VNC Frequently Asked Questions (FAQ)

This list is being updated regularly, so, particularly if you are reading a local or mirrored copy, it's worth checking the original from time to time. The archives of the mailing list are also available, and they can be a good source of help - try searching them here.

Getting Started

Running the programs

General Questions

Compiling the source

VNC Frequently Asked Questions

Getting Started

Q1 Where can I get VNC?

The latest versions of VNC and this documentation are always available from the AT&T Labs Cambridge web site at http://www.uk.research.att.com/vnc. In addition, various add-ons, extras, and ports to other platforms can be found on the contribs page.

Q2 I thought this was something to do with ORL? What's the Olivetti/Oracle link here?

In January 1999, AT&T acquired ORL, the Olivetti Research Laboratory founded 12 years earlier, and recently jointly funded by Oracle, to create AT&T Laboratories Cambridge.

Q3 I downloaded the .EXE files and they don't work!

Netscape used to have a nasty habit of sticking a .EXE extension on a file when it thinks it knows what type it is. When you fill in the download form you specify the type of compression you would like to use, and this does not include .EXE, so if the thing you downloaded has that extension, change it to whatever you requested (usually .tgz) and then unpack the files using an appropriate decoder.

Q4 I ran SETUP.EXE but it didn't work/nothing happens.

Setup often doesn't work if you're running it from a network drive. Try copying it to a local drive first. If you're on NT, make sure you have NT service pack 3 or later installed. It appears that the InstallShield system we use won't work without it.

Q5 I ran WinVNC, but nothing seemed to happen. I don't see an icon on my taskbar.

If you are using a version earlier than 3.3.3, we suggest you upgrade. If you are using 3.3.3 or later, this is because WinVNC doesn't know that somebody is logged in. On Win95, this will happen if you bypass the 'password' prompt at login. If you do this often, you might want to consider setting an empty Windows password, so you don't get prompted!

If you're running WinVNC as a service, it may be that the service has not been contacted by the 'Service Helper' when you logged in, to tell it who you are. (See the WinVNC docs for more details.) You can try running the Service Helper from the Start Menu to see if this is the problem.

Q6 WinVNC causes a 'Blue Screen of Death' on NT!

Again, make sure you have Service Pack 3 or later. If this happens it is usually due to bugs in Service Pack 1. Also note the Service Packs' warning that if you add or change components on your system you should reapply the service pack. If this doesn't fix it, check for updates to your network and graphics drivers. VNC makes very extensive use of both your video system and your network, and has a tendency to find any bugs in either of them! There may well be bugs in WinVNC, but we know of people running it on thousands of machines without problems, so please check other parts of your system before assuming it's directly a WinVNC problem.

Q7 I get an error message about 'disabling Nagle's algorithm'. What does it mean?

Nagle's algorithm is an optimisation which is used most of the time on socket connections. Under certain circumstances it batches up lots of small transmissions into bigger ones, to make better use of the bandwidth. VNC relies on small transmissions (like mouse movements) getting through quickly, so we turn it off using the TCP_NODELAY option. If this causes an error, it is a problem with your TCP/IP stack. In particular, Microsoft have broken this with NT service pack 6, but we hear that the hotfix mentioned in KB article Q245678 will fix it. In a future version of VNC we will pop this up as a warning without making it fatal.

Q8 How do I set up a Windows 95/98 machine so that I can dial into it directly and view it using VNC?

You need to install your modem from the control panel if you haven't already, and you need to set up the dialup networking server on your server machine. (This is included with Win98 and NT4. On Win95 it is in the Plus! pack, but you need to get an update to version 1.3 or later from Microsoft's site. At the time of writing it can be found here.) You can enable the dialup server from the 'Connections' menu of the dial-up networking window. If it isn't there, or if you've updated the dialup networking as mentioned above, you need to install it using the Windows Setup section of 'Add/Remove Programs' in the control panel. When it's running and you've dialled in, the server machine should have an IP address something like 192.168.55.1 as seen from the viewer - you can find this out by hovering over the VNC server icon, using 'netstat -r', or running winipcfg. You should then be able to connect to, for example, 192.168.55.1:0.

Q9 I ran the Unix vncserver program and got a 'No such file or directory' message.

Vncserver is a Perl script and so the first line has to point to the place where Perl is installed. On Linux this will generally be /usr/bin/perl, on other platfroms it's more likely to be /usr/local/bin/perl. Edit the line to point to the right place and it should work.

Q10 I ran the vncserver program and got a 'Number found where operator expected', 'prototype mismatch' or 'out of memory' message.

Note: This problem should be fixed in 3.3.2R3 and later. This is a Perl error, and happens on platforms where the Perl installation is not quite correct. We've heard of it particularly on S.u.S.E. linux and Redhat 5.2. The problem is probably the line in the vncserver script which says:

eval 'require "sys/socket.ph"';

Your first option is to change this to:

($] >= 5.0) ? eval 'use Socket' : eval 'require "sys/socket.ph"';

If this doesn't work, particularly on S.u.S.E., you could try:

eval 'require "linux/socket.ph"';

or check your Perl installation to see if socket.ph is to be found in another directory.

Remember that vncserver is only a convenient wrapper around Xvnc. If it causes you problems, feel free to discard it and run Xvnc directly.

Q11 I started the X server using vncserver, but it dies with a message "Could not open default font 'fixed'. "

The 'fixed' font is needed for the server to start - if it can't find it, you need to specify the correct font path for your machine in the 'vncserver' script. If you're not sure what the path should be, type 'xset q' from within a normal X session. One of the things reported is the font path used by your current X server, which is generally the right thing to use for Xvnc. On some platforms you may need to use a colon as a separator in the font path instead of a comma.

The VNC server can also get upset if you have directories on your font path which don't actually exist on your system. Make sure you remove those. Also note that older versions of the Xvnc server, by default, act as if they had a resolution of 100dpi. Some RedHat installations, for example, only install 75dpi fonts, so you may need to install the missing font RPMs from your distribution or use the -dpi option to Xvnc, or update to the latest version.

Q12 I get errors like "failed to bind listener" and "Failed to establish all listening sockets" in the log file.

This is probably due to the permissions on /tmp/.X11-unix. You may well see this if you update to Solaris 2.7 or Redhat 6.0, for example. See the section below entitled "Why can I only run vncserver/Xvnc as root?".

Q13 Vncserver seems to be dying quietly without putting any messages in the log file.

Check that the Xvnc process really has died. If so, then check that your VNC font path (set by uncommenting lines in the vncserver script) only includes directories which actually exist. The XFree86 code in older versions of Xvnc seems to have a problem which causes the server to die quietly if non-existent directories are searched. Upgrading to 3.3.3 or later should reduce these problems.

Q14 My Solaris/HP-UX Xvnc dies with a core dump!

There is a bug in XFree86 (on which Xvnc is based) which makes Solaris servers very unreliable if they have a pixel depth of 16. Use the -depth option to start your server with a depth of 8 or 24, and you should be fine. We've heard that this can be a problem with HP-UX as well. Darrell Kindred submitted a patch which speeds up operation on Alpha machines, and also fixes this problem. The problem is also fixed in 3.3.3 and later releases of VNC.

Q15 I connected to my Unix VNC server and I just see a grey desktop with a cursor.

After the vncserver script has started the Xvnc server, it then runs your ~/.vnc/xstartup script. By default this will try to start the twm window manager, but if twm isn't on your path, or if you prefer something else, you can edit xstartup. The log file may also give you clues about what is happening.

Q16 The log file is showing an error message from xrdb / Xlib.

By default, the first thing your xstartup script does is to run xrdb to load your resources. So if the Xvnc server has not started for any reason, the xrdb is often the first thing to notice it and print an error. (Though if you're getting a 'command not found' message, then xrdb is probably not on your path - you need to find where it is on your system and add it.)

If you get something like 'connection refused' or 'Can't connect: errno = 111', the Xvnc server probably isn't there. So you should check whether the Xvnc process is actually running, and whether there is anything earlier in the log file indicating why it might have died. By far the most common reason for the server not starting is that it can't find the 'fixed' font (see above). Other possibilities are that the server has quietly crashed, or that it is taking a very long time to start up. The vncserver script has a 3-second delay before running xstartup, but in extreme cases this may not be enough. Lastly, the DISPLAY variable used by vncserver is based on the results given by the 'uname - n' command. If your applications cannot resolve this to the right IP address, perhaps because of funny settings in /etc/hosts, then they won't be able to connect.

If you get a 'Client is not authorized to connect to Server' or similar message, there's something wrong with the X authority setup - perhaps xauth is not on your path? You could try using xhost to bypass this temporarily, but we wouldn't recomend this as a long-term solution. There should be some indication in the log file if xauth has failed.

Q17 The Java client doesn't work in my browser.

Several Java implementations have bugs which upset the VNC applet. Try pressing Reload. We've seen this problem on Netscape Navigator 3 and Internet Explorer 5. Note, too, that the Java applet often won't work if you are accessing the server via a web proxy. Make a direct connection if you can.

Q18 The Windows viewer dies as soon as it starts, or gives an error message (invalid page fault) immediately, before I've even typed in a server name!

There is a bug in the code which retrieves the list of most-recently accessed connections for the initial dialog box. If, when you run the viewer for the first time, you just hit return without entering a server name, this gets stored as an empty entry in the 'most recently used' list. The fix is to use REGEDIT to delete the registry key HKEY_CURRENT_USER\Software\ORL\VNCviewer\MRU. This will be fixed in version 3.3.3r2 of the viewer.

Q19 My viewer failed to connect to my server!

VNC relies on a correctly-configured and operational TCP/IP network, so please make 100% sure that your TCP/IP setup is right before you start asking questions on the mailing list. Here are some things you should check before assuming it's a VNC problem; consult your local expert if you don't know how to check them:

• Can you ping the server machine from the client?
• Is the VNC server definitely running on the server machine?
• The server listens on port 5900+displaynumber. Can you telnet to this port from the client machine?
• Have you specified the address correctly to the viewer? If you're using a display number other than zero for the server, (usually the case on Unix machines), did you remember to specify it?
• Is the server name known to the DNS? Try using an explicit IP address instead of a name (eg. 123.456.78.9:0 instead of snoopy:0).
• Do you have any firewalls or proxies in the way that could be blocking acess?
• If using the java client, did you remember to specify the correct port as part of the URL? (eg. http://snoopy:5800)?
• Can you try running either the server, or the client, or both, on different machines on your network to find whether the problem is at one end or the other?
• Can you try running the software on a different architecture? eg., if you are having problems viewing a PC from another PC, can you try connecting from a Unix machine?

