Skip to content
ProtocolPorts

Port reference

Port 6000 (TCP) – X11 (X Window System)

Display :0 of the X Window System server, accepting GUI client connections over TCP.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Open when an X server listens on TCP (legacy default). Often left accessible with weak xhost-based access control.

What is port 6000 used for?

Port 6000 is display :0 of the X Window System (X11), the classic graphical layer on Unix and Linux. The X server owns the screen, keyboard, and mouse, while GUI applications connect as clients to draw their windows and receive input. When X accepts network connections, each extra display increments the port, so :1 is 6001 and so on up to 6063.

When would you open it?

Most setups never need this port open because modern systems keep X listening on local sockets only. You would open it only for legacy remote-display setups where a GUI app on one machine draws on another machine's screen over the network. For remote graphical apps today, SSH X11 forwarding is the usual approach and does not require exposing 6000 directly.

Is it safe to open?

Raw X11 over the network offers weak access control, so an exposed display can be watched or controlled by others; the safe approach is to keep it local and tunnel over SSH instead. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :6000
nmap -p 6000 <target>
Windows
netstat -ano | findstr :6000
Test-NetConnection <host> -Port 6000
macOS
lsof -i :6000
nmap -p 6000 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 6000 to your device's local IP, internal port 6000, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 6000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=6000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6000 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 6000" -Direction Inbound -Protocol TCP -LocalPort 6000 -Action Allow

Security & risks

Common attacks

  • Unauthenticated access to displays opened with 'xhost +'
  • Keystroke logging and screenshot capture of the desktop
  • Injecting input events and reading window contents
  • Abusing X11 forwarding to reach a trusted client's display

Hardening

  • Disable TCP listening (-nolisten tcp); use local sockets only
  • Never run 'xhost +'; use MIT-MAGIC-COOKIE (xauth) authentication
  • Tunnel remote GUIs over SSH X11 forwarding instead of raw 6000
  • Firewall ports 6000-6063 from untrusted networks
  • Restrict source IPs and avoid trusted X11 forwarding

How to block this port

Linux (ufw)
sudo ufw deny 6000/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=6000/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 6000 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 6000" -Direction Inbound -Protocol TCP -LocalPort 6000 -Action Block

nmap snippet

nmap -p6000 --script x11-access <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 6001Port 5900Port 22Port 177

Frequently asked questions

What does 'xhost +' do and why is it dangerous?
It disables X11 access control, letting any host connect to your display on port 6000. An attacker can then log keystrokes, capture the screen, and inject input — full desktop compromise.
How do I know if my X server is exposed on 6000?
If the X server listens on TCP and access control is open, nmap's x11-access script will connect successfully. Disable TCP listening and use xauth cookies to lock it down.

Related guides