PortWho documentation · Getting started

Quick start

What PortWho answers, how the command line is built from source today, the first three commands to try, and how to read the table, the details view and the exit codes.

Product
PortWho
Section
Getting started
Page
1 of 7

Note

PortWho is in development. The read-only engine, the portwho command line and the PortWho.exe desktop application are implemented and tested internally, but there is no public download, installer or release yet, and the source repository is private during development.

What PortWho answers

PortWho tells you which process or Windows service owns a TCP or UDP port. For every listening TCP socket and every bound UDP socket, over IPv4 and IPv6, it reports:

  • protocol, local address and port;
  • owning process id and process name;
  • executable path, when Windows allows the process to be opened;
  • Windows services hosted by that process, so svchost.exe is explained;
  • Authenticode status of the executable (embedded signature, security-catalog signature, unsigned, invalid or unavailable) with the signer, organization and issuer.

PortWho never changes anything. It does not stop processes, touch sockets or services, and signature verification never uses the network.

Build and run from source

Building needs access to the source repository, which is private during development. The steps are documented for contributors and for when the repository is published; if you do not have access, skip to reading the output to see what PortWho reports.

You need Windows and the .NET SDK version pinned in the repository’s global.json.

cd apps/portwho
dotnet build PortWho.slnx --configuration Release

The command-line project builds an executable named portwho (by default under src\PortWho.Cli\bin\Release\net10.0-windows\). The examples below assume it is on your PATH or that you run it from that directory. dotnet test PortWho.slnx --configuration Release runs the test suite; the Windows integration tests only execute on Windows.

Three commands to try first

portwho

Lists every endpoint as a compact table, one line per endpoint, sorted by port.

portwho 8080

Answers “who owns port 8080?” in the detailed view: one block per endpoint with path, services and signer.

portwho --json

Writes a machine-readable document (schema version 1) for scripts and automation. See JSON output.

Reading the table

Sample output:

PROTO  ADDRESS      PORT   PID  PROCESS  SERVICES             SIGNATURE
-----  -----------  ----  ----  -------  -------------------  ---------------------
TCP    0.0.0.0       135  1116  svchost  RpcEptMapper, RpcSs  Microsoft Corporation
TCP    ::            135  1116  svchost  RpcEptMapper, RpcSs  Microsoft Corporation
UDP    192.168.1.5   137     4  System   -                    -
TCP    0.0.0.0       445     4  System   -                    -
TCP    ::            445     4  System   -                    -
UDP    0.0.0.0      5353  2240  svchost  Dnscache             Microsoft Corporation
UDP    ::           5353  2240  svchost  Dnscache             Microsoft Corporation
TCP    127.0.0.1    8080  5120  MyApi    -                    unsigned

8 endpoints
Column Meaning
PROTO TCP for a listening TCP socket, UDP for a bound UDP socket.
ADDRESS The local address the socket is bound to. 0.0.0.0 and :: mean every interface; 127.0.0.1 and ::1 mean loopback only.
PORT The local port.
PID The owning process id, exactly as Windows reports it.
PROCESS The process name without extension. When the lookup was partial, PortWho appends (access denied) or (lookup failed) to the name, or shows (exited) on its own.
SERVICES Key names of the Windows services hosted by the process, comma-separated, or - when there are none.
SIGNATURE The publisher of the executable: the organization on the signing certificate (or the signer name when the certificate has no organization), with (catalog) appended for catalog-signed files. Otherwise unsigned, INVALID, unavailable, or - when no check was made.

Column widths follow the content up to a cap, so long values are truncated with .... The full values remain available in the details view and in JSON.

Rows are sorted by port, then protocol (TCP before UDP), then address family (IPv4 before IPv6), then address, then PID, so a listing reads like netstat and identical rows stay adjacent.

Reading the details view

A single-port lookup such as portwho 135 uses the details view; --details (or -d) selects it for any listing.

Sample output:

TCP 0.0.0.0:135
  Process    svchost (PID 1116)
  Path       C:\Windows\System32\svchost.exe
  Services   RpcEptMapper (RPC Endpoint Mapper), RpcSs (Remote Procedure Call (RPC))
  Signature  signed by Microsoft Windows (Microsoft Corporation); issuer Microsoft Windows Production PCA 2011

TCP [::]:135
  Process    svchost (PID 1116)
  Path       C:\Windows\System32\svchost.exe
  Services   RpcEptMapper (RPC Endpoint Mapper), RpcSs (Remote Procedure Call (RPC))
  Signature  signed by Microsoft Windows (Microsoft Corporation); issuer Microsoft Windows Production PCA 2011

2 endpoints

Each block starts with the protocol and the address with port (IPv6 addresses are shown in brackets), followed by:

Line Meaning
Process Process name and PID, with the same (access denied), (exited) and (lookup failed) labels as the table.
Path Full path of the executable image, or (not available).
Services Each hosted service as Name (Display name), or none.
Signature A sentence: signed by ..., catalog-signed by ..., unsigned, INVALID ...: reason, unavailable: reason, or not checked. The signer is shown as Signer (Organization) when both are known and differ.
Note Only present when PortWho has an explanation for a partial lookup, for example why the process could not be opened.

A kernel-owned endpoint looks like this:

TCP 0.0.0.0:445
  Process    System (PID 4)
  Path       (not available)
  Services   none
  Signature  not checked
  Note       Windows kernel process; it has no user-mode executable image.

When nothing matches, both views print No endpoints matched.

Exit codes

Code Meaning
0 At least one endpoint was listed.
1 No endpoint matched.
2 Invalid command line. The error is written to standard error, followed by Run 'portwho --help' for usage.
3 Enumeration failed, the run was cancelled, or PortWho is not running on Windows.

Next steps