-
-
Notifications
You must be signed in to change notification settings - Fork 144
/
Copy pathOPTIONS.md
5910 lines (5030 loc) · 350 KB
/
OPTIONS.md
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Here are all of x11vnc command line options:
```
% x11vnc -opts (see below for -help long descriptions)
x11vnc: allow VNC connections to real X11 displays. 0.9.13 lastmod: 2010-12-27
x11vnc options:
-display disp -auth file -N
-autoport n -rfbport str -6
-no6 -noipv6 -noipv4
-reopen -reflect host:N -id windowid
-sid windowid -appshare -clip WxH+X+Y
-flashcmap -shiftcmap n -notruecolor
-advertise_truecolor -visual n -overlay
-overlay_nocursor -8to24 [opts] -24to32
-scale fraction -geometry WxH -scale_cursor frac
-viewonly -shared -once
-forever -loop -timeout n
-sleepin n -inetd -tightfilexfer
-ultrafilexfer -http -http_ssl
-avahi -mdns -zeroconf
-connect string -connect_or_exit str -proxy string
-vncconnect -novncconnect -allow host1[,host2..]
-localhost -unixsock str -listen6 str
-nolookup -input string -grabkbd
-grabptr -ungrabboth -grabalways
-viewpasswd string -passwdfile filename -showrfbauth filename
-unixpw [list] -unixpw_nis [list] -unixpw_cmd cmd
-find -finddpy -listdpy
-findauth [disp] -create -xdummy
-xvnc -xvnc_redirect -xdummy_xvfb
-create_xsrv str -svc -svc_xdummy
-svc_xvnc -svc_xdummy_xvfb -xdmsvc
-sshxdmsvc -unixpw_system_greeter -redirect port
-display WAIT:... -vencrypt mode -anontls mode
-sslonly -dhparams file -nossl
-ssl [pem] -ssltimeout n -sslnofail
-ssldir dir -sslverify path -sslCRL path
-sslGenCA [dir] -sslGenCert type name -sslEncKey pem
-sslCertInfo pem -sslDelCert pem -sslScripts
-stunnel [pem] -stunnel3 [pem] -enc cipher:keyfile
-https [port] -httpsredir [port] -http_oneport
-ssh user@host:disp -usepw -storepasswd pass file
-nopw -accept string -afteraccept string
-gone string -users list -noshm
-flipbyteorder -onetile -solid [color]
-blackout string -xinerama -noxinerama
-xtrap -xrandr [mode] -rotate string
-padgeom WxH -o logfile -flag file
-rmflag file -rc filename -norc
-env VAR=VALUE -prog /path/to/x11vnc -h, -help
-?, -opts -V, -version -license
-dbg -q, -quiet -v, -verbose
-bg -modtweak -nomodtweak
-xkb -noxkb -capslock
-skip_lockkeys -noskip_lockkeys -skip_keycodes string
-sloppy_keys -skip_dups -noskip_dups
-add_keysyms -noadd_keysyms -clear_mods
-clear_keys -clear_all -remap string
-norepeat -repeat -nofb
-nobell -nosel -noprimary
-nosetprimary -noclipboard -nosetclipboard
-seldir string -cursor [mode] -nocursor
-cursor_drag -arrow n -noxfixes
-alphacut n -alphafrac fraction -alpharemove
-noalphablend -nocursorshape -cursorpos
-nocursorpos -xwarppointer -noxwarppointer
-always_inject -buttonmap string -nodragging
-ncache n -ncache_cr -ncache_no_moveraise
-ncache_no_dtchange -ncache_no_rootpixmap -ncache_keep_anims
-ncache_old_wm -ncache_pad n -debug_ncache
-wireframe [str] -nowireframe -nowireframelocal
-wirecopyrect mode -nowirecopyrect -debug_wireframe
-scrollcopyrect mode -noscrollcopyrect -scr_area n
-scr_skip list -scr_inc list -scr_keys list
-scr_term list -scr_keyrepeat lo-hi -scr_parms string
-fixscreen string -debug_scroll -noxrecord
-grab_buster -nograb_buster -debug_grabs
-debug_sel -pointer_mode n -input_skip n
-allinput -input_eagerly -speeds rd,bw,lat
-wmdt string -debug_pointer -debug_keyboard
-defer time -wait time -extra_fbur n
-wait_ui factor -setdefer n -nowait_bog
-slow_fb time -xrefresh time -nap
-nonap -sb time -readtimeout n
-ping n -nofbpm -fbpm
-nodpms -dpms -forcedpms
-clientdpms -noserverdpms -noultraext
-chatwindow -noxdamage -xd_area A
-xd_mem f -sigpipe string -threads
-nothreads -fs f -gaps n
-grow n -fuzz n -debug_tiles
-snapfb -rawfb string -freqtab file
-pipeinput cmd -macnodim -macnosleep
-macnosaver -macnowait -macwheel n
-macnoswap -macnoresize -maciconanim n
-macmenu -macuskbd -macnoopengl
-macnorawfb -gui [gui-opts] -remote command
-query variable -QD variable -sync
-query_retries str -remote_prefix str -noremote
-yesremote -unsafe -safer
-privremote -nocmds -allowedcmds list
-deny_all
```
LibVNCServer options:
```
-rfbport port TCP port for RFB protocol
-rfbwait time max time in ms to wait for RFB client
-rfbauth passwd-file use authentication on RFB protocol
(use 'storepasswd' to create a password file)
-rfbversion 3.x Set the version of the RFB we choose to advertise
-permitfiletransfer permit file transfer support
-passwd plain-password use authentication
(use plain-password as password, USE AT YOUR RISK)
-deferupdate time time in ms to defer updates (default 40)
-deferptrupdate time time in ms to defer pointer updates (default none)
-desktop name VNC desktop name (default "LibVNCServer")
-alwaysshared always treat new clients as shared
-nevershared never treat new clients as shared
-dontdisconnect don't disconnect existing clients when a new non-shared
connection comes in (refuse new connection instead)
-httpdir dir-path enable http server using dir-path home
-httpport portnum use portnum for http connection
-enablehttpproxy enable http proxy support
-progressive height enable progressive updating for slow links
-listen ipaddr listen for connections only on network interface with
addr ipaddr. '-listen localhost' and hostname work too.
libvncserver-tight-extension options:
-disablefiletransfer disable file transfer
-ftproot string set ftp root
```
Full x11vnc options:
```
% x11vnc -help
x11vnc: allow VNC connections to real X11 displays. 0.9.13 lastmod: 2010-12-27
(type "x11vnc -opts" to just list the options.)
Typical usage is:
Run this command in a shell on the remote machine "far-host"
with X session you wish to view:
x11vnc -display :0
Then run this in another window on the machine you are sitting at:
vncviewer far-host:0
Once x11vnc establishes connections with the X11 server and starts listening
as a VNC server it will print out a string: PORT=XXXX where XXXX is typically
5900 (the default VNC server port). One would next run something like
this on the local machine: "vncviewer hostname:N" where "hostname" is
the name of the machine running x11vnc and N is XXXX - 5900, i.e. usually
"vncviewer hostname:0".
By default x11vnc will not allow the screen to be shared and it will exit
as soon as the client disconnects. See -shared and -forever below to override
these protections. See the FAQ for details how to tunnel the VNC connection
through an encrypted channel such as ssh(1). In brief:
ssh -t -L 5900:localhost:5900 far-host 'x11vnc -localhost -display :0'
vncviewer -encodings 'copyrect tight zrle hextile' localhost:0
Also, use of a VNC password (-rfbauth or -passwdfile) is strongly recommended.
For additional info see: http://www.karlrunge.com/x11vnc/
and http://www.karlrunge.com/x11vnc/faq.html
Config file support: if the file $HOME/.x11vncrc exists then each line in
it is treated as a single command line option. Disable with -norc. For
each option name, the leading character "-" is not required. E.g. a line
that is either "forever" or "-forever" may be used and are equivalent.
Likewise "wait 100" or "-wait 100" are acceptable and equivalent lines.
The "#" character comments out to the end of the line in the usual way
(backslash it for a literal). Leading and trailing whitespace is trimmed off.
Lines may be continued with a "\" as the last character of a line (it
becomes a space character).
Options:
-display disp X11 server display to connect to, usually :0. The X
server process must be running on same machine and
support MIT-SHM. Equivalent to setting the DISPLAY
environment variable to "disp".
See the description below of the "-display WAIT:..."
extensions, where alias "-find" will find the user's
display automatically, and "-create" will create a
Xvfb session if no session is found.
-auth file Set the X authority file to be "file", equivalent to
setting the XAUTHORITY environment variable to "file"
before startup. Same as -xauth file. See Xsecurity(7),
xauth(1) man pages for more info.
Use '-auth guess' to have x11vnc use its -findauth
mechanism (described below) to try to guess the
XAUTHORITY filename and use it.
XDM/GDM/KDM: if you are running x11vnc as root and want
to find the XAUTHORITY before anyone has logged into an
X session yet, use: x11vnc -env FD_XDM=1 -auth guess ...
(This will also find the XAUTHORITY if a user is already
logged into the X session.) When running as root,
FD_XDM=1 will be tried if the initial -auth guess fails.
-N If the X display is :N, try to set the VNC display to
also be :N This just sets the -rfbport option to 5900+N
The program will exit immediately if that port is not
available. The -N option only works with normal -display
usage, e.g. :0 or :8, -N is ignored in the -display
WAIT:..., -create, -find, -svc, -redirect, etc modes.
-autoport n Automatically probe for a free VNC port starting at n.
The default is to start probing at 5900. Use this to
stay away from other VNC servers near 5900.
-rfbport str The VNC port to listen on (a LibVNCServer option), e.g.
5900, 5901, etc. If specified as "-rfbport PROMPT"
then the x11vnc -gui is used to prompt the user to
enter the port number.
-6 IPv6 listening support. In addition to IPv4, the
IPv6 address is listened on for incoming connections.
The same port number as IPv4 is used.