Running the programs

Q20 My X VNC server is working, but I don't see my normal environment. How can I change the Window manager etc?

The window manager is started by the ~/.vnc/xstartup script. We use twm, as this is available on almost all Unix platforms. Edit the script if you'd rather replace it with something else. On many platforms you can, as an alternative, just make xstartup a link to whatever script normally starts your X environment.

If you want to be more sophisticated, you can specify the -name option to vncserver, and then take different actions in the xstartup script based on the name given. For example:

case "$VNCDESKTOP" in
kde)
        startkde &
        ;;
*)
        xterm -geometry 40x10+40+40 -ls -title "$VNCDESKTOP Desktop" &
        twm &
        ;;
esac

Q21 Why can I only run vncserver/Xvnc as root?

The most likely reason for this is that Xvnc can't create the unix domain socket (the path for this unix domain socket is usually /tmp/.X11-unix/Xn). Try making sure that users can write to this directory by making it world-writable, i.e.

chmod 01777 /tmp/.X11-unix

An alternative is to set the Xvnc binary to have the same permissions as your normal X server, but this may be more of a security risk.

Q22 Can I remote the normal X display of my workstation (display :0) in the same way as the Windows server does?

It would be possible to add VNC support to a standard X server, so that it operated this way, but we have no plans to do so. It shouldn't be too difficult, if you have the full source code for your X server. Xvnc is basically XFree86 with the hardware-dependent bits taken out and VNC put in their place, so it doesn't have drivers for any graphics cards. You could have a look at the Xvnc source code to see which bits have been added to the standard XFree86, and make the equivalent changes on your X server.

We tend to run all our X sessions as VNC sessions and only use the local X server to run the viewer. It's very fast when on the same machine as the server! If you feel that it's overkill to run two X servers on the same machine, you might consider Ganesh Varadarajan's svgalib-based viewer, available from the contribs page.

Q23 What X Visual does Xvnc use?

By default, vncserver will start Xvnc with the same depth as the current X display, if there is one, or 8 bits deep if there isn't. We've tried to steer clear of colour maps as much as possible and normally use "true colour", even when there are only 8 bits per pixel.

Unfortunately some X applications don't cope too well with an 8 bit TrueColor visual. You can make Xvnc use the more normal PseudoColor visual by giving a "-cc 3" option to vncserver.

Q24 Can I cut and paste between the viewer and the server?

VNC supports copying and pasting of ASCII text in both directions, provided the viewer and server allow it. When the clipboard changes on the machine running the viewer, the changes are copied to the server and vice versa. Some notable exceptions:

• X has more than one method of using the clipboard and different applications do it different ways. Emacs and xterm should just work. If you find that your X application doesn't work via VNC, you can generally use the xcutsel program to copy the clipboard between the different X methods. VNC uses Cut_Buffer0, so if you select text in Unix Netscape, for example, you may need to click 'Copy PRIMARY to 0' before it is accessible at the other end of the VNC link. You can use X resources to make the button labels more meaningful. For example, here's a script:

  #!/bin/sh
  exec xcutsel \
  	-xrm '*quit.borderWidth:0' \
  	-xrm '*quit.height: 1' \
  	-xrm '*quit.label:' \
  	-xrm '*sel-cut.label: Clipboard: out of netscape' \
  	-xrm '*cut-sel.label: Clipboard: into netscape' \
          -xrm '*font: -*-helvetica-*-r-*-*-*-*-*-*-*-*-*-*'
  

• Java applets running in the browser cannot access the clipboard of the machine on which they are running, so the Java viewer has a clipboard button. This pops up a window displaying the contents of the remote clipboard, which should allow you to manipulate it locally.

The code to do copying from the X server to the viewer didn't make it in the original version 3.3.2. It's back in 3.3.2R2 and later, so upgrade if you haven't already!

Q25 There's a memory leak in Xvnc!

This is fixed in versions 3.3.2r3 and later. If you're using an older distribution you can find a patch for it here.

Q26 Can I run the Windows server before anybody has logged in?

Yes. Read the section on running WinVNC as a service in the documentation.

Q27 Why doesn't Ctrl-Alt-Del work? Why can't I unlock my NT workstation remotely? Why can't I stop the screensaver remotely?

Make sure you are running a recent version of VNC, and that you are running it as a service. From some platforms you will not be able to type Ctrl-Alt-Del directly, because it will be caught by the local machine. The Windows viewer, for example, has an option on its menu to send a Ctrl-Alt-Del to the remote host. In some situations, you will find that something like Ctrl-Alt-Backspace or Ctrl-Alt- may work instead. Screensavers sometimes use a different resolution and so can disconnect you when they stop or start - see the next question.

