{"id":5113,"date":"2025-12-29T21:31:39","date_gmt":"2025-12-29T12:31:39","guid":{"rendered":"https:\/\/matoken.org\/blog\/?p=5113"},"modified":"2025-12-29T21:31:41","modified_gmt":"2025-12-29T12:31:41","slug":"witr_-why-is-this-running","status":"publish","type":"post","link":"https:\/\/matoken.org\/blog\/2025\/12\/29\/witr_-why-is-this-running\/","title":{"rendered":"\u30d7\u30ed\u30bb\u30b9\u306e\u60c5\u5831\u3092\u308f\u304b\u308a\u3084\u3059\u304f\u8868\u793a\u3057\u3066\u304f\u308c\u308bwitr"},"content":{"rendered":"<div id=\"preamble\">\n<div class=\"sectionbody\">\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"48\" height=\"48\" viewBox=\"0 0 512 512\"><path fill=\"currentColor\" d=\"M18 18v34.924C30.373 40.596 43.205 29.082 56.232 18zm66.443 0C61.258 37.103 38.673 56.716 18 79.066v93.604c35.238-62.356 85.948-121.868 169.047-154.234L186.71 18H84.442zm96.07 22.428C97.444 77.27 50.832 143.66 18 210.878v64.858c11.154.898 21.737 2.696 31.846 5.455c-4.82-7.28-8.926-14.836-11.254-22.258c-3.256-10.382-2.62-22.698-1.78-33.282c.842-10.583 2.317-19.17 2.317-19.17l17.74 3.04s-1.342 7.86-2.114 17.558c-.772 9.7-.545 21.504 1.012 26.467c2.876 9.17 13.302 24.353 23.015 36.187a327 327 0 0 0 4.016 4.79c7.474 4.124 14.704 8.94 21.745 14.48c33.96 26.73 63.706 69.267 99.367 130.902c16.65 6.505 40.976 9.85 64.414 10.405a36 36 0 0 1-2.592-4.486c-4.572-9.458-4.285-22.07 3.704-31.392c7.562-8.826 17.962-18.636 30.61-24.358c5.532-2.503 11.77-4.057 18.153-4.12c.076-.002.15.005.226.005l-18.238-62.606c-3.994-9.02-4.22-18.422-2.325-26.89c1.95-8.702 5.86-16.646 10.035-24.292c8.34-15.268 17.522-29.612 18.94-42.438c2.55-26.62-12.78-47.528-24.22-74.013l-1.08-2.5l.49-2.683c7.444-40.794 33.434-74.835 60.376-109.16c-49.54-4.95-111.124 15.353-158.06 29.514l-7.61 2.297l-3.218-7.27c-4.085-9.22-8.42-17.702-13.002-25.49m119.674 282.926c.112.25.215.503.333.753l-.49-1.293l.158.54zm79.655-258.51a164 164 0 0 0-13.22.51c-21.75 28.594-40.064 56.13-46.23 85.808a219 219 0 0 0 2.495 5.293c24.865-33.377 53.62-65.993 96.406-87.627c-14.438-2.722-27.53-3.96-39.45-3.984zm-156.03 130.77l17.323 4.886c-2.18 7.726.64 20.587 8.457 32.105c7.816 11.52 20.036 21.37 33.588 24.864l-4.494 17.428c-18.755-4.836-34.023-17.498-43.99-32.185c-9.965-14.687-15.22-31.725-10.885-47.098zM353.845 295.67l-4.797 84.873l21.817-62.324l-17.02-22.55zm72.394 29.07l-51.172 66.15s78.346-26.13 82.184-27.158s-31.012-38.992-31.012-38.992m38.672 77.076l-74.24 14.653l76.183 6.735l-1.943-21.39zm-143.662.543c6.196 36.786-13.185 38.92-33.77 42.212c8.924 2.434 37.68 6.205 45.69-6.953c6.452-10.598-5.676-27.313-11.92-35.26zm54.396 42.716l39.526 25.824l44.13-15.67zM18 471v18h476v-18z\"\/><\/svg><!-- game-icons:sniffing-dog --><\/p>\n<div class=\"paragraph\">\n<p>witr (why-is-this-running) \u306f\u30d7\u30ed\u30bb\u30b9\u540d\uff0cPID\uff0c\u30dd\u30fc\u30c8\u756a\u53f7\u304b\u3089\u305d\u308c\u304c\u306a\u305c\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u8abf\u3079\u3066\u8868\u793a\u3057\u3066\u304f\u308c\u307e\u3059\uff0e<\/p>\n<\/div>\n<div class=\"paragraph\">\n<p><span class=\"image\"><img decoding=\"async\" src=\"https:\/\/matoken.org\/blog\/wp-content\/uploads\/2025\/12\/witr-ssh.webp\" alt=\"witr ssh\"><\/span><\/p>\n<\/div>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><a href=\"https:\/\/github.com\/pranshuparmar\/witr\/\">pranshuparmar\/witr: Why is this running?<\/a><\/p>\n<\/li>\n<\/ul>\n<\/div>\n<p><!