TCP Port 5900 – VNC (Virtual Network Computing)
Port 5900 is the standard port for VNC, Virtual Network Computing, a cross-platform protocol for accessing a graphical desktop on a remote computer. VNC was originally developed at the AT&T Laboratories Cambridge research lab in the late 1990s and was released as open source in 1998. The underlying protocol is called RFB (Remote Framebuffer) and is specified in RFC 6143 (2011). Where Microsoft RDP on port 3389 is the dominant Windows remote-desktop protocol, VNC is the cross-platform alternative used widely on Linux, macOS, embedded devices, and across mixed environments where RDP is not available.
Several independent VNC implementations are in common use, including TigerVNC, TightVNC, UltraVNC, and the commercial RealVNC product, all of which speak the same base RFB protocol on port 5900 and interoperate with each other. macOS includes a built-in VNC server (Apple Remote Desktop and the Screen Sharing feature), and many Linux desktop environments ship VNC servers as part of their remote-access tooling.
When a single host runs multiple VNC server instances, additional ports above 5900 are commonly used (5901, 5902, etc.), each serving a different display number in the X Window System sense. Port 5800 and the ports above it are sometimes used for VNC over HTTP gateway access, where a Java-based VNC viewer is delivered through a web browser.
Outbound TCP/5900 from end-user devices is normal in remote-administration contexts and uncommon outside them. Inbound TCP/5900 to a host that is not configured for remote desktop access is uncommon, and inbound from the public internet is widely treated as a serious security exposure.
About TCP Port 5900
Port 5900 carries the IANA assignment for rfb. The IANA description reads: ‘Remote Framebuffer’.
Security Considerations
VNC on port 5900 has a well-documented security history that combines two patterns familiar from RDP on port 3389 and SSH on port 22: the protocol itself has weaknesses that matter when the port is exposed to untrusted networks, and any internet-facing VNC server is subject to continuous credential brute-forcing.
Our dataset contains no IDS rules referencing port 5900 directly and no curated malware families associated with this port, but this absence is not a strong indicator of low risk. As with SSH on port 22 and RDP on port 3389, the dominant attack against exposed VNC is automated credential brute-forcing, which most IDS rule sets do not flag rule-by-rule. Any internet-facing VNC server with a public IP receives a continuous stream of password attempts from automated scanners.
The protocol-level weaknesses are more specific. The original VNC password authentication uses a DES-based challenge-response in which the password is truncated to 8 characters before use, giving the protocol an effective password length cap that defeats most password-strength practices. The base RFB protocol also transmits the desktop session contents in plaintext, meaning anyone on the network path between client and server can capture both the session and the keystrokes the client sends back. Modern VNC implementations (TigerVNC, TightVNC, UltraVNC, RealVNC) all support TLS-encrypted variants or SSH tunneling to address this, but plain VNC over port 5900 with the original authentication remains common, particularly on consumer hardware, embedded devices, and IoT products that ship with VNC enabled.
Common practice for hardening VNC is similar to the practice for RDP: never expose port 5900 directly to the public internet, restrict access to known internal network ranges, place the service behind a VPN or SSH tunnel, use strong unique passwords (acknowledging the 8-character limitation), enable any TLS or encryption options the specific VNC implementation supports, and monitor authentication logs for brute-force patterns.
Inbound TCP/5900 from the public internet is uncommon in 2026 and is widely treated as a serious exposure that warrants investigation.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.