Q28 When I connect using VNC and then log into my Windows machine, I get disconnected and have to reconnect!

Sometimes logging in will involve a change in screen resolution, if the user's display settings are different from the defaults. If this happens, the server will disconnect you and you will need to reconnect to get the new screen size. Just occasionally on NT, the mode seems to change resolution temporarily as you log in, and if WinVNC happens to see this you can also be disconnected, even if the final resolution changes.

If the user has set a different display number in their personal WinVNC properties dialog you will also be disconnected.

Q29 Can I arrange for the local physical screen, keyboard & mouse on my WinVNC server to be disabled when I'm accessing it remotely?

We don't know of a way to do this which will still allow us to read the screen and inject fake input events from WinVNC. If you have any code which might help, we'd be pleased to hear from you! Until then, if this aspect of security is important, we can only recommend that you consider other options such as password-protected screen savers, lockable keyboards, turning off the screen, unplugging the keyboard, or other physical security devices.

Q30 I have troubles sending Ctrl-Alt-Del to a Windows server.

• Ctrl-Alt-Del will only be recognised by a Windows NT VNC server, and only when VNC is running as a service. On Win95/98, it suspends all processes, including the VNC server, so it wouldn't be much use!
• The Windows and Java viewers have menu options to send Ctrl-Alt-Del, so they don't get interpreted locally.
• If you are using the Mac or X-based viewer, you should just be able to type the keys, but some platforms seem to catch the keystrokes. If this is the case for you, I'm afraid you'll have to work out how to stop it! It might be worth trying slight variations (eg. the right Ctl key, or a different Del/Delete key, if you have one).

Q31 I can't make it work on Windows 2000

If you're using the standard VGA driver, can you change to SVGA or something specific to your video card? Windows 2000 uses the old Win98 VGA driver, which has problems.

Q32 The dead keys don't work on my keyboard

It's quite a challenge working out how to do international keyboard support across different platforms. We'll sort out dead keys, but if you'd like to work out how to do them, we'd be grateful.

Q33 When I start a DOS window, it doesn't display at the remote end.

You might also notice the pointer leaving a trail of arrows behind it. This happens when your DOS sessions are full-screen. WinVNC cannot read the display when this happens, but keystrokes should still get through. Press Alt-Enter to switch the DOS box to windowed mode.

Q34 I can't type into a DOS window or any DOS apps

This derives from the fact that Windows 95 uses BIOS calls and not Windows messages to get keystrokes within the command prompt. It should be fixed in version 3.3.1 R19 and later of the WinVNC server, so if you're using an earlier version, uninstall and upgrade.

Q35 The keyboard doesn't work / keys do strange things!

There is one common problem which can cause this. If a modifier key, such as Shift, Ctrl or Alt, is pressed, and the viewer window then loses focus or dies, the 'key release' message never gets to the viewer and hence never gets to the remote server. The remote machine will then think that M is Ctrl-M etc. We have done various things to reduce the chance of this happening; the viewers release various modifiers automatically when they lose focus, for example, but it can still occur and can be confusing when it does. The solution is easy: simply press and release the modifier key which is stuck. If you don't know which it is, then try them one at a time.

Q36 Most of my Windows apps work fine remotely, but this one doesn't update its window...

WinVNC can use a variety of hints to guess when a particular area of the screen has changed. The most useful is the occurrence of a WM_PAINT message in an application. Not all applications use these messages, though; the Windows clock is a good example.

In the registry WinVNC has a list of application names, and which things to use as update clues. A few standard applications are set up by the 'Install default registry settings' in the WinVNC section of the Start Menu; it tells WinVNC to look for timer messages from the clock, for example. Make sure you install these if you haven't already. Any other apps you run will appear in the registry, so you can easily tweak the settings. For more info, see the WinVNC documentation.

Q37 WinVNC is putting a huge load on my PC!

Firstly, WinVNC should have negligible impact when nobody is connected to it. It does practically nothing in this state. If you find that it is running at something close to 100% CPU when there is a remote connection, check the Update Handling in the Properties dialog box. The default settings should be fine in most circumstances. If you have either (a) Ticked 'Poll Full Screen' or (b) Ticked 'Poll Foreground Window' or 'Poll Window Under Cursor' without having 'Poll Console Windows Only' ticked, then the load will be much higher. See also the section below on 'How do I make VNC go faster?'.

Q38 WinVNC dies, or causes other applications to die, after a short time when a viewer is connected.

Some screen savers, particularly on Windows 95, do not interoperate well with WinVNC. Try disabling all screen savers on the machine running the server and see if that fixes it.

Q39 My remote Windows display is appearing in a very garbled form.

There can be problems with WinVNC being unable to detect changes to the screen on certain applications, as mentioned in the previous question, but there should not generally be serious screen corruption.

If you have Win95/98 and you have a video driver which only uses 16 colours, you need to change it. VNC really expects at least 256 colours, though 16 shoudl work on NT.

Make sure you have the latest service packs installed for your OS and experiment with different video drivers. WinVNC relies on various aspects of the video card and driver; in particular its ability to BitBlt correctly, and several users have solved their problems by updating the driver.

