Query by port

The most common reason people install witr: something is on the port you need, and lsof gives you a PID without telling you what will happen when you kill it.

witr --port 8000

The full picture in one line#

witr --port 5000 --short

systemd (pid 1) → PM2 v5.3.1: God (pid 1481580) → python (pid 1482060)

PM2 is in the chain, so killing PID 1482060 frees the port for about a second. The thing to stop is the PM2 process entry, not the Python process.

That distinction is the whole point. lsof -i :5000 would have handed you PID 1482060 and let you find out the hard way.

Ports owned by a container#

When a port is published by a container runtime, or bound through systemd socket activation, the owning PID is often 1 — technically true and completely useless. witr falls back to resolving the port through the container layer instead:

witr --port 5432 --verbose

The output names the container, its image, and the compose project and service it belongs to. From there, Query by Container picks up the thread.

Several ports at once#

Target flags repeat, and mix with other target types:

witr --port 5432 --port 6379 --port 8000
witr nginx --port 5432 --pid 1234

Results appear in the order you typed them, separated by labeled dividers.

Checking the bind address#

The standard output reports whether the bind is public or private. A service you assumed was loopback-only but is bound to 0.0.0.0 shows up as a warning, not just a line of context.

Next: Query by Container or the interactive TUI, which has a dedicated Ports tab.