portop The table
One row per socket. Optional columns appear as the terminal gets wider; click a heading, or press s, to sort by it.
Columns
| Column | Shows |
|---|---|
PORT | Local port and its service name (:22 ssh), colored by exposure on listening rows. |
PROTO | TCP or UDP; 6 marks IPv6. |
STATE | The TCP state. A bound, unconnected UDP socket is UNCONN and counts as listening. |
PROCESS | The owning process; nginx +3 when three workers share the socket. |
PID, CPU | Process ID and CPU use since the previous refresh. |
REMOTE | The peer, or its reverse-DNS name, for established connections. |
IFACE | The bind address; 0.0.0.0 and :: mean every interface. |
FIREWALL | The host firewall's verdict for a port the network can reach. |
TRAFFIC | Bytes per second received and sent, ↓1.2K ↑340, for an established TCP connection (details). |
USER | The socket's owner. |
CONTAINER | Docker or Podman container, or namespace/pod/container on Kubernetes (details). |
SYSTEMD | The systemd unit on Linux. On Windows it is SERVICE: the services hosted by the process. |
Exposure
A listening port is colored by who can reach it, at any terminal width:
| Color | Bound to | Reachable from |
|---|---|---|
| Red | 0.0.0.0, :: | Every network the host is on, unless a firewall blocks it |
| Amber | One address | That interface's network (a LAN or container network) |
| Green | 127.0.0.1, ::1 | This machine only |
Sorting by IFACE lists the most exposed ports first. The same scopes appear as "scope": "all" | "address" | "loopback" in JSON and drive baseline drift.
Keys
| Key | Action |
|---|---|
| ↑ ↓ PgUp PgDn g G | Move by row or page, to the top or bottom |
| enter | Process details |
| k | Stop the process: then y for SIGTERM or f for SIGKILL |
| o | Open the port in the browser, at the bound address for single-interface listeners |
| f, / | Filter; every word must match the port, PID, process, user, unit, container or address |
| v | IPv4, IPv6 or both |
| e | Show or hide established connections |
| s | Next sort column |
| c | Copy the row |
| n | Clear the new-port marks |
| r | Refresh now |
| , | Settings |
| ? | Help |
| q | Quit |
Every action can be rebound in the settings screen or in config.yml; a key that another action already uses is refused.
Mouse
Click to select, double-click for details, right-click for the kill confirmation, middle-click to open the port, scroll with the wheel, click a heading to sort and click it again to reverse.
Details
enter shows the command line, executable, working directory, user, memory, threads, open files, start time and, for a shared socket, its workers.
Stopping a process
k records the process's start time when the confirmation opens and checks it again just before sending the signal. If the process exited and its PID was reused in the meantime, the signal is refused. On Windows both choices end the process.