Lesson 6 of 7 · 6 min

The folder tells the story

A port becomes easier to understand when you can see the working directory. That folder usually reveals the project, tool, or database that launched the listener.

What you'll learn

  • The mental model
  • Find the process first
  • Find the folder

Process names are often too generic.

node does not tell you which JavaScript project is running.

python3 does not tell you whether the process is FastAPI, Django, a notebook, or a temporary file server.

java does not tell you which application it belongs to.

The folder often tells the truth.

The mental model

A process has a current working directory. That directory is usually where the command was launched.

For developer tools, that folder often reveals the project.

Example:

/Users/you/Documents/projects/mappster
/Users/you/Documents/projects/wallmarkets
/Users/you/Documents/Codex/localhost-explorer

If two ports are both owned by node, the folder may be the only obvious difference.

Find the process first

For a specific port:

lsof -nP -iTCP:3000 -sTCP:LISTEN

Example:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    48217 you   21u  IPv4 ...        TCP 127.0.0.1:3000 (LISTEN)

The PID is 48217.

Find the folder

On macOS, run:

lsof -a -p 48217 -d cwd

Example output:

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    48217 you  cwd    DIR   ...           /Users/you/Documents/projects/mappster

That cwd line is the current working directory.

Now the vague process becomes specific:

node on port 3000

turns into:

node on port 3000 from /Users/you/Documents/projects/mappster

That is much more useful.

Also inspect the command

The folder tells you where. The command tells you how.

ps -p 48217 -o pid,ppid,user,stat,comm,args

You might see:

node ./node_modules/.bin/vite --host 127.0.0.1

or:

python3 -m uvicorn app.main:app --port 8000

or:

python3 manage.py runserver 127.0.0.1:8000

The folder plus command usually gives you the full story.

Why this matters

Without the folder, you may stop the wrong project.

Maybe you have three apps open:

mappster      -> localhost:3000
wallmarkets   -> localhost:3001
sciencebo     -> localhost:5173

If you only look at process names, they may all be node.

If you look at folders, the answer becomes obvious.

When folder is misleading

The working directory is a strong clue, not a legal contract.

Some services start from a generic folder. Some apps change directories. Some launchers hide the original project path.

If the folder is not enough, combine it with:

ps -p <PID> -o pid,ppid,user,stat,comm,args

and parent inspection:

ps -p <PPID> -o pid,ppid,user,stat,comm,args

The more clues agree, the more confident you can be.