--- title: WIR - What Is Running: A CLI Tool in C to Inspect... description: A new CLI tool called 'wir' (What Is Running) provides a unified interface for inspecting processes and ports on macOS and Linux. Written in C, it consolidates... canonical: https://daily.dev/posts/wir---what-is-running-a-cli-tool-in-c-to-inspect-processes-and-ports-qku2txwyn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports | daily.dev og:description: A new CLI tool called 'wir' (What Is Running) provides a unified interface for inspecting processes and ports on macOS and Linux. Written in C, it consolidates... og:url: https://daily.dev/posts/wir---what-is-running-a-cli-tool-in-c-to-inspect-processes-and-ports-qku2txwyn og:image: https://api.daily.dev/og/posts/qKu2tXWyn.png og:image:alt: WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports **[Deleted user](https://daily.dev/sources/404)** · [@ghost](https://daily.dev/ghost) · 3 min read · 0 upvotes · 0 comments ## Summary A new CLI tool called 'wir' (What Is Running) provides a unified interface for inspecting processes and ports on macOS and Linux. Written in C, it consolidates functionality from lsof, netstat, and ps into a single command with features like port-to-process mapping, process ancestry trees, environment variable inspection, and multiple output formats (JSON, tree, short). The tool demonstrates cross-platform system programming with platform abstraction layers for /proc parsing on Linux and libproc/sysctl on macOS, strict memory management, and modular architecture. Available via Homebrew, it's designed as both a practical utility and a learning project for understanding system-level programming concepts. ## Content I recently released **wir** (What Is Running), a command-line tool written in C to inspect what's running on specific ports and get detailed process information. A project born from a practical need that turned into an opportunity to explore system programming in C. ## The Problem How many times have you had a port occupied without knowing which process is using it? Or needed to trace a process hierarchy to understand who spawned what? We usually resort to combinations of `lsof`, `netstat`, and `ps`, but why not have everything in a single command? ## The Solution `wir` is a cross-platform tool (macOS and Linux) that allows you to: - Discover which process is using a specific port - Get detailed information about a PID - Visualize the complete ancestry tree of a process - List all running processes - View a process's environment variables - Output in normal, short, JSON, or tree format - Receive security warnings for potentially risky configurations ## Practical Examples ```bash # Who's using port 8080? wir --port 8080 # Info about a specific process wir --pid 1234 # Show the process ancestry tree wir --pid 1234 --tree # JSON output for scripting wir --port 3000 --json # List all processes (short format) wir --all --short # Security warnings only wir --port 8080 --warnings ``` ## The Architecture The project is structured in a modular way: - **Platform abstraction layer**: handles differences between Linux (`/proc` parsing) and macOS (`libproc` and `sysctl`) - **Output formatting**: supports multiple display modes without duplicating logic - **Consistent error handling**: every allocation is checked, every resource is freed - **Strict memory management**: no leaks, no undefined behavior ## What I Learned Writing `wir` was an excellent opportunity to practice fundamental concepts: 1. **System programming**: interfacing with `/proc`, system calls, process management 2. **Cross-platform development**: conditional compilation and different APIs for each OS 3. **Memory safety in C**: manual memory management without a garbage collector 4. **Build systems**: Makefile with automatic platform detection 5. **API design**: clean and composable interface ## I Don't Memorize Commands As my approach goes: I'm not interested in memorizing the exact `lsof` or `netstat` commands. I prefer understanding the underlying architecture and building tools that solve the problem more elegantly. `wir` isn't just a wrapper, it's an abstraction that hides the complexity of OS differences. ## The Future The project is open to extensions: - UDP port support - Advanced process filtering - Support for other OSes (BSD, etc.) - Performance optimizations - Additional output formats ## Try It Out [wir](https://github.com/AlbertoBarrago/wir) It's a learning project, so feel free to experiment and extend it. Building system tools in C is a great way to understand what's really happening under the hood. ```bash # Build and install brew tap AlbertoBarrago/tap brew install wir # Start using it wir --port 3000 ``` ## Similar posts on daily.dev - [witr: Why is this running? Trace process, port, container or file](https://daily.dev/posts/witr-why-is-this-running-trace-process-port-container-or-file-kveuzlpib) · Product Hunt · 201 upvotes · 8 comments - [pranshuparmar/witr: Why is this running?](https://daily.dev/posts/pranshuparmar-witr-why-is-this-running--3eqkjkhyd) · Hacker News · 11 upvotes · 2 comments - [GitHub - raskrebs/sonar: CLI tool for inspecting and managing services listening on localhost ports](https://daily.dev/posts/github---raskrebs-sonar-cli-tool-for-inspecting-and-managing-services-listening-on-localhost-ports-g9zhba0uo) · Hacker News · 1 upvotes · 0 comments - [I launched Port Pilot](https://daily.dev/posts/i-launched-port-pilot-j9k2a75bz) · Flavio Copes · 1 upvotes · 1 comments --- Tags: [#c](https://daily.dev/tags/c), [#cli](https://daily.dev/tags/cli), [#devtools](https://daily.dev/tags/devtools), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/wir---what-is-running-a-cli-tool-in-c-to-inspect-processes-and-ports-qku2txwyn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/wir---what-is-running-a-cli-tool-in-c-to-inspect-processes-and-ports-qku2txwyn","headline":"WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports","text":"A new CLI tool called 'wir' (What Is Running) provides a unified interface for inspecting processes and ports on macOS and Linux. Written in C, it consolidates functionality from lsof, netstat, and ps into a single command with features like port-to-process mapping, process ancestry trees, environment variable inspection, and multiple output formats (JSON, tree, short). The tool demonstrates cross-platform system programming with platform abstraction layers for /proc parsing on Linux and libproc/sysctl on macOS, strict memory management, and modular architecture. Available via Homebrew, it's designed as both a practical utility and a learning project for understanding system-level programming concepts.","url":"https://daily.dev/posts/wir---what-is-running-a-cli-tool-in-c-to-inspect-processes-and-ports-qku2txwyn","datePublished":"2026-01-13T17:33:48.190Z","dateModified":"2026-03-15T04:58:16.769Z","author":{"@type":"Person","name":"Deleted user","url":"https://daily.dev/ghost","image":"https://media.daily.dev/image/upload/s--hNIUzLiO--/f_auto/v1705327420/public/ghost_vlftth","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":33410}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/404","name":"Deleted user"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Deleted user","item":"https://daily.dev/sources/404"},{"@type":"ListItem","position":3,"name":"WIR - What Is Running: A CLI Tool in C to Inspect Processes and Ports"}]} ```