--more--><\/p>\n<div class=\"paragraph\">\n<p>\u4f8b\u3048\u3070\u4ee5\u4e0b\u306fport 22 \u3092\u8abf\u3079\u3066\u3044\u307e\u3059\uff0esshd \u304c\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u306a\u3069\u304c\u308f\u304b\u308a\u307e\u3059\uff0e<\/p>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"content\">\n<pre>$ sudo .\/witr -port 22\nTarget      : sshd\n\nProcess     : sshd (pid 581)\nUser        : root\nCommand     : sshd: \/usr\/sbin\/sshd -D [listener] 0 of 10-100 startups\nStarted     : 4 days ago (Thu 2025-12-25 18:10:39 +09:00)\n\nWhy It Exists :\n  systemd (pid 1)   sshd (pid 581)\n\nSource      : systemd service (supervisor)\n\nWorking Dir : \/\nListening   : 0.0.0.0:22\n              :::22\n\nWarnings    :\n    Process is listening on a public interface\n    Process is running as root\n    Process is running from a suspicious working directory: \/<\/pre>\n<\/div>\n<\/div>\n<div class=\"paragraph\">\n<p>\u30e1\u30e2\u30ea\u3092\u305f\u304f\u3055\u3093\u4f7f\u3063\u3066\u3044\u308b(1GB+)\u3068\u8b66\u544a\u304c\u8868\u793a\u3055\u308c\u305f\u308a\u3082\u3057\u307e\u3059<\/p>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"content\">\n<pre>$ sudo ~\/usr\/local\/bin\/witr -pid 10522\nTarget      : firefox.real\n\nProcess     : firefox.real (pid 10522) [high-mem]\nUser        : matoken\nCommand     : \/usr\/bin\/firefox.real\nStarted     : 2 days ago (Sat 2025-12-27 05:39:41 +09:00)\n\nWhy It Exists :\n  systemd (pid 1) \u2192 firefox.real (pid 10522)\n\nSource      : systemd service (supervisor)\n\nWorking Dir : \/home\/matoken\n\nWarnings    :\n  \u2022 Process is using high memory (&gt;1GB RSS)<\/pre>\n<\/div>\n<\/div>\n<div class=\"paragraph\">\n<p>\u4ee5\u4e0b\u306f\u30d7\u30ed\u30bb\u30b9ID 524 \u304b\u3089glance \u304ccron \u304b\u3089\u8d77\u52d5\u3057\u3066\u3044\u308b\u306e\u304c\u308f\u304b\u308a\u307e\u3059\uff0e<\/p>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"content\">\n<pre>$ .\/witr -pid 524\nTarget      : glance\n\nProcess     : glance (pid 524) {forked}\nUser        : matoken\nCommand     : \/home\/matoken\/bin\/glance -config \/home\/matoken\/.config\/glance.yml\nStarted     : 4 days ago (Thu 2025-12-25 18:10:36 +09:00)\nRestarts    : 1\n\nWhy It Exists :\n  systemd (pid 1) \u2192 cron (pid 448) \u2192 cron (pid 492) \u2192 sh (pid 523 glance (pid 524)\n\nSource      : systemd service (supervisor)\n\nWorking Dir : \/home\/matoken\nListening   : :::8080\n\nWarnings    :\n    Process is listening on a public interface<\/pre>\n<\/div>\n<\/div>\n<div class=\"paragraph\">\n<p>\u30dd\u30fc\u30c8\u30b9\u30ad\u30e3\u30f3\u3057\u3066open \u3057\u3066\u3044\u308b\u30dd\u30fc\u30c8\u5168\u3066\u306b\u5bfe\u3057\u3066witr \u3092\u5b9f\u884c\u3057\u3066\u307f\u305f\u308a\u3082\uff0e<\/p>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"content\">\n<pre>$ sudo nmap -p 0-65535 localhost | grep open | cut -f1 -d\\\/ | xargs -n1 sudo .