Q40 I have problems with double-clicks in Windows.

By default, mouse button up events are used to signal to WinVNC that the current window may have changed and should be re-scanned. This can introduce a delay which results in a double-click being interpreted by the system as a pair of single clicks. Variations in network delays can also cause the clicks to be too widely separated when they appear at the server. Some suggestions:

• In many situations, the action performed by a double-click is also available from a right-button menu.
• You may find that clicking three times, rather than two, will help.
• You can change the double-click speed using the control panel on the server so that more widely-spaced clicks are still interpreted as doubles.
• You can disable the left-click hook by editing the registry, as described in the WinVNC documentation, although this may mean that WinVNC misses some screen updates from that application.

Q41 I'm installing WinVNC as a service on lots of machines, and I get prompted for the password on each one. Can I do this non-interactively?

Not directly, but you can by editing the registry before installing. On a machine which already has WinVNC installed, copy all the registry settings under

HKEY_USERS/.Default/Software/ORL/WinVNC3

into the same place in the registry of the remote machine, either by hand or using your favourite tool. When WinVNC runs, it will see the password in that section of the registry and will not prompt you to type one in.

Another hint that might be useful was sent in by Johannes Norinder. If you run the SETUP program with a -r option, it will create a setup.iss file, probably in your %systemroot% directory. Following installations on similar computer can be started with "setup -s -h1[path to your setup.iss]" and you won't have to answer the questions again!

Q42 I only have a two-button Windows mouse, and I really need three buttons for X...

Get a recent version of the Windows viewer. This allows you to emulate the middle button by pressing both buttons together.

Q43 I have a three-button Windows mouse, but the middle button doesn't work.

This is almost certainly a problem with your mouse driver. The Windows VNC viewer recognises standard WM_MBUTTON... messages and should work with any driver that generates them. Some drivers, knowing that Windows seldom normally uses the middle button, either don't recognise it, or map it to something else like a double-click. Try telling Windows that you have a different type of mouse, (we've had reports that the Logitech PS/2 Port Mouse is a good one to try) or use the 3-button emulation mode mentioned above.

Q44 My machine doesn't have a DNS entry or static IP address! What address should other people use to connect to my WinVNC server?

If your ISP allocates you a dynamic IP address when you dial in, you will need to give that to the person trying to connect. On Windows95 machines, after connecting, you can use the winipcfg program (type it into the Start/Run... box). On NT machines, type ipconfig at a command prompt. On linux machines, try hostname -i. A handy new feature on recent versions of WinVNC causes the IP addresses of the local machine to be displayed when the mouse hovers over the WinVNC icon, (if they can be determined at that time).

Of course, if your phone line is now in use you may need to find some other way of getting this information to the remote person. I suggest a chat system like AOL Instant Messenger. There are also programs out there which will automatically create a web page with your current IP address, which the other person could then read.

Q45 Can I get rid of the taskbar icon created by WinVNC?

No. Not without changing and recompiling the source code. We feel that there would be few legitimate uses of VNC where you would need to conceal its operation. However, there might be occasions where you would not want the user of the server machine to be able to adjust the WinVNC settings, password, etc, so versions later than 3.3.2R3 will include a 'restricted' mode where the icon is still visible, but the menu options normally available from it will be disabled.

In some situations, particularly on Win95, you may find that the icon is not displayed. This is not a feature, it's a bug which we plan to iron out! See the question above on 'I ran WinVNC don't see an icon in my Taskbar!'.

Q46 Can I set up WinVNC to use my Windows NT password for authentication?

Not at present. Partly because there are many problems with the NT security model, but chiefly because we want to keep VNC as cross-platform as possible. In the future we may try and make the code and the protocol more modular so it will be easier to add your own favourite authentication.

Q47 Can I make the Macintosh server start automatically when the machine boots up?

Yes, create an alias to VNCServer and put it into the Startup items folder (in your system folder).

Q48 When I try to set a new password for my Mac server, I hit CHANGE on the web page, but nothing happens. It is trying to bring up the settings.html page, but fails.

The http portion of the current server is unstable, sorry. But you can set your settings with AppleScript.

Open the AppleScript editor and enter the following:

tell application "VNCServer"
set password to "whatever"
end tell

There are other options you can set, which are all documented in the directory inside VNCServer (use the AppleScript editor to open the dictionary)

General Questions

Q49 How do I make VNC go faster?

We find VNC to be perfectly acceptable as our normal method of accessing Unix desktops on a daily basis. This is over a 10 Mbit/s ethernet on reasonably modern machines, using the X or Win32 viewer. Because Windows gives us fewer hints about what it's doing, and because we don't have the source code for Windows in the same way that we do for X, the WinVNC server has to work harder to find out what's changed, and so a really fast machine should make a big speed difference. For more information about how the Windows server works, see the WinVNC documentation. But if you've been disappointed by the speed of the Windows server, don't give up. We're improving it gradually, but it'll be a while before it's as fast as on Unix.

There are several things that can slow any VNC session down, however, and you may like to consider these if you find it too slow:

• Unusually 'busy' desktops. The VNC protocol is very efficient at rendering areas of a single colour, such as you generally find on window title bars, scrollbars, backgrounds of pages etc. But if, for example, you have pretty 24-bit photographs of your girlfriend as your screen background, or dithered title-bars on your windows, you may pay a price for the aesthetics. A colourful or patterned desktop background will probably slow down VNC more than any other single factor. We have some suggestions on speeding up the twm window manager, some of which will also apply to other environments.
• Hi-colour desktops. Don't use 24-bit colour if you can use 16 or 8 equally well. Remember, on Unix you can run multiple servers, so I have a big 16-bit desktop for normal work and a small 8-bit one for when I log in from home. The server can send out a wide range of pixel formats, and some viewers will allow you to request a specific format for that session. On the Windows viewer, for example, if you click Options... when making the connection, you can request only 8-bit pixels from the server - useful if the network gets slow. If you are using a modem, I recommend changing the shortcut in the Start menu to include the /8bit option - this will then be the default. Similarly, if you regularly connect to a remote WinVNC server, consider whether you could run happily at lower resolution. A 1280x1024 screen has more then 4 times as many pixels as a 640x480 one, and if all you are doing is checking a printer queue you probably don't need them all! Note, though, that on WinVNC, 16-bit colour is usually the best to use. See below.
• Elderly graphics cards or drivers may make quite a difference; this is a graphics-intensive application! On Windows the graphics system on the server will affect the speed as well as the one on the viewer.
• Some applications are not very economical about redrawing their display. Early versions of Unix Netscape, for example, tended to draw everything twice when scrolling, which did nothing to help the smoothness under VNC. X11Amp flashes its display very fast when in 'pause' mode.
• Some Java Virtual Machines are particularly fast at reading from the network and particularly slow at drawing to the screen, or vice versa. With the Java viewer it is worth experimenting with the encodings available from the Options menu, as we sometimes find big differences in speed.
• If you are connecting to WinVNC, don't change the default settings in the Properties box unless you need to. See 'WinVNC is putting a huge load on my PC' above.
• All the standard clients can do local rectangle copying, and this generally means that dragging a full window on X is much faster than dragging its outline. If your window manager allows this, it may speed things up. Roman Mitnitski also reports that when he increased the mouse dragging threshold (-t option of the server) the performance was improved.
• Generally, with WinVNC, use 16-bit colour (65536 colours) on the server if you can. 16-bit is almost always the best depth to use, because:
  1. 256-colour screens have to be palette-converted before they can be transmitted to truecolour clients. Only if the client is 256-colour palette- based will you see any performance increase. Even if the client is 256 colour truecolour, it'll have to convert via a 32-bit truecolour palette!
  2. 24-bit screens have to be specially munged via 32-bit since VNC's internal colour-handling routines don't work with 24-bit directly.
  3. 24 and 32-bit screens have to have each pixel looked up in three tables to get the converted value.
  4. Graphics cards claiming to do 24-bit often actually do 32-bit with munging - this in many cases makes 24-bit slower just for general use than 32-bit!
  5. Finally, 16-bit involves no palette processing and a single lookup in a cached src_format to dest_format table to convert the pixels.

On slow links, you may also want to use some software to compress the data between the two ends. SSH is good for this. See the section on security below.

Q50 Will VNC work through a firewall?

It depends on your firewall, and whether you want to access a server inside your firewall from elsewhere, or a server outside your firewall from inside.

Generally firewalls are designed to prevent incoming connections except to certain well-known machines and ports. If you can configure these to include your VNC server, then you will be able to access it from anywhere in the world. There is a good argument to be made for the fact that VNC is less of a security risk than X, so if your site doesn't allow X in or out it may still allow VNC.

Many modern firewalls will allow outgoing connections initiated from inside, so you can often access servers on outside machines. It is straightforward, for example, to recompile the viewer source to include SOCKS support, or to make other special arrangements. See the contribs page.

It's a pity that Java within a browser doesn't automatically use SOCKS if the browser is configured to use it. There's probably Java SOCKS support out there somewhere...

If your internet access is through a router which does Network Address Translation, you may be able to configure the router to redirect particular incoming ports to particular machines. So you could run WinVNC with a display number of 0 on machine snoopy, and with display 1 on machine woodstock, then set your router to send port 5900 to snoopy and 5901 to woodstock. See below for information on the other port numbers used by VNC.

Q51 Which TCP/IP ports does VNC use?

A VNC server listens on two ports. The exact port numbers depend on the VNC display number, because a single machine may run multiple servers. The most important one is 59xx, where xx is the display number. The VNC protocol itself runs over this port. So for most PC servers, the port will be 5900, because they use display 0 by default.

In addition, VNC servers normally have a small and very restricted web server built in, which allows you to connect a browser to them and use the Java viewer. This runs on port 58xx. Note that this is the HTTP port used for downloading pages and applets, but once the applet is running it uses 59xx for VNC just like any other viewer.

The servers can be changed to listen on other ports if, for any reason, these are not suitable for you. See the server's documentation for more details. Most of the viewers, if given a display number larger than 99, will interpret it as a direct port number and will not add 5900. See also the next question.

If you are running a viewer in 'listening' mode, where it accepts connections initiated by the server, it will listen for incoming VNC on port 5500.

Q52 Can I run VNC over a port normally used for a standard service? (eg. port 21, or port 80)

In rare circumstances, people may want to do this, perhaps because they have a firewall which only allows connections to certain ports. This can be done, at least for the Windows and Unix servers (see their documentation), but the following points need to be borne in mind:

• On some systems (eg. most forms of Unix), ordinary users are not allowed to run servers on ports below 1024.
• You obviously can't run a VNC server on a port that's already being used for other things.
• Many VNC servers use two ports: one for the VNC server, and one for the HTTP server that provides the Java applet (see previous question). If you plan to use the Java viewer, you may want to change both. Not all servers will allow this at present.
• You need to tell the viewer the right display number. Normally, display numbers come between 0 and 99. If you specify any number smaller than 99, the viewers add 5900 to get the port number. If you specify a larger number, the viewers take it as a port number directly. So how do you use port numbers lower than 99? You have to specify a negative display number! For example, to connect to a server running on port 80 on machine 'snoopy':
  
  vncviewer snoopy:-5820
  
  because -5820 + 5900 = 80. This may not work with all viewers, but Unix and Windows seem to be fine.

Q53 How secure is VNC?

Access to your VNC desktop generally allows access to your whole environment, so security is obviously important. VNC uses a challenge-response password scheme to make the initial connection: the server sends a random series of bytes, which are encrypted using the password typed in, and then returned to the server, which checks them against the 'right' answer. After that the data is unencrypted and could, in theory, be watched by other malicious users, though it's a bit harder to snoop a VNC session than, say, a telnet, rlogin, or X session. Since VNC runs over a simple single TCP/IP socket, it is easy to add support for SSL or some other encryption scheme if this is important to you, or to tunnel it through something like SSH.

SSH allows you to redirect remote TCP/IP ports so that all traffic is strongly encrypted, and this can be combined with VNC. SSH can also compress the encrypted data - this can be very useful if using VNC over slow links. See the 'Using SSH with VNC' page.

While we're on the subject of security, you should also be aware that only the first 8 characters of VNC passwords are significant. This is because the 'getpass' call used in the Unix server to read a password has this restriction, and the other platforms have been made compatible with this.

Ray Jones <rjones@pobox.com> has built a version of VNC which uses SSLeay public key encryption, and Wolfram Gloger <wmglo@dent.med.uni-muenchen.de> has built Xvnc with the TCP Wrapper library, allowing you more control over which hosts are allowed to connect. See the contribs page for details.

Q54 Are you going to make it more secure?

We do hope eventually to add better security to VNC, but there's also a good argument for not doing so. If security is a concern, it can be better to use a single system such as SSH or FreeS/WAN to encrypt all your traffic, rather than relying on the individual packages to do the right thing. Then, if you decide in a year's time that one system is too easily crackable, you can replace it yourself and all of your communications will benefit. It may also be easier to fit in with corporate security systems this way.

Q55 Could you do file transfer (e.g. by drag & drop) between the two ends?

It's certainly possible, but we aren't going to do it. File transfer seems simple, but is actually rather complicated to do in a cross- platform way. Some examples: How do you map filenames between platforms with wildly different naming conventions? How do you cope with running out of disk space? What about permissions? How do you do it on platforms which don't have a concept of drag and drop? Can you interrupt the transfer if it's taking too long? Can you restart it if it gets interrupted?

Since there are a very large number of perfectly good systems out there for transferring files over IP, we aren't planning to incorporate it in VNC. It would probably more than double the size of the code, and would introduce all sorts of issues that we, quite frankly, aren't interested in! So use the standard file transfer built into Windows, or use FTP, or netcat, or the web, or rcp, or ssh, or...

Q56 Are you planning support for AIX, EPOC,HP-UX, SGI, Win 3.1, or my favourite platform ?

We have provided VNC on all the platforms we use here, and it's difficult to provide binaries for anything we don't have, and it takes a while to get up to speed on new platforms. Information about third-party ports of VNC to a large number of other platforms can be found on the 'contribs' page, so check there first. Remember that a viewer is available for any platform which runs Java, though the speed may vary quite a bit. But for many platforms it should not be difficult to compile at least the viewer. If anyone tailors the sources for a particular platform we will happily either incorporate the changes in the main source distributions or make the patches available from our site.

Q57 Would things work better if you compressed the stream?

VNC incorporates really quite efficient compression in the sense that we generally send a tiny fraction of the raw data, probably something like 1/20 on average. The details are in the protocol spec if anyone's interested. On a couple of test screen dumps we found that the Hextile encoding was more efficient than GIF! I don't know whether this is true in general.

But we haven't done more general encoding after that; we've tended to the view that (a) it might introduce too much latency and (b) most modems compress pretty well anyway. We are planning some zlib-compression experiments in the near future to see how this affects things. Because different bits of the screen can be sent using different encodings, the server could, in theory, detect that one bit would be most efficiently sent as JPEG, while another would be better hextiled.

