<p>I recently released <strong>wir</strong> (What Is Running), a command-line tool written in C to inspect what’s running on specific ports and get detailed process information. A project born from a practical need that turned into an opportunity to explore system programming in C.</p>
<h2>The Problem</h2>
<p>How many times have you had a port occupied without knowing which process is using it? Or needed to trace a process hierarchy to understand who spawned what? We usually resort to combinations of <code>lsof</code>, <code>netstat</code>, and <code>ps</code>, but why not have everything in a single command?</p>
<h2>The Solution</h2>
<p><code>wir</code> is a cross-platform tool (macOS and Linux) that allows you to:</p>
<ul>
<li>Discover which process is using a specific port</li>
<li>Get detailed information about a PID</li>
<li>Visualize the complete ancestry tree of a process</li>
<li>List all running processes</li>
<li>View a process’s environment variables</li>
<li>Output in normal, short, JSON, or tree format</li>
<li>Receive security warnings for potentially risky configurations</li>
</ul>
<h2>Practical Examples</h2>
<pre><code class="language-bash"><span class="hljs-comment"># Who&#x27;s using port 8080?</span>
wir --port 8080

<span class="hljs-comment"># Info about a specific process</span>
wir --pid 1234

<span class="hljs-comment"># Show the process ancestry tree</span>
wir --pid 1234 --tree

<span class="hljs-comment"># JSON output for scripting</span>
wir --port 3000 --json

<span class="hljs-comment"># List all processes (short format)</span>
wir --all --short

<span class="hljs-comment"># Security warnings only</span>
wir --port 8080 --warnings
</code></pre>
<h2>The Architecture</h2>
<p>The project is structured in a modular way:</p>
<ul>
<li><strong>Platform abstraction layer</strong>: handles differences between Linux (<code>/proc</code> parsing) and macOS (<code>libproc</code> and <code>sysctl</code>)</li>
<li><strong>Output formatting</strong>: supports multiple display modes without duplicating logic</li>
<li><strong>Consistent error handling</strong>: every allocation is checked, every resource is freed</li>
<li><strong>Strict memory management</strong>: no leaks, no undefined behavior</li>
</ul>
<h2>What I Learned</h2>
<p>Writing <code>wir</code> was an excellent opportunity to practice fundamental concepts:</p>
<ol>
<li><strong>System programming</strong>: interfacing with <code>/proc</code>, system calls, process management</li>
<li><strong>Cross-platform development</strong>: conditional compilation and different APIs for each OS</li>
<li><strong>Memory safety in C</strong>: manual memory management without a garbage collector</li>
<li><strong>Build systems</strong>: Makefile with automatic platform detection</li>
<li><strong>API design</strong>: clean and composable interface</li>
</ol>
<h2>I Don’t Memorize Commands</h2>
<p>As my approach goes: I’m not interested in memorizing the exact <code>lsof</code> or <code>netstat</code> commands. I prefer understanding the underlying architecture and building tools that solve the problem more elegantly. <code>wir</code> isn’t just a wrapper, it’s an abstraction that hides the complexity of OS differences.</p>
<h2>The Future</h2>
<p>The project is open to extensions:</p>
<ul>
<li>UDP port support</li>
<li>Advanced process filtering</li>
<li>Support for other OSes (BSD, etc.)</li>
<li>Performance optimizations</li>
<li>Additional output formats</li>
</ul>
<h2>Try It Out</h2>
<p><a href="https://github.com/AlbertoBarrago/wir" target="_blank" rel="noopener nofollow">wir</a></p>
<p>It’s a learning project, so feel free to experiment and extend it. Building system tools in C is a great way to understand what’s really happening under the hood.</p>
<pre><code class="language-bash"><span class="hljs-comment"># Build and install</span>
brew tap AlbertoBarrago/tap
brew install wir

<span class="hljs-comment"># Start using it</span>
wir --port 3000
</code></pre>


Alberto Barrago

A new CLI tool called 'wir' (What Is Running) provides a unified interface for inspecting processes and ports on macOS and Linux. Written in C, it consolidates functionality from lsof, netstat, and ps into a single command with features like port-to-process mapping, process ancestry trees, environment variable inspection, and multiple output formats (JSON, tree, short). The tool demonstrates cross-platform system programming with platform abstraction layers for /proc parsing on Linux and libproc/sysctl on macOS, strict memory management, and modular architecture. Available via Homebrew, it's designed as both a practical utility and a learning project for understanding system-level programming concepts.

WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports