RedLine · Engineering-focused software publisher

We draw the line.

From a question about Windows to its exact answer, and at everything a utility should never do. RedLine builds Utility Forge: focused tools that inspect before they change anything, work offline and are documented like engineering.

What are you trying to do?

PortWho
In development
Parts
6 done 0 building 2 planned
Release
None yet

PortWho · ownership map

Sample data · simulated Windows host
Red flow = resolution, not network traffic

TCP 127.0.0.1:8080 Owner chain
  1. 01 Endpoint TCP 127.0.0.1:8080 Listening socket
  2. 02 Process MyApi · PID 5120 Opened with read-only query rights
  3. 03 Executable MyApi.exe C:\Users\me\source\MyApi\bin\Debug\net10.0\
  4. 04 Services none Not a service host
  5. 05 Publisher ! unsigned No embedded or catalog signature 
> portwho 8080
TCP 127.0.0.1:8080
  Process    MyApi (PID 5120)
  Path       C:\Users\me\source\MyApi\bin\Debug\net10.0\MyApi.exe
  Services   none
  Signature  unsigned
Table view All 16 endpoints, as portwho lists them
Proto Address Port PID Process Services Signature Action
UDP 0.0.0.0 123 1880 svchost W32Time Microsoft Corporation
TCP 0.0.0.0 135 1116 svchost RpcEptMapper, RpcSs Microsoft Corporation
TCP :: 135 1116 svchost RpcEptMapper, RpcSs Microsoft Corporation
TCP 0.0.0.0 445 4 System - -
UDP 0.0.0.0 1900 3880 svchost SSDPSRV Microsoft Corporation
TCP 0.0.0.0 5040 6312 svchost CDPSvc Microsoft Corporation
UDP 0.0.0.0 5353 2240 svchost Dnscache Microsoft Corporation
UDP :: 5353 2240 svchost Dnscache Microsoft Corporation
UDP 0.0.0.0 5355 2240 svchost Dnscache Microsoft Corporation
TCP 0.0.0.0 7680 4412 svchost DoSvc Microsoft Corporation
TCP 127.0.0.1 8080 5120 MyApi - unsigned
TCP 0.0.0.0 49664 1004 lsass (access denied) KeyIso, SamSs -
TCP 0.0.0.0 49665 872 wininit - Microsoft Corporation
TCP 0.0.0.0 49666 1672 svchost EventLog Microsoft Corporation
TCP 0.0.0.0 49667 2244 svchost Schedule Microsoft Corporation
TCP 0.0.0.0 49668 3020 spoolsv Spooler Microsoft Corporation

01 · Utility Forge

Four tools. One line from question to answer.

Each tool answers one question about Windows and makes the path to the answer visible. They ship one at a time, in a fixed order, and a tool gets a download only when an approved release exists.

  1. In development

    PortWho

    Which process owns port 8080?

    Find out exactly which process or Windows service owns a TCP or UDP port.

    1. Port
    2. Process
    3. Executable
    4. Services
    5. Signature

    Network Free Read-only

  2. In development

    FileScope

    What is this file, really?

    Tell me what this file actually is, without executing or uploading it.

    1. File
    2. Metadata
    3. Identity
    4. Findings

    Files Free Read-only

  3. In development

    Tidy

    How do I organise Downloads without losing anything?

    Safely organise messy folders such as Downloads, with a preview and an undo.

    1. Files
    2. Proposed organisation
    3. Preview
    4. Confirmed operation

    Files Free

  4. In development

    NetDoctor

    Why is my internet not working?

    Tell me why my network or internet connection is failing.

    1. Symptoms
    2. Diagnostics
    3. Evidence
    4. Explanation

    Network Free Read-only

02 · Our red lines

Lines we don’t cross.

The name is a promise. These are struck out of every tool we publish, permanently.

  • Bundled software

    A download contains the tool and nothing else. No toolbars, no offers, no “recommended” extras.

