Windows · amd64 + arm64 · 14 MB · MIT

See what is listening, and which project owns it.

A native Windows app that lists every listening TCP port with the process that owns it, its PID, and the folder it was started in. netstat tells you a port is taken. This tells you which project took it.

Download for Windows How it reads a machine

One binary · no runtime to install · opens instantly

Fig 1 · socket indexer

Every port is a socket, and its number is its height.

A bench indexer reads the machine the way the app does: one socket per listener, standing as tall as its port number, with the ports another machine can reach sitting in wide collars. Move the pointer across the row, or use the arrow keys.

The probe: the port being readWide collar: another machine can reach itSocket: one listening portDial: the port number, 0 to 65535An example scan: 8 listeners, 2 of them reachable from another machine. Socket height and the needle both read the port number on one 0-65535 scale. The head sweeps the row the way the app rescans every two seconds, lifting between sockets and settling on each.

Fig 2 · parameter read station

Built for the question “what just took port 3000?”

No dashboard to configure, no agent to run. Two things are worth knowing, because neither is the obvious approach.

The folder, not just the port

Two servers of the same program are told apart by the project each one serves. The working directory comes from the process's own PEB — Windows exposes it only through NtQueryInformationProcess, which neither the toolhelp snapshot nor WMI reports.
The table comes from the API

The port list is read from GetExtendedTcpTable, not from netstat. netstat's output is localized, so its columns and address text change with the system language. The API does not.
Current without asking

It rescans every two seconds, off the UI thread, so the list stays live without a refresh key. Close the window and it keeps watching from the tray.

The feeler: reading the working directoryParameter block: one process, its folder and command lineShuttle: presents one block at a timeRack: where the shuttle standsTwo rows the app shows side by side: the same program, told apart by the folder each one serves. The shuttle indexes a block under the fixed feeler; the feeler lifts while the work moves, then settles on the folder field. The reading is read-only — a spring probe, not a cutter.

Plate 1 · the app itself

Every column, and the one that matters.

Port, process, bind address, PID, folder — sortable, searchable, and live. Each row says whether the port is exposed or local, and the folder column is the one that tells two servers of the same program apart.

Ports in its dark theme: a sidebar of views and folders beside a table of listening TCP ports showing the port number, whether it is exposed or local, the process name, the bind address, the PID and the project folder, with Open, Copy, Restart and Stop actions for the selected row. — Dark. Every listening port, whether it is exposed, the process behind it, and the folder it serves.

The same window in the light theme: the sidebar's All ports, Exposed only and Local only views with their counts and the folder list, beside the same table. — Light. Search across every column; narrow the list from the sidebar by what another machine can reach, what only this one can, or the folder a process runs in.

Sheet 1 · specification

What it is, exactly.

PlatformWindows 10 or later, 64-bit (amd64 and arm64)

RuntimeNone — a single 14 MB binary. No webview, no cgo, no Node.

StackGo with MyGo and Onevra, drawn on the GPU

ScanEvery 2 seconds, on a background thread

ProtocolsIPv4 and IPv6, TCP

FiltersSearch across every column; an All / Exposed only / Local only view and one entry per project folder, in the sidebar

InstallPer user, no administrator prompt

LicenceMIT

Fig 3 · restart interlock

Stop or restart, safely.

Every destructive action asks first and names the process. Restart reuses the original command line and working directory — which means the command line has to be read before the process is stopped, because it is gone with the process.

The bolt: while it is in the eye, the lever is heldThe key: turned before anything movesTrip lever: the process it stopsRead head: takes the command line firstEvery destructive action in the app asks first and names the process. Here that is a keyed interlock: the bolt sits in the lever's eye until the key is turned, and the lever cannot travel while it is held. The lock body's read head takes the command line before the lever moves, because the command line is gone with the process — which is what makes restart possible.

Sheet 2 · quiet states

The quiet states matter too.

Nothing listening, nothing matching, a process it may not end — each says so plainly, and offers the next step.

The empty state after a search matches nothing: it names the query and offers a Clear search button. — A search with no matches names what was searched for, and offers a way out.

A system process selected: Stop and Restart are disabled and explain why. — A system process cannot be ended — the buttons are disabled and say why.

Know what your machine is serving.

Download the installer Read the source