Introducing Winnom: Know Your Node
Every developer who's lived with Node for more than a week knows the moment. Something is holding :3000. You didn't start it. Or you started it four terminals ago and closed the terminal but not the process. Task Manager shows you eleven node.exe entries, all identically named, all equally useless. You start killing them one by one and hope you didn't just take down the thing you were actually working on.
That's the moment Winnom is built for.
## What it is
Winnom is a lightweight native Windows app that finds every node.exe running on your machine, tells you what each one is actually doing, and lets you end any of them with one click. No Electron, no bundled browser engine, no 200 MB install ā it's a WPF window built on .NET 10 that starts instantly and stays out of your way.
It's available now at winnom.app.
## What it shows you
For every Node process on your system, Winnom surfaces the stuff Task Manager refuses to:
- - What it's serving. Next.js, Vite, Nuxt, NestJS, webpack, nodemon, ts-node, Jest, and the rest of the usual suspects get recognized by fingerprinting the command line. Anything unfamiliar just shows the script file name, so you're never staring at a blank "node.exe" again.
- - Listening ports. Pulled straight from the kernel TCP table ā no scraping
netstatoutput ā so you know exactly which process owns:3000. - - Uptime, CPU, and memory. How long it's been alive, live CPU sampled between refreshes, and working-set memory.
- - Per-process network IO. Bytes up and down, per process (more on the asterisk below).
Up top, the same numbers rolled up across everything: total process count, total CPU, total memory, total throughput. One glance and you know whether your machine is busy or just lying to you.
## Reveal in Explorer
Every row has a š button that opens Explorer right at the folder the process is running out of, highlighting the actual script file when it can find it. It does this by reading the target process's real working directory out of its PEB ā so "which index.js is this one?" finally has an answer.
## End process, and mean it
The red End process button kills the process and its entire child tree. There's a quick confirmation first, because unsaved work is unsaved work and we're not animals.
## The admin asterisk
Per-process network IO comes from an ETW kernel trace session, and opening one of those is a privileged operation. Run Winnom normally and everything works ā except the network numbers, which politely say "needs admin." Launch it as administrator and the network columns light up. Everything else needs no elevation, so you only reach for the elevated launch when you actually care about throughput.
## Built native, on purpose
| Piece | Job |
|---|---|
| Process scanner | Enumerates node.exe, pulls command lines, samples CPU |
| Classifier | Turns a command line into "what it's serving" |
| Port mapper | GetExtendedTcpTable ā listening ports per PID |
| Network monitor | ETW kernel session ā per-PID bytes sent/received |
| Path resolver | Reads the target's working directory from its PEB |
64-bit only ā the PEB-reading bits assume the x64 process layout, and in 2026 that's a bet we're comfortable making.
## Get it
Head to winnom.app to download. It's framework-dependent on the .NET 10 desktop runtime, which you almost certainly already have if you're the kind of person who has eleven stray Node processes.
Stop guessing which one owns the port. Go find out.
ā The CHKDSK Labs team