  • Telemetry

    Nothing phones home. The tools work offline and keep working if this site disappears.

  • Forced accounts

    Every tool is free to use without signing in. No licence keys, activation or online licence check.

  • Optimizer claims

    No “boost your PC”, no registry cleaning, no fear-based warnings.

  • Silent changes

    Read-only first. Anything that changes state previews, validates, logs and offers undo.

  • Unverifiable builds

    Every release is published with SHA-256 checksums and says plainly whether it is signed. Nothing is offered until a release is verified and approved.

03 · Trust, engineered

Built to be checked, not just believed.

The full trust model

Unless otherwise specified, these apply to every tool

  1. Inspect before change. The first tools are read-only. Anything that changes state previews, validates, logs and offers undo where possible.
  2. Least privilege. Tools run as a normal user. Elevation is requested only for the one operation that needs it.
  3. Local first. Core functionality works offline. Signature checks use the local certificate cache.
  4. Verifiable releases. SHA-256 checksums, immutable paths and a stated signed or unsigned status come with every public release. Signed builds carry RFC 3161 timestamps.
  5. Documented like a product. Quick start, concepts, CLI reference, JSON schema and troubleshooting sit next to every tool.
PortWho · revision block · status today
Rev Part Status
A1 Read-only engine IP Helper enumeration, process, service and Authenticode resolution, including exited and reused process IDs. Implemented
A2 Command line (portwho) Table, details and JSON views with filters. Implemented
A3 JSON output (schema v1) Implemented
A4 WPF desktop application (PortWho.exe) Port lookup, filters, details pane, background signature checks, JSON and CSV export. Tested internally; not released. Implemented
A5 Packaging and release verification Reproducible portable ZIPs with SHA-256 sums, a manifest, an independent verifier and tamper tests. Every package so far is an unsigned internal build. Implemented
A6 Windows CI Build, format check, tests and an unsigned internal package on every change. Implemented
C1 Release signing decision No code-signing certificate exists. Free signing is being evaluated; the first x64 release may instead be unsigned, only after an independent rebuild and review and the owner's approval. Planned
C2 Public release Nothing is published or downloadable. Planned

No public release yet

A download appears here only when a verified, checksummed and approved release exists. Anything claiming to be a PortWho download elsewhere is not from us.

System boundary · PortWho Network access: none
PortWho reads the socket tables, processes, the service manager and the local certificate cache inside your PC. The path to the internet is cut: no data leaves the machine. YOUR PC · LOCAL ONLY Socket tables Processes Service manager Local certificate cache PortWho READ-ONLY 0 bytes out NET

No telemetry · no account · no update check in today's builds · revocation lookups disabled

04 · Guides and documentation

Fix it by hand first.

Guides that work without any of our tools, written from the same investigation the tools automate.

All guides

  1. How-to · 14 min

    Inspect a suspicious file with built-in Windows tools

    An attachment or download you do not trust? Find out what it really is without opening it: the real name and type, its SHA-256, its Authenticode signature and its Mark-of-the-Web, using only PowerShell and File Explorer, and learn what each result does not prove.

  2. How-to · 7 min

    Find what is using port 8080 on Windows

    Your dev server says port 8080 is already in use. Find the process behind it with netstat, tasklist and PowerShell, learn what the listening addresses mean, and free the port without breaking something else.

  3. How-to · 8 min

    Organise Downloads safely without a cleanup utility

    Sort a cluttered Downloads folder into category folders with PowerShell, without losing or overwriting anything: inventory the files, build and review a move plan, catch name collisions, confirm each move, keep a record and undo it if needed.

05 · Publisher

An independent publisher with an engineering standard.

RedLine is the publisher behind Utility Forge. The tools are designed and built by Mundoin in Germany: a neutral publisher brand with a real, accountable person behind it.

Source code, CI workflows and the product blueprint are in a private repository. They are not publicly accessible.

About RedLine Explore PortWho