There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning activity on port 5904/TCP. The researchers mention they do not know what is being scanned for.

Does anyone know what vulnerability (or use) the attacker(or benign user?) may be searching for?

2 Answers 2


I don't know what vulnerability they might be looking for, but VNC uses that port. http://www.cyberciti.biz/faq/linux-iptables-open-vncserver-port-6000-5800-5900/

Maybe one of the vulnerabilities listed here that applies to VNC servers. http://web.nvd.nist.gov/view/vuln/search-results?query=vnc

  • Yes, though, it's only likely that VNC will only be using 5904 in thin client systems. VNC main listen is on 5900 and it spawns a port for each display server sequentially up from that, so 5904 is not 'till the 4th display server.
    – ewanm89
    Commented Mar 22, 2013 at 0:57

It's sometimes useful to scan a closed port (host discovery and fingerprinting).

Assuming TCP, VNC may use it, if you compare the DShield graphs for ports 5900, 5901, 5902, 5903 and 5904 there's some visible agreement between 5901, 5902, and 5904 but notably not with 5903. 5900 has too much background noise.

On a hunch, I compared permutations of ports, and found 5904 drops around when 5490 starts, but the number of target systems isn't comparable (nmap tells me port 5490 is a HTTP/CONNECT proxy, but fairly scarcely seen, in the bottom 1%). So much for my hunch of a misfired scanner.

I can tell you that I have recorded (logs only, not packet captures or honeypot data) recent scans targeting TCP/5900,5901,5902,5904 (not 5903). Discounting 5900 (since that's constantly scanned) from 25 unique hosts.

All the destination 5904 probes came (notionally) from a single IP registered to a large French web/virtual hosting company, 80% of the total port 590{1,2,4} probes in all. Over a 60+ hour period from March 7-11 every probe used the same four source/destination port pairs, with target port 5904 being approx 50% of total. Different target ports were favoured on different days and by different hosts, scans possibly started on March 6 with port 5901. A low-rate, non-sequential, non-uniform scan (from 10-30 probes per host) of an IP block was performed. I suspect it was also network mapping attempt because an upstream device (on a different IP block) also recorded the same scans (source host & port, destination ports) interleaved with those scans.

Best guess is a distributed parallelised scan for VNC ports (with a generous addition of lesser-used ports) via hijacked hosts, and perhaps they got lucky with a well connected system in the unnamed French ISP which skewed port 5904 statistics. I cannot explain the omission of port 5903.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .