RFB protocol
# RFB protocol

RFB ("remote framebuffer") is an open simple protocol for remote access to graphical user interfaces. Because it works at the framebuffer level it is applicable to all windowing systems and applications, including Microsoft Windows, macOS, the X Window System and Wayland. RFB is the protocol used in Virtual Network Computing (VNC) and its derivatives.

## Description

By default, a viewer/client uses TCP port 5900 to connect to a server (or 5800 for browser access), but can also be set to use any other port. Alternatively, a server can connect to a viewer in "listening mode" (by default on port 5500). One advantage of listening mode is that the server site does not have to configure its firewall/NAT to allow access on the specified ports; the burden is on the viewer, which is useful if the server site has no computer expertise, while the viewer user would be expected to be more knowledgeable.

Although RFB started as a relatively simple protocol, it has been enhanced with additional features (such as file transfers) and more sophisticated compression and security techniques as it has developed. To maintain seamless cross-compatibility between the many different VNC client and server implementations, the clients and servers negotiate a connection using the best RFB version, and the most appropriate compression and security options that they can both support.

## History

RFB was originally developed at Olivetti Research Laboratory (ORL) as a remote display technology to be used by a simple thin client with Asynchronous Transfer Mode connectivity called a Videotile. In order to keep the device as simple as possible, RFB was developed and used in preference to any of the existing remote display technologies.

RFB found a second and more enduring use when VNC was developed. VNC was released as open source software and the RFB specification published on the web. Since then RFB has been a free protocol which anybody can use.

When ORL was closed in 2002 some of the key people behind VNC and RFB formed RealVNC, Ltd., in order to continue development of VNC and to maintain the RFB protocol. The current RFB protocol is published on the RealVNC website.

## Protocol versions

Published versions of the RFB protocol are as follows:

| Version | Published | Date | Specification |
| - | - | - | - |
| RFB 3.3 | ORL | January 1998 | The Remote Framebuffer Protocol 3.3 |
| RFB 3.7 | RealVNC Ltd | August 2003 | The Remote Framebuffer Protocol 3.7 |
| RFB 3.8 (current) | RealVNC Ltd | June 2007 | The Remote Framebuffer Protocol 3.8 |
| IETF RFC (3.8) | RealVNC Ltd | March 2011 | RFC 6143 |

Developers are free to add additional encoding and security types but they must book unique identification numbers for these with the maintainers of the protocol so that the numbers do not clash. Clashing type numbers would cause confusion when handshaking a connection and break cross-compatibility between implementations. The list of encoding and security types was maintained by RealVNC Ltd and is separate from the protocol specification so that new types can be added without requiring the specification to be reissued. Since December 2012, the list went to IANA.

A community version of the RFB protocol specification which aims to document all existing extensions is hosted by the TigerVNC project.

### Encoding types

Since encodings are part of the negotiation, some of the encodings below are pseudo-encodings used to advertise the ability to handle a certain extension.

RFB Encodings :

| Number | Encoding |
| - | - |
| 0x00000000 | Raw |
| 0x00000001 | CopyRect |
| 0x00000002 | RRE (Rising Rectangle Run-length) |
| 0x00000004 | CoRRE (Compact RRE) |
| 0x00000005 | Hextile (RRE Variant) |
| 0x00000006 | Zlib |
| 0x00000007 | Tight |
| 0x00000008 | ZlibHex (Zlib + Hextile) |
| 0x00000009 | Ultra |
| 0x00000010 | ZRLE (Zlib Run-length) |
| 0x00000011 | ZYWRLE |
| 0x00000014 | H.264 |
| 0x00000032 | Open H.264 |
| 0xFFFF0001 | CacheEnable |
| 0xFFFF0006 | XOREnable |
| 0xFFFF8000 | ServerState (UltraVNC) |
| 0xFFFF8001 | EnableKeepAlive (UltraVNC) |
| 0xFFFF8002 | FTProtocolVersion (File Transfer Protocol Version - UltraVNC) |
| 0xFFFFFEC7 | ContinuousUpdates |
| 0xFFFFFEC8 | Fence |
| 0xFFFFFECC | ExtendedDesktopSize |
| 0xFFFFFECF | General Input Interface (GII) |
| 0xFFFFFF00–0xFFFFFF09 | CompressLevel (Tight encoding) |
| 0xFFFFFF10 | XCursor |
| 0xFFFFFF11 | RichCursor |
| 0xFFFFFF18 | PointerPos |
| 0xFFFFFF20 | LastRect |
| 0xFFFFFF21 | NewFBSize |
| 0xFFFFFF74 | Tight PNG |
| 0xFFFFFFE0–0xFFFFFFE9 | QualityLevel (Tight encoding) |

Of the publicly-defined picture-based encodings, the most efficient ones are the Tight encoding types. Two types of encodings are defined by TightVNC:

* Tight Encoding, a mixture of rectangle, palette and gradient filling with zlib and JPEG, plus a Zlib-plus-filter "basic compression".
* Tight PNG Encoding, Tight encoding with basic compression replaced with PNG data.

H.264 has been researched for encoding RFB data, but the preliminary results (using Open H.264 format) were described as lackluster by a TurboVNC developer. It does become more efficient with fewer I-frames (keyframes), but CPU utilization remains a problem.

## Limitations

In terms of transferring clipboard data, "there is currently no way to transfer text outside the Latin-1 character set". A common pseudo-encoding extension solves the problem by using UTF-8 in an extended $format.^{:§7.7.27}$

The VNC protocol is pixel based. Although this leads to great flexibility (i.e. any type of desktop can be displayed), it is often less efficient than solutions that have a better understanding of the underlying graphic layout like X11 or desktop such as RDP. Those protocols send graphic primitives or high level commands in a simpler form (e.g. open window), whereas RFB just sends the raw pixel data, albeit compressed.

The VNC protocol expresses mouse button state in a single byte, as binary up/down. This limits the number of mouse buttons to eight (effectively 7 given convention of button 0 meaning "disabled"). Many modern mice enumerate 9 or more buttons, leading to forward/back buttons having no effect over RFB. A "GII" extension solves this $problem.^{:§7.7.11}$