\/witr -port<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"sect1\">\n<h2 id=\"_witr_\u306e\u5c0e\u5165\">witr \u306e\u5c0e\u5165<\/h2>\n<div class=\"sectionbody\">\n<div class=\"paragraph\">\n<p>witr \u306e\u5c0e\u5165\u306finstall.sh \u304c\u304a\u3059\u3059\u3081\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3042\u307e\u308a\u597d\u307f\u306e\u65b9\u6cd5\u3067\u306f\u3042\u308a\u307e\u305b\u3093\uff0e\u4e2d\u3092\u898b\u308b\u3068GitHub Releases \u304b\u3089\u74b0\u5883\u306b\u3042\u3063\u305f\u30d0\u30a4\u30ca\u30ea\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\uff0c <code>\/usr\/local\/bin<\/code> \u4ee5\u4e0b\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u3044\u307e\u3059\uff0e\u30d0\u30a4\u30ca\u30ea\u306fLinux amd64, arm64 \u304c\u7528\u610f\u3057\u3066\u3042\u308a\u307e\u3059\uff0e<br \/>\namd64 \u74b0\u5883\u3067\u306b\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u624b\u9806\u3067\u624b\u52d5\u3067\u5c0e\u5165\u3057\u307e\u3057\u305f\uff0e<\/p>\n<\/div>\n<div class=\"admonitionblock note\">\n<table  class=\" table table-hover\" >\n<tr>\n<td class=\"icon\">\n<div class=\"title\">Note<\/div>\n<\/td>\n<td class=\"content\">\nv0.1.1 \u3067macOS amd64\/arm64 \u3082\u8ffd\u52a0\u3055\u308c\u307e\u3057\u305f\uff0e\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"content\">\n<pre>$ wget -c https:\/\/github.com\/pranshuparmar\/witr\/releases\/latest\/download\/witr-linux-amd64 <b class=\"conum\">(1)<\/b>\n$ install -m 755 .\/witr-linux-amd64 ~\/usr\/local\/bin\/witr <b class=\"conum\">(2)<\/b>\n$ which witr\n\/home\/matoken\/usr\/local\/bin\/witr\n$ rm witr-linux-amd64\n$ witr <b class=\"conum\">(3)<\/b>\nUsage: witr [--pid N | --port N | name] [--short] [--tree] [--json] [--warnings] [--no-color] [--env] [--help] [--version]\n  --pid &lt;n&gt;         Explain a specific PID\n  --port &lt;n&gt;        Explain port usage\n  --short           One-line summary\n  --tree            Show full process ancestry tree\n  --json            Output result as JSON\n  --warnings        Show only warnings\n  --no-color        Disable colorized output\n  --env             Show only environment variables for the process\n  --help            Show this help message\n  --version         Show version and exit\n$ witr --version\nwitr v0.1.1 (commit b50f08b, built 2025-12-28)<\/pre>\n<\/div>\n<\/div>\n<div class=\"colist arabic\">\n<ol>\n<li>\n<p>witr \u306e\u6700\u65b0\u306elinux amd64 \u30d0\u30a4\u30ca\u30ea\u7248\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/p>\n<\/li>\n<li>\n<p>\u597d\u307f\u306e\u5834\u6240\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/p>\n<\/li>\n<li>\n<p>USAGE<\/p>\n<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"sect1\">\n<h2 id=\"_linux_armhfarm_32bit_\u3067\u3082\u52d5\u304b\u3059\">Linux armhf(arm 32bit) \u3067\u3082\u52d5\u304b\u3059<\/h2>\n<div class=\"sectionbody\">\n<div class=\"paragraph\">\n<p>Raspberry Pi bookworm armhf \u3067\u3082\u52d5\u304b\u3057\u305f\u3044\u3068\u601d\u3044\u307e\u3059\uff0e<br \/>\nbuild \u3057\u3088\u3046\u3068\u3057\u305f\u3089\u307e\u305agolang \u304c\u53e4\u3044\u3068\u8a00\u308f\u308c\u305f\u306e\u3067\u307e\u305a\u306f\u65b0\u3057\u3044golang \u306e\u5165\u624b\u304b\u3089\uff0e<\/p>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"title\">package\u7248golang \u306f1.23 \u3060\u304c1.25.5+ \u304c\u5fc5\u8981<\/div>\n<div class=\"content\">\n<pre>$ \/usr\/bin\/go build -ldflags \"-X main.version=0.1.0 -X main.commit=$(git rev-parse --short HEAD) -X 'main.buildDate=$(date +%Y-%m-%d)'\" -o witr-linux-arm32 .