The question is always how much work it's worth doing at the server to find this out. To some degree you can control this already, because the viewers allow you to specify your preferred encoding. Under X, if your viewer and server are on the same machine the viewer will use the raw encoding by default, otherwise it will use hextile. You may find that by selecting different encodings on the command line you get better performance.

See also the suggestions above about using ssh, which also provides compression.

Q58 Have you thought about caching bits of the screen at the viewer end?

Yes, that could also be good. You could have an off-screen cache in the viewer and the server could copy things from there to the screen. Management of this would add a certain amount of complexity, though.

Since there is already a CopyRect primitive in VNC, an alternative approach would be to copy updates from another part of the screen if they already exist there, rather than resending them. Again, to make the server find out efficiently when this is worth doing would be an interesting challenge, and volunteers for the project are welcome!

Q59 Can I use VNC over a modem without using TCP/IP?

Not at present. VNC could run over other transports such as RS232, firewire, USB, modems, IrDA etc, in fact, anything which gives a reliable 2-way connection. At present we just use TCP/IP, because it's convenient, ubiquitous, and easy to route. This means that you can use VNC over anything which supports TCP/IP, so using it over a modem is just the same as any other network, once you have Dial-Up Networking set up. If you need to communicate directly between two machines without going via the internet/intranet, then set up a remote access server on one and dial in from the other.

Q60 Does VNC have any Y2K (Year 2000) bugs?

The simplest answer to this, now that the date has passed, is that lots of people are happily running it without any problems. However, if you want more details, this is what we used to say here in the last millennium:

The WinVNC server and Windows viewer have been tested on a PC with its date running through the 2000 boundary without any problems, so unless the underlying OS or BIOS has difficulties, VNC on a PC should be fine. The VNC part of the X-based Unix VNC server only uses dates when writing the log files; the logfile entries are timestamped with a two-digit year, but the format is easy to change if required and the entries are not intended to be machine-readable. The developers of the XFree86 server on which Xvnc is based state that there are no Y2K problems (see http://www.xfree86.org/FAQ/). We therefore issue the standard disclaimer: we believe the VNC code, in its entirety, to be free from Year 2000 problems, subject to the other components of the systems on which it is running.

Q61 How can I install WinVNC on multiple machines?

When you run WinVNC for the first time on a machine, it will prompt you for a password. If you are doing this on a large number of machines, especially remotely, this can be a nuisance. The way to bypass this is to make sure that the target machine already knows the password by putting the encrypted version straight into the registry before installing. So:

• Install WinVNC on a master machine and set the password
• Copy the appropriate registry entries from
  
  HKEY_CURRENT_USER\Software\ORL\WinVNC3 , or
  
  HKEY_USERS\.DEFAULT\Software\ORL\WinVNC3,
  
  (if you installed WinVNC as a service) and install them on the target machine using your favourite registry utility.
• Copy the VNC files (typically under C:\Program Files\ORL\VNC) onto the remote machine.
• Install as a service or into the startup directory as appropriate.

Q62 Can I connect multiple users to the same Windows server, and have them each see their own desktop, as with WinFrame, NTrigue, WTS, etc?

No. Windows NT has a reasonable concept of multi-user access, but not where the GUI is concerned. Basically, you can't do this without access to the source code of Windows, and that's rather difficult to get hold of! We have successfully run multiple WinVNC servers on a Windows Terminal Server machine, but they don't update unless a WTS client is also connected, which rather defeats the purpose. It may be possible in future to get documentation on the WTS APIs, in which case we might be able to do something better.

Of course, if your server is Unix-based, then you have no problem. You can run dozens of VNC servers on a single machine.

Q63 Any other tips?

Several people have indicated that they have to use Windows occasionally but prefer to use Unix most of the time, and so want to access a PC under the desk from the Unix box.

Here's a suggestion: all other things being equal, I recommend using the Windows box to view the Unix machine rather than the other way around. This is chiefly because Windows generally works better as a client than as a server, and also because PC graphics cards are often better than those in Unix workstations. Remember, you can create a VNC session of any size and pixel depth you like.

If you're very anti-Windows you can make your VNC desktop the same size as the local screen and set the taskbar to 'Auto hide' and just pretend you're on an X terminal, but pop up the Start menu when you have to use PowerPoint.... The Windows viewer also now has a proper 'full-screen mode', so you don't even need to bother with auto-hide.

Q64 You misspelled 'organization' on the download page!

No we didn't. We spell it like that in the UK. Actually, we spell it both ways, but the 's' spelling is more common, despite what the OED says! Now, as for 'misspelt'...

Compiling the source

Q65 I'm trying to compile WinVNC and the compiler complains about various missing files!

You need to compile using the No_CORBA configuration, or it will try to include various files which are part of our internal version only. If you still get errors about vncControl.idl after doing this, blame Microsoft! It's a bug in the way Visual C++ 6 imports projects that were built under Visual C++ 5. You don't need the IDL file, and it isn't included. Just delete it from the project.

Q66 I'm having trouble compiling VNC on my platform...

Have you checked the contribs page? Several people have provided hints on how to build VNC on other platforms. If yours is not listed there, you might at least get some clues..