Port 5900 VNC – Free, Online, Private

What listens on 5900

Port 5900 is RFB, RFC 6143. The IANA name is rfb, Remote Framebuffer. VNC servers speak it. Display :0 is 5900, display :1 is 5901, and so on. A client pointed at 5900 is pointed at the first display only. The protocol starts with a version banner, RFB 003.008 and similar, then security types. Some of those types are no authentication at all. TLS and VeNCrypt are extensions, not the base protocol. UDP 5900 is in the registry. Sessions are TCP. Port 5800 is a common browser gateway in old VNC installs and is not this assignment.

The IANA service name is rfb: Remote Framebuffer. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 5900. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 5900

Service notes for port 5900: the IANA name is rfb (Remote Framebuffer), and the program people mean is VNC. TCP 5900 is the IANA rfb port, Remote Framebuffer, the protocol VNC uses. Displays after the first are 5901 and up. UDP is registered and is not the session. A VNC server with security type None on a reachable address is a remote screen. Prefer an SSH tunnel and bind the server to localhost. If it must be direct, require a real authentication type and a tunnel or a VPN, and do not use the classic VNC password alone across the internet. The password scheme is weak. A server that shares a logged-in desktop also shares whatever that user can do. Lock the screen policy is not a network policy. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 5900, you are on the wrong page.

People open 5900 and the server is on 5901 because it is display :1. The probe of 5900 gets a reset and the session is fine on the next port. Another trap is a banner that appears and then the client fails the security handshake. That is progress, not a closed port. Another is macOS Screen Sharing, which can be on 5900 and also be reached through the Apple protocol. Another is a firewall that allows the port and a server that is bound to localhost because of an -localhost flag. ss shows the address. Believe it.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 5900 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. A TCP connect should produce an RFB version banner if this is a VNC server. The process is x11vnc, Xvnc, vino, or Screen Sharing. A banner is not a completed login.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 5900 is display :0. The next display is 5901, not a second copy of 5900.
• The IANA name is rfb, not vnc.
• UDP is registered. The session is TCP.
• Security type None will be found if the port is reachable.

Linuxsudo ss -lptn 'sport = :5900'
sudo lsof -nP -iTCP:5900 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:5900 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.5900[^0-9]'

Windowsnetstat -ano | findstr :5900
Get-NetTCPConnection -LocalPort 5900

Remotenc -vz host 5900