whoisport

Find out what is listening on a TCP or UDP port, and optionally kill it.

$ whoisport 3000
port    3000
pid     373232
parent  373230
user    kaitlyn
cmd     node node_modules/.bin/vite --port 3000
cwd     /home/kaitlyn/site
uptime  4m 12s

$ whoisport 3000 --kill
...
pid 373232: exited after SIGTERM

$ whoisport
PORT   PID      USER       CMD
3000   373232   kaitlyn    node node_modules/.bin/vite --port 3000
5432   ?        ?          ?
8080   41120    kaitlyn    python3 -m http.server 8080
ports marked ? are owned by another user; run with sudo to see it

lsof -i :3000 gives you a PID and a wall of columns. whoisport gives you the command line, the directory it was started from, who owns it and how long it has been running, which is usually what you need to decide whether to kill it.

Install

cargo binstall whoisport   # prebuilt binary, no compiling
cargo install whoisport    # build from source
pipx install whoisport     # or: uvx whoisport, pip install whoisport

macOS or Linux, with Homebrew:

brew install dpologdvinity/tap/whoisport

Debian/Ubuntu or Fedora/RHEL: download the .deb or .rpm for your architecture from the Releases page, then

sudo apt install ./whoisport_*.deb     # Debian, Ubuntu
sudo dnf install ./whoisport-*.rpm     # Fedora, RHEL

Windows, with Scoop:

scoop bucket add whoisport https://github.com/dpologdvinity/whoisport
scoop install whoisport

Or download a binary from the Releases page: Linux (static, x86_64 and aarch64), macOS (Apple Silicon and Intel) and Windows (x86_64).

Works on Linux (reads /proc directly, no runtime dependencies), macOS (uses the built-in lsof) and Windows 10/11.

Usage

whoisport                          # list every listening port
whoisport <PORT>...                # details for one or more ports
whoisport <PORT>... --kill [--force]
whoisport [<PORT>...] --json       # machine-readable output
whoisport [<PORT>...] --udp        # UDP instead of TCP

Docker: when a port is published by a container, whoisport shows the container name and image (docker web (nginx:alpine)), even when the docker-proxy process itself is owned by root. It asks docker ps only in that case.

--kill always needs explicit ports; it never kills everything. When several processes hold one socket, it signals only the innermost ones: service managers (systemd, launchd, svchost.exe) and parents of another holder are never signalled, because stopping them can take down far more than the port. If any holder was skipped, whoisport says which one still holds the port and exits 3.

How --kill asks, per platform:

On Windows, Ctrl+C reaches every program attached to a console, so whoisport only sends it when the target's console holds nothing but the target, its child processes and a shell. Otherwise it says so and leaves the choice of --force to you.

Exit codes: 0 success, 1 a requested port had nothing listening (or nothing is listening at all), 2 invalid arguments, 3 a kill failed or a holder was skipped, so the port may still be in use.

Checks IPv4 and IPv6 TCP sockets in the LISTEN state. On Linux, processes owned by other users can't be inspected without sudo; they show up as ?. On Windows, details of system services need an elevated terminal. On macOS, other users' listeners only appear when run with sudo.

License

MIT