X11 port scanning the network?

[the_dalex]

Today one of our MIS guys came to me to let me know that one of my employee's machines was apparently port-scanning the whole network on campus. The only thing that he did at the time was run X11, but didn't do anything in it (just left it open for a while during a conversation with a customer). They scanned his ports and one of the few open ones was an X11 port, so I'm wondering if somehow X11 tries to map the network or something automatically upon startup...

Anyone have any clues? If it happens again he could be in trouble, but we don't know what's doing it. I told him to never run X11 again here just in case, but I want to know more about it.

Thanks!

 

[tomf87]

There was a protocol that was used years ago called DMCP, I believe. X clients used this protocol to find X servers on the network.

I haven't heard of X11 on 10.3 doing this, but it is possible.

 

[caveman_uk]

X11 is a client-server thing so it can act as a client for remote servers i.e. on other machines. So maybe it was searching for them. I don't think it usually does it though....