Port 5900VNC (RFB)

What port 5900 is used for

VNC transmits a computer's screen as a stream of pixel updates and sends back keyboard and mouse input. Unlike RDP, which understands Windows drawing operations, VNC works at the framebuffer level, which makes it platform-neutral: the same viewer connects to Linux, macOS, Windows, a Raspberry Pi or the KVM console of a server's management controller.

Ports are allocated per display:

macOS Screen Sharing and Apple Remote Desktop also listen on 5900.

Security considerations

• Plain RFB is unencrypted. Everything on screen, and every keystroke, is visible to a network observer. Use a VNC product with built-in TLS, or reach the server through an SSH tunnel (ssh -L 5901:localhost:5900 user@host) or a VPN.
• Password handling is weak in classic VNC. The traditional authentication limits passwords to 8 significant characters. Prefer implementations that support stronger authentication or system accounts.
• Never expose 5900 to the internet. Internet-wide scans routinely find unauthenticated VNC servers; many have been used to access industrial systems and point-of-sale terminals.
• Bind to localhost when the server is only meant to be reached through a tunnel (-localhost in most Unix servers).

How to check port 5900

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :5900

A line in the LISTENING state means a local program has bound port 5900; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :5900 or lsof -i :5900.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 5900

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 5900. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Firewall considerations

Allow inbound TCP 5900–5910 only from specific management addresses, and only if a tunnel or VPN is not available. Home routers should not forward VNC ports.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 5900 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.