\/cmd\/witr\ngo: errors parsing go.mod:\n\/home\/matoken\/src\/witr\/go.mod:3: invalid go version '1.25.5': must match format 1.23<\/pre>\n<\/div>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"title\">go.dev \u304b\u3089armv6 \u30d0\u30a4\u30ca\u30ea\u3092\u5165\u624b\u3057\u3066\u30d1\u30b9\u3092\u901a\u3059<\/div>\n<div class=\"content\">\n<pre>$ wget -c https:\/\/go.dev\/dl\/go1.25.5.linux-armv6l.tar.gz <b class=\"conum\">(1)<\/b>\n$ mkdir -p ~\/usr\/local\n$ tar -C ~\/usr\/local -xzf go1.25.5.linux-armv6l.tar.gz <b class=\"conum\">(2)<\/b>\n$ rm go1.25.5.linux-armv6l.tar.gz\n$ PATH=~\/usr\/local\/go\/bin:$PATH <b class=\"conum\">(3)<\/b>\n$ which go\n\/home\/matoken\/usr\/local\/go\/bin\/go\n$ go version <b class=\"conum\">(4)<\/b>\ngo version go1.25.5 linux\/arm\n$ cat &lt;&lt; EOF &gt; hello.go <b class=\"conum\">(5)<\/b>\npackage main\nimport \"fmt\"\nfunc main() {\n\tfmt.Println(\"Hello World\")\n}\nEOF\n$ go run hello.go <b class=\"conum\">(6)<\/b>\nHello World<\/pre>\n<\/div>\n<\/div>\n<div class=\"colist arabic\">\n<ol>\n<li>\n<p>Linux armv6l \u306e\u30d0\u30a4\u30ca\u30ea\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/p>\n<\/li>\n<li>\n<p>\u30a2\u30fc\u30ab\u30a4\u30d6\u3092\u9069\u5f53\u306a\u5834\u6240\u306b\u5c55\u958b<\/p>\n<\/li>\n<li>\n<p>\u30d1\u30b9\u3092\u901a\u3057\u3066\u304a\u304f(\u4e00\u6642\u7684\u306a\u4f8b)<\/p>\n<\/li>\n<li>\n<p>\u30d0\u30fc\u30b8\u30e7\u30f3\u78ba\u8a8d<\/p>\n<\/li>\n<li>\n<p>hello world \u3092\u7528\u610f<\/p>\n<\/li>\n<li>\n<p>\u52d5\u4f5c\u78ba\u8a8d<\/p>\n<div class=\"ulist\">\n<ul>\n<li>\n<p><a href=\"https:\/\/go.dev\/doc\/install\">Download and install &#8211; The Go Programming Language<\/a><\/p>\n<\/li>\n<li>\n<p><a href=\"https:\/\/go.dev\/dl\/\">All releases &#8211; The Go Programming Language<\/a><\/p>\n<\/li>\n<\/ul>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n<div class=\"listingblock\">\n<div class=\"title\">witr \u3092\u30d3\u30eb\u30c9<\/div>\n<div class=\"content\">\n<pre>$ git clone https:\/\/github.com\/pranshuparmar\/witr\/\n$ cd witr\n$ go build -ldflags \"-X main.version=0.1.0 -X main.commit=$(git rev-parse --short HEAD) -X 'main.buildDate=$(date +%Y-%m-%d)'\" -o witr-linux-arm32 .\/cmd\/witr\n$ .\/witr-linux-arm32 --version\nwitr 0.1.0 (commit a2dc413, built 2025-12-28)<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>witr (why-is-this-running) \u306f\u30d7\u30ed\u30bb\u30b9\u540d\uff0cPID\uff0c\u30dd\u30fc\u30c8\u756a\u53f7\u304b\u3089\u305d\u308c\u304c\u306a\u305c\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u304b\u3092\u8abf\u3079\u3066\u8868\u793a\u3057\u3066\u304f\u308c\u307e\u3059\uff0e pranshuparmar\/witr: Why is this runnin [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"webmentions_disabled_pings":false,"webmentions_disabled":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[809,7,6,546,199,1],"tags":[1242,1259],"class_list":["post-5113","post","type-post","status-publish","format-standard","hentry","category-bookworm-raspberry-pi-os","category-debian-linux","category-linux","category-raspberry-pi-os","category-sid","category-1","tag-system-info","tag-witr"],"_links":{"self":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/comments?post=5113"}],"version-history":[{"count":2,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5113\/revisions"}],"predecessor-version":[{"id":5115,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/5113\/revisions\/5115"}],"wp:attachment":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/media?parent=5113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/categories?post=5113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/tags?post=5113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}