On Jul 14,  1:06pm, Mike Starke wrote:

> I just did a nmap on one of my routers (cisco 2500) and there is
> one line that I cannot explain:
> 
> 6001	open	tcp	X11:1
> 
> What is this? How can I close this if not needed?

It looks like someone's X session to me.

If your router is part of your intranet infrastructure, you probably
don't want to close it down.  OTOH, if it's part of your firewall
between your intranet and the outside world, you'll definitely want to
close it down.  People needing X access through the firewall should
be using ssh.