How it works

portop reads what the operating system already exposes; it installs nothing and runs no daemon.

Linux

Sockets come from /proc/net/{tcp,tcp6,udp,udp6} and are matched to processes through /proc/<pid>/fd, as ss and lsof do. systemd units and container IDs come from each process's cgroup, traffic from netlink socket diagnostics.

macOS

Sockets and owners come from the machine-readable output of lsof; process details and CPU time from ps; traffic from nettop.

Windows

Sockets and owning PIDs come from GetExtendedTcpTable and GetExtendedUdpTable, process details from the Win32 process APIs with limited query rights, and services from the Service Control Manager.

Safety

External tools run without a shell, with a timeout and a fixed locale. Text that other processes control (names, command lines, reverse DNS, Compose values) is cleaned of terminal escape sequences and bidirectional controls before it is drawn. A signal is only sent after re-checking the target's start time.