VNC runs on TCP 5900 + display number. Display :0 = port 5900, display :1 = 5901, display :2 = 5902, and so on. The HTTP variant (Java viewer) runs on 5800 + display number. The team that uses VNC for remote desktop on a Linux server knows the display-number-to-port mapping by heart.
Table of contents
- The port mapping
- Starting a VNC server
- Connecting with a VNC client
- The SSH tunnel pattern (the right way)
- Killing a VNC server
- How this fits the rest of the stack
- FAQ
The port mapping
VNC’s port scheme: TCP 5900 + N for display N. So:
-
Display :0 = TCP 5900
-
Display :1 = TCP 5901
-
Display :2 = TCP 5902
-
Display :9 = TCP 5909
-
Display :99 = TCP 5999
The HTTP/Java viewer variant: TCP 5800 + N for display N. The team that runs the older Java viewer uses these.
The first 5900 ports are the standard ones. The team that uses display numbers above 100 needs to confirm the VNC server’s -rfbport option supports custom ports (most do).
Starting a VNC server
TigerVNC (the most common on Linux):
vncserver :1 -geometry 1920x1080 -depth 24
This starts a VNC server on display :1 (TCP 5901), with a 1920x1080 desktop and 24-bit color. The first time, it asks for a password to set. The team that scripts this in a service file passes -geometry, -depth, and the password via ~/.vnc/passwd.
Display :0 is the physical display (the one connected to a monitor). VNC displays start at :1 by convention. The team that uses :0 is the team that VNCs into the local X session (rare on a headless server).
Connecting with a VNC client
From a remote client: vncviewer server.example.com:5901 or vncviewer server.example.com:1. The :1 shorthand means display :1 (port 5901).
The team that uses a GUI client (Remmina, RealVNC Viewer, TigerVNC Viewer) enters server.example.com:5901 in the address bar.
Encryption: vanilla VNC has no encryption - the password is sent in cleartext on first connect, and the rest of the stream is plaintext. The team that uses VNC across an untrusted network tunnels over SSH: ssh -L 5901:localhost:5901 user@server, then connect to localhost:5901 locally. The tunnel encrypts the stream.
The SSH tunnel pattern (the right way)
ssh -L 5901:localhost:5901 user@server
Now connect to localhost:5901 with the VNC client. The SSH tunnel carries the VNC traffic over an encrypted channel. The team that uses this for the VNC session over the public internet does not need to worry about VNC’s lack of native encryption.
For multiple displays, multiple tunnels: ssh -L 5901:localhost:5901 -L 5902:localhost:5902 user@server.
Killing a VNC server
vncserver -kill :1
Stops display :1 (port 5901). The team that scripts cleanup uses this. Without -kill, the process keeps running and the port stays open.
FAQ
What is the difference between VNC ports 5900 and 5800?
5900+N is the RFB protocol (the actual VNC display). 5800+N is the HTTP server that hosts the Java applet viewer. Modern VNC clients use 5900+N; the 5800+N path is only for the old Java viewer.
Is VNC encrypted by default?
No. The password is sent in cleartext on first connect, and the rest of the stream is plaintext. The team that uses VNC across an untrusted network tunnels over SSH.
What is the difference between display :0 and display :1?
Display :0 is the physical display - the one connected to a monitor. Displays :1 and above are virtual displays started by vncserver (or Xvfb, or xdummy). On a headless server, there is no :0; VNC displays start at :1.
Can multiple users connect to the same VNC display?
Yes - VNC supports multiple concurrent connections. The first connection is the “primary”; subsequent connections are viewers (read-only or read-write, depending on the server config).
Why is VNC slow on my network?
VNC is screen-by-screen and uses RFB, which has no native compression beyond what the client and server negotiate. The team that has a fast desktop over LAN has RFB at 30 fps; the team that has it across a transcontinental link has 5-10 fps. SSH + -C (compression) helps, but for real performance, RDP or X2Go is better.
How this fits the rest of the stack
For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.
Useful related references: