whoport

Overview

whoport is a Windows CLI tool written in Go that tells you exactly what process is listening on a given port and lets you kill it, without the netstat -ano | findstr → tasklist | findstr dance.

It shows the PID, process name, full executable path, the exact command line that started the process, and how long it has been running. If you want to kill it, it prompts for confirmation first.

> whoport 8123

Port 8123 (TCP, LISTENING)
  PID:      7524
  Process:  python.exe
  Path:     C:\Users\modi\AppData\Local\Python\bin\python.exe
  Command:  "C:\Users\modi\AppData\Local\Python\bin\python.exe" -m http.server 8123
  Started:  16s ago

Kill python.exe (PID 7524)? [y/N]:

Usage

Pass a port number to inspect it. The tool shows everything you need to make a decision before it asks whether to kill the process.

whoport 3000

To see every port currently in use:

whoport --all

To kill without the confirmation prompt, useful in scripts:

whoport 3000 --kill

Commands

How It Works

Unlike tools that shell out to netstat and parse text, whoport calls the Windows IP Helper API directly — the same underlying mechanism netstat itself uses, just without the middleman and with more context exposed.

The porttable/ package calls GetExtendedTcpTable via iphlpapi.dll to enumerate the TCP table. The procinfo/ package resolves a PID to its name, full path, and start time using OpenProcess and QueryFullProcessImageName. Command line comes from a WMI query. The output/ package handles formatting only.

Installation

Grab the prebuilt binary from the Releases page and put whoport.exe somewhere on your PATH. No Go installation required.

To build from source (requires Go 1.22+):

git clone https://github.com/notsajeed/whoport.git
cd whoport
go build -o whoport.exe .

Notes

Run as Administrator to see full process details for system or elevated processes. Without it, some rows will show access denied instead of a process name — this is a Windows permissions constraint, not a bug.

PID 4 is always the Windows kernel's System process and will never resolve to a name, even when running elevated. That's expected. whoport only reads the TCP table and optionally terminates the specific confirmed process — it does not touch the registry, network config, or anything else on the system.

Roadmap

UDP support is next. After that, a --watch <port> mode that alerts when a port opens or closes, a --dry-run flag to preview a kill without executing it, and eventually cross-platform support for Linux and macOS via /proc/net/tcp.

Development Notes

Built out of frustration with the standard Windows port-hunting workflow. The four-step netstat / tasklist sequence is slow, ugly, and still doesn't tell you the command line or how long the process has been running.

Going directly to the Windows API instead of shelling out keeps the tool fast, avoids parsing fragile text output, and gives access to richer process metadata than netstat exposes.