NOTE: This x11vnc binary was compiled to have the
"-6" IPv6 listening mode ENABLED by default (CPPFLAGS
-DX11VNC_LISTEN6=1). So to disable IPv6 listening mode
you MUST supply the "-no6" option (see below.)
The "-6" mode works for both normal connections and
-ssl encrypted ones. Nearly everything is supported
for the IPv6 case, but there are a few exceptions.
See -stunnel for its IPv6 support.
Currently, for absolutely everything to work correctly
the machine may need to have some IPv4 support, at the
least for the loopback interface. However, for nearly
all usage modes no IPv4 support is required. See -noipv4
.
If you have trouble compiling or running in IPv6 mode,
set -DX11VNC_IPV6=0 in CPPFLAGS when configuring to
disable IPv6 support.
-no6 Disable IPv6 listening support (only useful if the
"-6" mode is compiled in to be the default; see the
X11VNC_LISTEN6 description above under "-6".)
-noipv6 Do not try to use IPv6 for any listening or connecting
sockets. This includes both the listening service
port(s) and outgoing connections from -connect,
-connect_or_exit, or -proxy. Use this if you are having
problems due to IPv6.
-noipv4 Do not try to use IPv4 for any listening or connecting
sockets. This is mainly for exploring the behavior of
x11vnc on an IPv6-only system, but may have other uses.
-reopen If the X server connection is disconnected, try to
reopen the X display (up to one time.) This is of use
for display managers like GDM (KillInitClients option)
that kill x11vnc just after the user logs into the
X session. Note: the reopened state may be unstable.
Set X11VNC_REOPEN_DISPLAY=n to reopen n times and
set X11VNC_REOPEN_SLEEP_MAX to the number of seconds,
default 10, to keep trying to reopen the display (once
per second.)
Update: as of 0.9.9, x11vnc tries to automatically avoid
being killed by the display manager by delaying creating
windows or using XFIXES. So you shouldn't need to use
KillInitClients=false as long as you log in quickly
enough (within 45 seconds of connecting.) You can
disable this by setting X11VNC_AVOID_WINDOWS=never.
You can also set it to the number of seconds to delay.
-reflect host:N Instead of connecting to and polling an X display,
connect to the remote VNC server host:N and be a
reflector/repeater for it. This is useful for trying
to manage the case of many simultaneous VNC viewers
(e.g. classroom broadcasting) where, e.g. you put
a repeater on each network switch, etc, to improve
performance by distributing the load and network
traffic. Implies -shared (use -noshared as a later
option to disable). See the discussion below under
-rawfb vnc:host:N for more details.
-id windowid Show the X window corresponding to "windowid" not
the entire display. New windows like popup menus,
transient toplevels, etc, may not be seen or may be
clipped. Disabling SaveUnders or BackingStore in the
X server may help show them. x11vnc may crash if the
window is initially partially obscured, changes size,
is iconified, etc. Some steps are taken to avoid this
and the -xrandr mechanism is used to track resizes. Use
xwininfo(1) to get the window id, or use "-id pick"
to have x11vnc run xwininfo(1) for you and extract
the id. The -id option is useful for exporting very
simple applications (e.g. the current view on a webcam).
-sid windowid As -id, but instead of using the window directly it
shifts a root view to it: this shows SaveUnders menus,
etc, although they will be clipped if they extend beyond
the window.
-appshare Simple application sharing based on the -id/-sid
mechanism. Every new toplevel window that the
application creates induces a new viewer window via
a reverse connection. The -id/-sid and -connect
options are required. Run 'x11vnc -appshare -help'
for more info.
-clip WxH+X+Y Only show the sub-region of the full display that
corresponds to the rectangle geometry with size WxH and
offset +X+Y. The VNC display has size WxH (i.e. smaller
than the full display). This also works for -id/-sid
mode where the offset is relative to the upper left
corner of the selected window. An example use of this
option would be to split a large (e.g. Xinerama) display
into two parts to be accessed via separate viewers by
running a separate x11vnc on each part.
Use '-clip xinerama0' to clip to the first xinerama
sub-screen (if xinerama is active). xinerama1 for the
2nd sub-screen, etc. This way you don't need to figure
out the WxH+X+Y of the desired xinerama sub-screen.
screens are sorted in increasing distance from the
(0,0) origin (I.e. not the Xserver's order).
-flashcmap In 8bpp indexed color, let the installed colormap flash
as the pointer moves from window to window (slow).
Also try the -8to24 option to avoid flash altogether.
-shiftcmap n Rare problem, but some 8bpp displays use less than 256
colorcells (e.g. 16-color grayscale, perhaps the other
bits are used for double buffering) *and* also need to
shift the pixels values away from 0, .., ncells. "n"
indicates the shift to be applied to the pixel values.
To see the pixel values set DEBUG_CMAP=1 to print out
a colormap histogram. Example: -shiftcmap 240
-notruecolor For 8bpp displays, force indexed color (i.e. a colormap)
even if it looks like 8bpp TrueColor (rare problem).
-advertise_truecolor If the X11 display is indexed color, lie to clients
when they first connect by telling them it is truecolor.
To workaround RealVNC: inPF has colourMap but not 8bpp
Use '-advertise_truecolor reset' to reset client fb too.
-visual n This option probably does not do what you think.
It simply *forces* the visual used for the framebuffer;
this may be a bad thing... (e.g. messes up colors or
cause a crash). It is useful for testing and for some
workarounds. n may be a decimal number, or 0x hex.
Run xdpyinfo(1) for the values. One may also use
"TrueColor", etc. see <X11/X.h> for a list. If the
string ends in ":m" then for better or for worse
the visual depth is forced to be m. You may want to
use -noshm when using this option (so XGetImage may
automatically translate the pixel data).
-overlay Handle multiple depth visuals on one screen, e.g. 8+24
and 24+8 overlay visuals (the 32 bits per pixel are
packed with 8 for PseudoColor and 24 for TrueColor).
Currently -overlay only works on Solaris via
XReadScreen(3X11) and IRIX using XReadDisplay(3).
On Solaris there is a problem with image "bleeding"
around transient popup menus (but not for the menu
itself): a workaround is to disable SaveUnders
by passing the "-su" argument to Xsun (in
/etc/dt/config/Xservers).
Use -overlay as a workaround for situations like these:
Some legacy applications require the default visual to
be 8bpp (8+24), or they will use 8bpp PseudoColor even
when the default visual is depth 24 TrueColor (24+8).
In these cases colors in some windows will be incorrect
in x11vnc unless -overlay is used. Another use of
-overlay is to enable showing the exact mouse cursor
shape (details below).
Under -overlay, performance will be somewhat slower
due to the extra image transformations required.
For optimal performance do not use -overlay, but rather
configure the X server so that the default visual is
depth 24 TrueColor and try to have all apps use that
visual (e.g. some apps have -use24 or -visual options).
-overlay_nocursor Sets -overlay, but does not try to draw the exact mouse
cursor shape using the overlay mechanism.
-8to24 [opts] Try this option if -overlay is not supported on your
OS, and you have a legacy 8bpp app that you want to
view on a multi-depth display with default depth 24
(and is 32 bpp) OR have a default depth 8 display with
depth 24 overlay windows for some apps. This option
may not work on all X servers and hardware (tested
on XFree86/Xorg mga driver and Xsun). The "opts"
string is not required and is described below.
This mode enables a hack where x11vnc monitors windows
within 3 levels from the root window. If it finds
any that are 8bpp it extracts the indexed color
pixel values using XGetImage() and then applies a
transformation using the colormap(s) to create TrueColor
RGB values that it in turn inserts into bits 1-24 of
the framebuffer. This creates a depth 24 "view"
of the display that is then exported via VNC.
Conversely, for default depth 8 displays, the depth
24 regions are read by XGetImage() and everything is
transformed and inserted into a depth 24 TrueColor
framebuffer.
Note that even if there are *no* depth 24 visuals or
windows (i.e. pure 8bpp), this mode is potentially
an improvement over -flashcmap because it avoids the
flashing and shows each window in the correct color.
This method works OK, but may still have bugs and it
does hog resources. If there are multiple 8bpp windows
using different colormaps, one may have to iconify all
but one for the colors to be correct.
There may be painting errors for clipping and switching
between windows of depths 8 and 24. Heuristics are
applied to try to minimize the painting errors. One can
also press 3 Alt_L's in a row to refresh the screen
if the error does not repair itself. Also the option
-fixscreen 8=3.0 or -fixscreen V=3.0 may be used to
periodically refresh the screen at the cost of bandwidth
(every 3 sec for this example).
The [opts] string can contain the following settings.
Multiple settings are separated by commas.
For for some X servers with default depth 24 a
speedup may be achieved via the option "nogetimage".
This enables a scheme were XGetImage() is not used
to retrieve the 8bpp data. Instead, it assumes that
the 8bpp data is in bits 25-32 of the 32bit X pixels.
There is no requirement that the X server should put
the data there for our poll requests, but some do and
so the extra steps to retrieve it can be skipped.
Tested with mga driver with XFree86/Xorg. For the
default depth 8 case this option is ignored.
To adjust how often XGetImage() is used to poll the
non-default visual regions for changes, use the option
"poll=t" where "t" is a floating point time.
(default: 0.05)
Setting the option "level2" will limit the search
for non-default visual windows to two levels from the
root window. Do this on slow machines where you know
the window manager only imposes one extra window between
the app window and the root window.
Also for very slow machines use "cachewin=t"
where t is a floating point amount of time to cache
XGetWindowAttributes results. E.g. cachewin=5.0.
This may lead to the windows being unnoticed for this
amount of time when deiconifying, painting errors, etc.
While testing on a very old SS20 these options gave
tolerable response: -8to24 poll=0.2,cachewin=5.0. For
this machine -overlay is supported and gives better
response.
Debugging for this mode can be enabled by setting
"dbg=1", "dbg=2", or "dbg=3".
-24to32 Very rare problem: if the framebuffer (X display
or -rawfb) is 24bpp instead of the usual 32bpp, then
dynamically transform the pixels to 32bpp. This will be
slower, but can be used to work around problems where
VNC viewers cannot handle 24bpp (e.g. "main: setPF:
not 8, 16 or 32 bpp?"). See the FAQ for more info.
In the case of -rawfb mode, the pixels are directly
modified by inserting a 0 byte to pad them out to 32bpp.
For X displays, a kludge is done that is equivalent to
"-noshm -visual TrueColor:32". (If better performance
is needed for the latter, feel free to ask).
-scale fraction Scale the framebuffer by factor "fraction". Values
less than 1 shrink the fb, larger ones expand it. Note:
the image may not be sharp and response may be slower.
If "fraction" contains a decimal point "." it
is taken as a floating point number, alternatively
the notation "m/n" may be used to denote fractions
exactly, e.g. -scale 2/3
To scale asymmetrically in the horizontal and vertical
directions, specify a WxH geometry to stretch to:
e.g. '-scale 1024x768', or also '-scale 0.9x0.75'
Scaling Options: can be added after "fraction" via
":", to supply multiple ":" options use commas.
If you just want a quick, rough scaling without
blending, append ":nb" to "fraction" (e.g. -scale
1/3:nb). No blending is the default for 8bpp indexed
color, to force blending for this case use ":fb".
To disable -scrollcopyrect and -wirecopyrect under
-scale use ":nocr". If you need to to enable them use
":cr" or specify them explicitly on the command line.
If a slow link is detected, ":nocr" may be applied
automatically. Default: :cr
More esoteric options: for compatibility with vncviewers
the scaled width is adjusted to be a multiple of 4:
to disable this use ":n4". ":in" use interpolation
scheme even when shrinking, ":pad" pad scaled width
and height to be multiples of scaling denominator
(e.g. 3 for 2/3).
-geometry WxH Same as -scale WxH
-scale_cursor frac By default if -scale is supplied the cursor shape is
scaled by the same factor. Depending on your usage,
you may want to scale the cursor independently of the
screen or not at all. If you specify -scale_cursor
the cursor will be scaled by that factor. When using
-scale mode to keep the cursor at its "natural" size
use "-scale_cursor 1". Most of the ":" scaling
options apply here as well.
-viewonly All VNC clients can only watch (default off).
-shared VNC display is shared, i.e. more than one viewer can
connect at the same time (default off).
-once Exit after the first successfully connected viewer
disconnects, opposite of -forever. This is the Default.
-forever Keep listening for more connections rather than exiting
as soon as the first client(s) disconnect. Same as -many
To get the standard non-shared VNC behavior where when
a new VNC client connects the existing VNC client is
dropped use: -nevershared -forever This method can
also be used to guard against hung TCP connections that
do not go away.
-loop Create an outer loop restarting the x11vnc process
whenever it terminates. -bg and -inetd are ignored
in this mode (however see -loopbg below).
Useful for continuing even if the X server terminates
and restarts (at that moment the process will need
permission to reconnect to the new X server of course).
Use, e.g., -loop100 to sleep 100 millisecs between
restarts, etc. Default is 2000ms (i.e. 2 secs) Use,
e.g. -loop300,5 to sleep 300 ms and only loop 5 times.
If -loopbg (plus any numbers) is specified instead,
the "-bg" option is implied and the mode approximates
inetd(8) usage to some degree. In this case when
it goes into the background any listening sockets
(i.e. ports 5900, 5800) are closed, so the next one
in the loop can use them. This mode will only be of
use if a VNC client (the only client for that process)
is already connected before the process goes into the
background, for example, usage of -display WAIT:..,
-svc, and -connect can make use of this "poor man's"
inetd mode. The default wait time is 500ms in this
mode. This usage could use useful: -svc -bg -loopbg
-timeout n Exit unless a client connects within the first n seconds
after startup.
If there have been no connection attempts after n
seconds x11vnc exits immediately. If a client is
trying to connect but has not progressed to the normal
operating state, x11vnc gives it a few more seconds
to finish and exits if it does not make it to the
normal state.
For reverse connections via -connect or -connect_or_exit
a timeout of n seconds will be set for all reverse
connects. If the connect timeout alarm goes off,
x11vnc will exit immediately.
-sleepin n At startup sleep n seconds before proceeding (e.g. to
allow redirs and listening clients to start up)
If a range is given: '-sleepin min-max', a random value
between min and max is slept. E.g. '-sleepin 0-20' and
'-sleepin 10-30'. Floats are allowed too.
-inetd Launched by inetd(8): stdio instead of listening socket.
Note: if you are not redirecting stderr to a log file
(via shell 2> or -o option) you MUST also specify the -q
option, otherwise the stderr goes to the viewer which
will cause it to abort. Specifying both -inetd and -q
and no -o will automatically close the stderr.
-tightfilexfer Enable the TightVNC file transfer extension. Note that
that when the -viewonly option is supplied all file
transfers are disabled. Also clients that log in
viewonly cannot transfer files. However, if the remote
control mechanism is used to change the global or
per-client viewonly state the filetransfer permissions
will NOT change.
IMPORTANT: please understand if -tightfilexfer is
specified and you run x11vnc as root for, say, inetd
or display manager (gdm, kdm, ...) access and you do
not have it switch users via the -users option, then
VNC Viewers that connect are able to do filetransfer
reads and writes as *root*.
Also, tightfilexfer is disabled in -unixpw mode.
-ultrafilexfer Note: to enable UltraVNC filetransfer and to get it to
work you probably need to supply these LibVNCServer
options: "-rfbversion 3.6 -permitfiletransfer"
"-ultrafilexfer" is an alias for this combination.
IMPORTANT: please understand if -ultrafilexfer is
specified and you run x11vnc as root for, say, inetd
or display manager (gdm, kdm, ...) access and you do
not have it switch users via the -users option, then
VNC Viewers that connect are able to do filetransfer
reads and writes as *root*.
Note that sadly you cannot do both -tightfilexfer and
-ultrafilexfer at the same time because the latter
requires setting the version to 3.6 and tightvnc will
not do filetransfer when it sees that version number.
-http Instead of using -httpdir (see below) to specify
where the Java vncviewer applet is, have x11vnc try
to *guess* where the directory is by looking relative
to the program location and in standard locations
(/usr/local/share/x11vnc/classes, etc). Under -ssl or
-stunnel the ssl classes subdirectory is sought.
-http_ssl As -http, but force lookup for ssl classes subdir.
Note that for HTTPS, single-port Java applet delivery
you can set X11VNC_HTTPS_DOWNLOAD_WAIT_TIME to the
max number of seconds to wait for the applet download
to finish. The default is 15.
-avahi Use the Avahi/mDNS ZeroConf protocol to advertise
this VNC server to the local network. (Related terms:
Rendezvous, Bonjour). Depending on your setup, you
may need to start avahi-daemon and open udp port 5353
in your firewall.
You can set X11VNC_AVAHI_NAME, X11VNC_AVAHI_HOST,
and/or X11VNC_AVAHI_PORT environment variables
to override the default values. For example:
-env X11VNC_AVAHI_NAME=wally
If the avahi API cannot be found at build time, a helper
program like avahi-publish(1) or dns-sd(1) will be tried
-mdns Same as -avahi.
-zeroconf Same as -avahi.
-connect string For use with "vncviewer -listen" reverse connections.
If "string" has the form "host" or "host:port"
the connection is made once at startup.
Use commas for a list of host's and host:port's.
E.g. -connect host1,host2 or host1:0,host2:5678.
Note that to reverse connect to multiple hosts at the
same time you will likely need to also supply: -shared
Note that unlike most vnc servers, x11vnc will require a
password for reverse as well as for forward connections.
(provided password auth has been enabled, -rfbauth, etc)
If you do not want to require a password for reverse
connections set X11VNC_REVERSE_CONNECTION_NO_AUTH=1 in
your environment before starting x11vnc.
If "string" contains "/" it is instead interpreted
as a file to periodically check for new hosts.
The first line is read and then the file is truncated.
Be careful about the location of this file if x11vnc
is running as root (e.g. via gdm(1), etc).
Repeater mode: Some services provide an intermediate
"vnc repeater": http://www.uvnc.com/addons/repeater.html
(and also http://koti.mbnet.fi/jtko/ for linux port)
that acts as a proxy/gateway. Modes like these require
an initial string to be sent for the reverse connection
before the VNC protocol is started. Here are the ways
to do this:
-connect pre=some_string+host:port
-connect pre128=some_string+host:port
-connect repeater=ID:1234+host:port
-connect repeater=23.45.67.89::5501+host:port
SSVNC notation is also supported:
-connect repeater://host:port+ID:1234
As with normal -connect usage, if the repeater port is
not supplied 5500 is assumed.
The basic idea is between the special tag, e.g. "pre="
and "+" is the pre-string to be sent. Note that in
this case host:port is the repeater server, NOT the
vnc viewer. Somehow the pre-string tells the repeater
server how to find the vnc viewer and connect you to it.
In the case pre=some_string+host:port, "some_string"
is simply sent. In the case preNNN=some_string+host:port
"some_string" is sent in a null padded buffer of
length NNN. repeater= is the same as pre250=, this is
the ultravnc repeater buffer size.
Strings like "\n" and "\r", etc. are expanded to
newline and carriage return. "\c" is expanded to
"," since the connect string is comma separated.
See also the -proxy option below for additional ways
to plumb reverse connections.
Reverse SSL: using -connect in -ssl mode makes x11vnc
act as an SSL client (initiates SSL connection) rather
than an SSL server. The idea is x11vnc might be
connecting to stunnel on the viewer side with the
viewer in listening mode. If you do not want this
behavior, use -env X11VNC_DISABLE_SSL_CLIENT_MODE=1.
With this the viewer side can act as the SSL client
as it normally does for forward connections.
Reverse SSL Repeater mode: This will work, but note
that if the VNC Client does any sort of a 'Fetch Cert'
action before connecting, then the Repeater will
likely drop the connection and both sides will need
to restart. Consider the use of -connect_or_exit
and -loop300,2 to have x11vnc reconnect once to the
repeater after the fetch. You will probably also want
to supply -sslonly to avoid x11vnc thinking the delay
in response means the connection is VeNCrypt. The env
var X11VNC_DISABLE_SSL_CLIENT_MODE=1 discussed above
may also be useful (i.e. the viewer can do a forward
connection as it normally does.)
IPv6: as of x11vnc 0.9.10 the -connect option should
connect to IPv6 hosts properly. If there are problems
you can disable IPv6 by setting -DX11VNC_IPV6=0
in CPPFLAGS when configuring. If there problems
connecting to IPv6 hosts consider a relay like the
included inet6to4 script or the -proxy option.
-connect_or_exit str As with -connect, except if none of the reverse
connections succeed, then x11vnc shuts down immediately
An easier to type alias for this option is '-coe'
By the way, if you do not want x11vnc to listen on
ANY interface use -rfbport 0 which is handy for the
-connect_or_exit mode.
-proxy string Use proxy in string (e.g. host:port) as a proxy for
making reverse connections (-connect or -connect_or_exit
options).
Web proxies are supported, but note by default most of
them only support destination connections to ports 443
or 563, so this might not be very useful (the viewer
would need to listen on that port or the router would
have to do a port redirection).
A web proxy may be specified by either "host:port"
or "http://host:port" (the port is required even if
it is the common choices 80 or 8080)
SOCKS4, SOCKS4a, and SOCKS5 are also supported.
SOCKS proxies normally do not have restrictions on the
destination port number.
Use a format like this: socks://host:port or
socks5://host:port. Note that ssh -D does not support
SOCKS4a, so use socks5://. For socks:// SOCKS4 is used
on a numerical IP and "localhost", otherwise SOCKS4a
is used (and so the proxy tries to do the DNS lookup).
An experimental mode is "-proxy http://host:port/..."
Note the "/" after the port that distinguishes it from
a normal web proxy. The port must be supplied even if
it is the default 80. For this mode a GET is done to
the supplied URL with the string host=H&port=P appended.
H and P will be the -connect reverse connect host
and port. Use the string "__END__" to disable the
appending. The basic idea here is that maybe some cgi
script provides the actual viewer hookup and tunnelling.
How to actually achieve this within cgi, php, etc. is
not clear... A custom web server or apache module
would be straight-forward.
Another experimental mode is "-proxy ssh://user@host"
in which case a SSH tunnel is used for the proxying.
"user@" is not needed unless your unix username is
different on "host". For a non-standard SSH port
use ssh://user@host:port. If proxies are chained (see
next paragraph) then the ssh one must be the first one.
If ssh-agent is not active, then the ssh password needs
to be entered in the terminal where x11vnc is running.
Examples:
-connect localhost:0 -proxy ssh://me@friends-pc:2222
-connect snoopy:0 -proxy ssh://ssh.company.com
Multiple proxies may be chained together in case one
needs to ricochet off of a number of hosts to finally
reach the VNC viewer. Up to 3 may be chained, separate
them by commas in the order they are to be connected to.
E.g.: http://host1:port1,socks5://host2:port2 or three
like: first,second,third
IPv6: as of x11vnc 0.9.10 the -proxy option should
connect to IPv6 hosts properly. If there are problems
you can disable IPv6 by setting -DX11VNC_IPV6=0
in CPPFLAGS when configuring. If there problems
connecting to IPv6 hosts consider a relay like the
included inet6to4 script.
-vncconnect Monitor the VNC_CONNECT X property set by the standard
-novncconnect VNC program vncconnect(1). When the property is
set to "host" or "host:port" establish a reverse
connection. Using xprop(1) instead of vncconnect may
work (see the FAQ). The -remote control mechanism uses
X11VNC_REMOTE channel, and this option disables/enables
it as well. Default: -vncconnect
To use different names for these X11 properties (e.g. to
have separate communication channels for multiple
x11vnc's on the same display) set the VNC_CONNECT or
X11VNC_REMOTE env. vars. to the string you want, for
example: -env X11VNC_REMOTE=X11VNC_REMOTE_12345
Both sides of the channel must use the same unique name.
The same can be done for the internal X11VNC_TICKER
property (heartbeat and timestamp) if desired.
-allow host1[,host2..] Only allow client connections from hosts matching
the comma separated list of hostnames or IP addresses.
Can also be a numerical IP prefix, e.g. "192.168.100."
to match a simple subnet, for more control build
LibVNCServer with libwrap support (See the FAQ). If the
list contains a "/" it instead is a interpreted
as a file containing addresses or prefixes that is
re-read each time a new client connects. Lines can be
commented out with the "#" character in the usual way.
-allow applies in -ssl mode, but not in -stunnel mode.
IPv6: as of x11vnc 0.9.10 a host can be specified
in IPv6 numerical format, e.g. 2001:4860:b009::93.
-localhost Basically the same as "-allow 127.0.0.1".
Note: if you want to restrict which network interface
x11vnc listens on, see the -listen option below.
E.g. "-listen localhost" or "-listen 192.168.3.21".
As a special case, the option "-localhost" implies
"-listen localhost".
A rare case, but for non-localhost -listen usage, if
you use the remote control mechanism (-R) to change
the -listen interface you may need to manually adjust
the -allow list (and vice versa) to avoid situations
where no connections (or too many) are allowed.
If you do not want x11vnc to listen on ANY interface
(evidently you are using -connect or -connect_or_exit,
or plan to use remote control: -R connect:host), use
-rfbport 0
IPv6: if IPv6 is supported, this option automatically
implies the IPv6 loopback address '::1' as well.
-unixsock str Listen on the unix socket (AF_UNIX) 'str'
for connections. This mode is for either local
connections or a tunnel endpoint where one wants the
file permission of the unix socket file to determine
what can connect to it. (This currently requires an
edit to libvnserver/rfbserver.c: comment out lines 310
and 311, 'close(sock)' and 'return NULL' in rfbserver.c
after the setsockopt() call.) Note that to disable all
tcp listening ports specify '-rfbport 0' and should be
useful with this mode. Example:
mkdir ~/s; chmod 700 ~/s;
x11vnc -unixsock ~/s/mysock -rfbport 0 ...
The SSVNC unix vncviewer can connect to unix sockets.
-listen6 str When in IPv6 listen mode "-6", listen only on the
network interface with address "str". It also works
for link scope addresses (fe80::219:dbff:fee5:3f92%eth0)
and IPv6 hostname strings (e.g. ipv6.google.com.)
Use LibVNCServer -listen option for the IPv4 interface.
-nolookup Do not use gethostbyname() or gethostbyaddr() to look up
host names or IP numbers. Use this if name resolution
is incorrectly set up and leads to long pauses as name
lookups time out, etc.
-input string Fine tuning of allowed user input. If "string" does
not contain a comma "," the tuning applies only to
normal clients. Otherwise the part before "," is
for normal clients and the part after for view-only
clients. "K" is for Keystroke input, "M" for
Mouse-motion input, "B" for Button-click input, "C"
is for Clipboard input, and "F" is for File transfer
(ultravnc only). Their presence in the string enables
that type of input. E.g. "-input M" means normal
users can only move the mouse and "-input KMBCF,M"
lets normal users do anything and enables view-only
users to move the mouse. This option is ignored when
a global -viewonly is in effect (all input is discarded
in that case).
-grabkbd When VNC viewers are connected, attempt to the grab
the keyboard so a (non-malicious) user sitting at the
physical display is not able to enter keystrokes.
This method uses XGrabKeyboard(3X11) and so it is
not secure and does not rule out the person at the
physical display injecting keystrokes by flooding the
server with them, grabbing the keyboard himself, etc.
Some degree of cooperation from the person at the
display is assumed. This is intended for remote
help-desk or educational usage modes.
Note: on some recent (12/2010) X servers and/or
desktops, -grabkbd no longer works: it prevents the
window manager from resizing windows and similar things.
Try -ungrabboth below (might not work.)
-grabptr As -grabkbd, but for the mouse pointer using
XGrabPointer(3X11). Unfortunately due to the way the X
server works, the mouse can still be moved around by the
user at the physical display, but he will not be able to
change window focus with it. Also some window managers
that call XGrabServer(3X11) for resizes, etc, will
act on the local user's input. Again, some degree of
cooperation from the person at the display is assumed.
-ungrabboth Whenever there is any input (either keyboard or
pointer), ungrab *both* the keyboard and the pointer
while injecting the synthetic input. This is to allow
window managers, etc. a chance to grab.
-grabalways Apply both -grabkbd and -grabptr even when no VNC
viewers are connected. If you only want one of them,
use the -R remote control to turn the other back on,
e.g. -R nograbptr.
-viewpasswd string Supply a 2nd password for view-only logins. The -passwd
(full-access) password must also be supplied.
-passwdfile filename Specify the LibVNCServer password via the first line
of the file "filename" (instead of via -passwd on
the command line where others might see it via ps(1)).
See the descriptions below for how to supply multiple
passwords, view-only passwords, to specify external
programs for the authentication, and other features.
If the filename is prefixed with "rm:" it will be
removed after being read. Perhaps this is useful in
limiting the readability of the file. In general, the
password file should not be readable by untrusted users
(BTW: neither should the VNC -rfbauth file: it is NOT
encrypted, only obscured with a fixed key).
If the filename is prefixed with "read:" it will
periodically be checked for changes and reread. It is
guaranteed to be reread just when a new client connects
so that the latest passwords will be used.
If "filename" is prefixed with "cmd:" then the
string after the ":" is run as an external command:
the output of the command will be interpreted as if it
were read from a password file (see below). If the
command does not exit with 0, then x11vnc terminates
immediately. To specify more than 1000 passwords this
way set X11VNC_MAX_PASSWDS before starting x11vnc.
The environment variables are set as in -accept.
Note that due to the VNC protocol only the first 8
characters of a password are used (DES key).
If "filename" is prefixed with "custom:" then a
custom password checker is supplied as an external
command following the ":". The command will be run