP listening by default (Xorg -nolisten tcp). Verify with: ss -tlnp | grep 6000. For remote GUI applications, use SSH X forwarding exclusively: ssh -X user@host application. Wayland (X11 successor) has no network protocol at all, eliminating this attack surface entirely.

Diagnosis commands

Check if X11 is listening on TCP (should show nothing on modern systems)

shell

ss -tlnp | grep ':600[0-9]'

Show current X11 access control list (look for 'access control disabled' = vulnerable)

shell

xhost

Scan for open X11 displays on a host

shell

nmap -p 6000-6005 target

Verify -nolisten tcp is set in X server startup

shell

cat /etc/X11/xinit/xserverrc | grep nolisten

Usage examples

Port 6000 – X11

shell

xhost +remote_host # DANGEROUS
ssh -X user@host xeyes
nmap -p 6000 target
DISPLAY=:0 xdpyinfo

Common services on this port

Xorg serverXFree86 (legacy)XQuartz (macOS)X11 forwarded via SSH

Related ports

6001

X11 display :1

6010

SSH X11 forwarding (typical offset)

SSH (secure X11 forwarding via -X)

History

X Window System was developed at MIT in 1984. Port 6000 was chosen for display :0 (6000 + display number). X11 was designed for the MIT campus network where trust was assumed. The protocol has never been updated for modern security requirements – no encryption, no mandatory authentication. SSH X forwarding (1995) became the standard for remote X11 access. Wayland (2012, production-ready ~2020) replaces X11 with a protocol that has no network transparency by design.

FAQ

Is X11 forwarding over SSH secure?

Yes – ssh -X tunnels the X11 protocol through the encrypted SSH connection. The remote application connects to a virtual display that SSH relays securely. However, ssh -X with ForwardX11Trusted=yes (or ssh -Y) allows the remote side to snoop on your local display. Use ssh -X (untrusted forwarding) which restricts the remote application's access to your display via the SECURITY extension.

How do I check if my X11 is exposed?

Run: ss -tlnp | grep 6000. If nothing appears, TCP X11 is disabled (safe). If Xorg is listening on 0.0.0.0:6000 or :::6000, add -nolisten tcp to your X server startup (/etc/X11/xinit/xserverrc or the display manager config). Also check xhost output – if it shows 'access control disabled, clients can connect from any host', run xhost - immediately.