Skip to main content

Overview

psys monitors network processes and connections in real-time using Linux’s ss command-line utility. Data is automatically refreshed every 5 seconds to provide live updates.

Data Collection

psys uses two ss commands to gather network information:

Listening Ports (ss -tlnp)

The -tlnp flags stand for: tcp, listening sockets, numeric addresses (no DNS lookup), process information.

Established Connections (ss -tnp)

The -tnp flags capture: tcp, numeric addresses, process information for established connections.

Parsing ss Output

psys uses regular expressions to parse the ss command output:

Listener Regex

This captures:
  • Local address and port
  • Process name
  • PID (process ID)

Established Connection Regex

This captures:
  • Local address and port
  • Remote (peer) address and port
  • Process name
  • PID

Data Structure

The collected data is structured into two main types:

Listener Type

Connection Type

Process Information Retrieval

psys reads additional process information from the /proc filesystem:

Process Name

Command Line

Reading from /proc requires appropriate permissions. psys gracefully handles permission errors.

Process Icon Detection

psys automatically detects the type of process and assigns appropriate icons:

Supported Icon Types

Node.js

node, mainthread processes

Next.js

next processes

Redis

redis processes or port 6379

MongoDB

mongo processes or port 27017

PostgreSQL

postgres, psql processes or port 5432

MySQL

mysql, mariadb processes or port 3306

Apache

apache, httpd processes or port 80

SSH

ssh, sshd processes or port 22

Generic

All other processes

Known Service Detection

When the process name is unknown ("?"), psys falls back to port-based service detection:

Address Interpretation

psys provides human-readable descriptions for listening addresses:

Auto-Refresh Polling

The dashboard automatically refreshes data every 5 seconds:
You can manually trigger a refresh at any time using the Refresh button in the header.