Virtual Network Computing

1. Virtual Network Computing

2. Introduction • Virtual Network Computing (VNC) is a desktop sharing system which uses the RFB (Remote FrameBuffer) protocol to remotely control another computer. • It transmits the keyboard presses and mouse clicks from one computer to another relaying the screen updates back in the other direction, over a network. • VNC is platform-independent: • a VNC viewer on any operating system can connect to a VNC server on any other operating system. • There are clients and servers for almost all operating systems and for Java. • Multiple clients may connect to a VNC server at the same time. Popular uses of the technology include remote technical support, and accessing files on your work computer from your home computer. • VNC was originally developed at AT&T. • The original VNC source code is open source under the GNU General Public License, as are many of the variants of VNC available today. • Cf: TightVNC

3. History • VNC was created at the Olivetti & Oracle Research Lab, which was then owned by Olivetti and Oracle Corporation. In 1999 AT&T acquired the lab, and in 2002 closed down the research part of the lab. • The name originates from a thin clientATM Network Computer called the Videotile, which was essentially an LCD with a pen input and a fast ATM connection to the network. VNC is essentially a software-only version of this 'ATM Network Computer'. • Developers that worked on VNC while still at the AT&T Research Lab: • Tristan Richardson • Quentin Stafford-Fraser • James Weatherall • Ken Wood • Andy Harter • Charlie McLachlan • Paul Webster • [edit]

4. How it works • VNC has two parts, a client and a server. • The server is the program on the machine that shares its screen, and the client (or viewer) is the program that watches and interacts with the server. • VNC is a very simple protocol, based on one graphic primitive: • "Put a rectangle of pixel data at a given x, y position". • That is, the server sends small rectangles of the framebuffer to the client. • This in its simplest form uses a lot of bandwidth, so various methods are used to reduce it. For example, there are various encodings - methods to determine the most efficient way to transfer these rectangles. • The VNC protocol allows the client and server to negotiate which encoding will be used. • The simplest encoding, which is supported by all clients and servers, is the raw encoding where pixel data is sent in left-to-right scanline order, and after initial setup, then only transfers rectangles that change. Because of that, this encoding works very well if only a small portion of the screen changes from one frame to the next (like a mouse pointer moving across a desktop, or text being written at the cursor), but bandwidth demands get very high if a lot of pixels change. (Full screen video is the most radical example of this.) • VNC by default uses ports 5900 to 5906, each representing the corresponding X screen (ports 6000 to 6006, for screens :0 to :6). • A Java viewer is available in many implementations such as RealVNC on ports 5800 to 5806, following the same pattern. These ports can be changed. • Most Windows computers can only use a single port because Windows lacks the multisession features of unix based servers. • The default display number for Windows based computers is 0 which maps to TCP port 5900. • It is possible to run more than one display on Windows terminal servers by running VNC once from each terminal session. • To do this, connect to the terminal server using a standard terminal services client, then launch a new instance of the VNC server on a different display than any other running instances on that same server. Repeat this many times and you get many different instances of VNC running on a single Windows server with different desktops.

5. Security in VNC • By default, VNC is not a secure protocol. While passwords are not sent in plain-text (as in telnet), brute-force cracking could prove successful if both the encryption key and encoded password are sniffed from a network. For this reason it is recommended that a password of at least 8 characters is used. • However, VNC may be tunnelled over an SSH or VPNconnection which would add an extra security layer with stronger encryption. SSH clients are available for all major platforms (and many smaller platforms as well); SSH tunnels can be created from UNIX clients, Windows clients, Macintosh clients (including OS X and System 7 and up) - and many others. • UltraVNC supports the use of an open-source encryption plugin which encrypts the entire VNC session including password authentication and data transfer. It also allows authentication to be performed based on NTLM and Active Directory user accounts. • RealVNC offers high-strength encryption as part of its commercial package. • Workspot released AES encryption patches for VNC. • As with any server software, if the port used by this service is explicitly blocked by a firewall it is practically impossible to break into the service. • In other words a network administrator has to enable firewalling for 5901 on the local router in order to prevent access from outside the LAN. • On July 31, 2005, Tridia announced that they were discontinuing development of their free product Tridia VNC and suggested users instead pay for their commercial remote administration software iTvity, claiming that software based on the VNC protocol is unsuitable for deployment in a business environment due to design deficiencies in VNC itself.