PortWho

The problem

A development server refuses to start because port 8080 is “already in use”. A service you did not install is listening on every interface. netstat -ano gives you a process id, tasklist gives you a name, and if the name is svchost.exe you are still no wiser. Finding the real owner of a port on Windows means stitching together three or four commands and knowing which columns to trust.

What PortWho does

PortWho asks Windows for every listening TCP socket and bound UDP socket, then resolves each owner once: the process, its executable path, the services hosted inside it, and the Authenticode signature on the executable. The result is one row per endpoint with everything you need to decide what it is.

PROTO  ADDRESS      PORT   PID  PROCESS  SERVICES             SIGNATURE
-----  -----------  ----  ----  -------  -------------------  ---------------------
TCP    0.0.0.0       135  1116  svchost  RpcEptMapper, RpcSs  Microsoft Corporation
TCP    ::            135  1116  svchost  RpcEptMapper, RpcSs  Microsoft Corporation
TCP    0.0.0.0       445     4  System   -                    -
UDP    0.0.0.0      5353  2240  svchost  Dnscache             Microsoft Corporation
TCP    127.0.0.1    8080  5120  MyApi    -                    unsigned

The table above is sample data rendered in the current command line’s exact format; the rows on your machine will differ.

Asking about a single port switches to the detailed view:

TCP 127.0.0.1:8080
  Process    MyApi (PID 5120)
  Path       C:\Users\me\source\MyApi\bin\Debug\net10.0\MyApi.exe
  Services   none
  Signature  unsigned

What it deliberately does not do

PortWho is read-only. It never stops a process, closes a socket or changes a service. It does not watch traffic. When Windows refuses to open a process, PortWho says so for that row instead of asking for elevation or failing the whole listing.

How the engine resolves owners

1. The IP Helper API returns the listening TCP and bound UDP tables for IPv4 and IPv6, each row with its owning process id.
2. Every distinct process is inspected once: name, executable path and the list of services hosted in that process (from the service control manager), which is what turns svchost.exe into “RpcEptMapper, RpcSs”.
3. The executable is verified with WinTrust: embedded signature, security-catalog signature, unsigned, invalid or unavailable, including the signer, organisation and issuer. Verification never touches the network.
4. Rows are reported exactly as Windows reports them. Two UDP sockets sharing an address and port through SO_REUSEADDR appear twice, because that is what is bound.

Current status

Part	State
Engine, portwho command line, JSON schema v1	Implemented, tested on Windows CI
PortWho.exe desktop application	Implemented, tested internally
Portable ZIP packaging and verifier	Implemented; unsigned internal builds only
Release signing decision	Open: no certificate exists
Public release	None. Nothing is offered for download

Internal packages have been run only on Windows 11 x64. Until a public release exists, the quick start explains what building from source involves, and the guides show how to answer the same questions with the tools Windows already has.