witr — tracing processes and ports to their origin

★ 22.2K

witr is an open-source tool that answers one question — "why is this running?" — by tracing any process, open port, container, or file back through the exact chain that started it. Reach for it when a port is occupied and you have no idea what is holding it; when a process is running on a server and nobody owns it; when you are investigating an incident and need to know which systemd unit, timer, or container supervisor is responsible; when you have inherited a machine and need to map it before touching anything. Written in Go and distributed as a single static binary, it installs via a one-liner script or through Homebrew, apt, winget, conda, npm, AUR, and other package managers. It runs in two modes: a CLI that outputs machine-readable JSON for scripting, and a full-screen interactive TUI for manual investigation. Supported platforms are Linux, macOS, FreeBSD, and Windows; Docker containers are understood. Where ps, lsof, and systemctl show state and leave you to correlate it manually, witr makes causality explicit in a single command. It shows current system state only — processes that have already exited cannot be recovered.