diff --git a/loop/port_monitor.go b/loop/port_monitor.go
index 9614db2..105e1e7 100644
--- a/loop/port_monitor.go
+++ b/loop/port_monitor.go
@@ -4,7 +4,10 @@
 	"context"
 	"fmt"
 	"log/slog"
+	"net"
+	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -54,17 +57,27 @@
 }
 
 // updatePortState runs ss and checks for changes in listening ports
+// Falls back to /proc/net/tcp* parsing if ss is not available
 func (pm *PortMonitor) updatePortState(ctx context.Context) {
+	var currentPorts string
+	var err error
+
+	// Try ss command first
 	cmd := exec.CommandContext(ctx, "ss", "-lntu")
 	output, err := cmd.Output()
 	if err != nil {
-		// Log the error but don't fail - port monitoring is not critical
-		slog.DebugContext(ctx, "Failed to run ss command", "error", err)
-		return
+		// ss command failed, try /proc filesystem fallback
+		slog.DebugContext(ctx, "ss command failed, trying /proc fallback", "error", err)
+		currentPorts, err = pm.getListeningPortsFromProc()
+		if err != nil {
+			// Both methods failed - log and return
+			slog.DebugContext(ctx, "Failed to get listening ports", "ss_error", err)
+			return
+		}
+	} else {
+		currentPorts = string(output)
 	}
 
-	currentPorts := string(output)
-
 	pm.mu.Lock()
 	defer pm.mu.Unlock()
 
@@ -140,6 +153,11 @@
 	return result
 }
 
+// UpdatePortState is a public wrapper for updatePortState for testing purposes
+func (pm *PortMonitor) UpdatePortState(ctx context.Context) {
+	pm.updatePortState(ctx)
+}
+
 // GetAllRecentEvents returns a copy of all recent port events
 func (pm *PortMonitor) GetAllRecentEvents() []PortEvent {
 	pm.mu.Lock()
@@ -177,3 +195,150 @@
 
 	return ports
 }
+
+// getListeningPortsFromProc reads /proc/net/tcp and /proc/net/tcp6 to find listening ports
+// Returns output in a format similar to ss -lntu
+func (pm *PortMonitor) getListeningPortsFromProc() (string, error) {
+	var result strings.Builder
+	result.WriteString("Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port\n")
+
+	// Parse IPv4 listening ports
+	if err := pm.parseProc("/proc/net/tcp", "tcp", &result); err != nil {
+		return "", fmt.Errorf("failed to parse /proc/net/tcp: %w", err)
+	}
+
+	// Parse IPv6 listening ports
+	if err := pm.parseProc("/proc/net/tcp6", "tcp", &result); err != nil {
+		// IPv6 might not be available, log but don't fail
+		slog.Debug("Failed to parse /proc/net/tcp6", "error", err)
+	}
+
+	// Parse UDP ports
+	if err := pm.parseProc("/proc/net/udp", "udp", &result); err != nil {
+		slog.Debug("Failed to parse /proc/net/udp", "error", err)
+	}
+
+	if err := pm.parseProc("/proc/net/udp6", "udp", &result); err != nil {
+		slog.Debug("Failed to parse /proc/net/udp6", "error", err)
+	}
+
+	return result.String(), nil
+}
+
+// parseProc parses a /proc/net/* file for listening sockets
+func (pm *PortMonitor) parseProc(filename, protocol string, result *strings.Builder) error {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+
+	lines := strings.Split(string(data), "\n")
+	for i, line := range lines {
+		if i == 0 || strings.TrimSpace(line) == "" {
+			continue // Skip header and empty lines
+		}
+
+		fields := strings.Fields(line)
+		if len(fields) < 4 {
+			continue
+		}
+
+		// Parse socket state (4th field, index 3)
+		stateHex := fields[3]
+		state, err := strconv.ParseInt(stateHex, 16, 32)
+		if err != nil {
+			continue
+		}
+
+		// Check if socket is in LISTEN state (0x0A for TCP) or bound state for UDP
+		isListening := false
+		if protocol == "tcp" && state == 0x0A {
+			isListening = true
+		} else if protocol == "udp" && state == 0x07 {
+			// UDP sockets in state 0x07 (TCP_CLOSE) are bound/listening
+			isListening = true
+		}
+
+		if !isListening {
+			continue
+		}
+
+		// Parse local address (2nd field, index 1)
+		localAddr := fields[1]
+		addr, port, err := pm.parseAddress(localAddr, strings.Contains(filename, "6"))
+		if err != nil {
+			continue
+		}
+
+		// Format similar to ss output
+		result.WriteString(fmt.Sprintf("%s   LISTEN 0      0          %s:%d        0.0.0.0:*\n",
+			protocol, addr, port))
+	}
+
+	return nil
+}
+
+// parseAddress parses hex-encoded address:port from /proc/net files
+func (pm *PortMonitor) parseAddress(addrPort string, isIPv6 bool) (string, int, error) {
+	parts := strings.Split(addrPort, ":")
+	if len(parts) != 2 {
+		return "", 0, fmt.Errorf("invalid address:port format: %s", addrPort)
+	}
+
+	// Parse port (stored in hex, big-endian)
+	portHex := parts[1]
+	port, err := strconv.ParseInt(portHex, 16, 32)
+	if err != nil {
+		return "", 0, fmt.Errorf("invalid port hex: %s", portHex)
+	}
+
+	// Parse IP address
+	addrHex := parts[0]
+	var addr string
+
+	if isIPv6 {
+		// IPv6: 32 hex chars representing 16 bytes
+		if len(addrHex) != 32 {
+			return "", 0, fmt.Errorf("invalid IPv6 address hex length: %d", len(addrHex))
+		}
+		// Convert hex to IPv6 address
+		var ipBytes [16]byte
+		for i := 0; i < 16; i++ {
+			b, err := strconv.ParseInt(addrHex[i*2:(i+1)*2], 16, 8)
+			if err != nil {
+				return "", 0, fmt.Errorf("invalid IPv6 hex: %s", addrHex)
+			}
+			ipBytes[i] = byte(b)
+		}
+		// /proc stores IPv6 in little-endian 32-bit chunks, need to reverse each chunk
+		for i := 0; i < 16; i += 4 {
+			ipBytes[i], ipBytes[i+1], ipBytes[i+2], ipBytes[i+3] = ipBytes[i+3], ipBytes[i+2], ipBytes[i+1], ipBytes[i]
+		}
+		addr = net.IP(ipBytes[:]).String()
+	} else {
+		// IPv4: 8 hex chars representing 4 bytes in little-endian
+		if len(addrHex) != 8 {
+			return "", 0, fmt.Errorf("invalid IPv4 address hex length: %d", len(addrHex))
+		}
+		// Parse as little-endian 32-bit integer
+		addrInt, err := strconv.ParseInt(addrHex, 16, 64)
+		if err != nil {
+			return "", 0, fmt.Errorf("invalid IPv4 hex: %s", addrHex)
+		}
+		// Convert to IP address (reverse byte order for little-endian)
+		addr = fmt.Sprintf("%d.%d.%d.%d",
+			addrInt&0xFF,
+			(addrInt>>8)&0xFF,
+			(addrInt>>16)&0xFF,
+			(addrInt>>24)&0xFF)
+	}
+
+	// Handle special addresses
+	if addr == "0.0.0.0" {
+		addr = "*"
+	} else if addr == "::" {
+		addr = "*"
+	}
+
+	return addr, int(port), nil
+}
diff --git a/loop/port_monitor_test.go b/loop/port_monitor_test.go
index a1dad57..e0f7ff1 100644
--- a/loop/port_monitor_test.go
+++ b/loop/port_monitor_test.go
@@ -2,6 +2,8 @@
 
 import (
 	"context"
+	"os"
+	"strings"
 	"testing"
 	"time"
 )
@@ -203,3 +205,184 @@
 		t.Errorf("Expected 0 recent events since now, got %d", len(recentEvents))
 	}
 }
+
+// TestParseAddress tests the hex address parsing for /proc/net files
+func TestParseAddress(t *testing.T) {
+	pm := NewPortMonitor()
+
+	tests := []struct {
+		name       string
+		addrPort   string
+		isIPv6     bool
+		expectIP   string
+		expectPort int
+		expectErr  bool
+	}{
+		{
+			name:       "IPv4 localhost:80",
+			addrPort:   "0100007F:0050", // 127.0.0.1:80 in little-endian hex
+			isIPv6:     false,
+			expectIP:   "127.0.0.1",
+			expectPort: 80,
+			expectErr:  false,
+		},
+		{
+			name:       "IPv4 any:22",
+			addrPort:   "00000000:0016", // 0.0.0.0:22
+			isIPv6:     false,
+			expectIP:   "*",
+			expectPort: 22,
+			expectErr:  false,
+		},
+		{
+			name:       "IPv4 high port",
+			addrPort:   "0100007F:1F90", // 127.0.0.1:8080
+			isIPv6:     false,
+			expectIP:   "127.0.0.1",
+			expectPort: 8080,
+			expectErr:  false,
+		},
+		{
+			name:       "IPv6 any port 22",
+			addrPort:   "00000000000000000000000000000000:0016", // [::]:22
+			isIPv6:     true,
+			expectIP:   "*",
+			expectPort: 22,
+			expectErr:  false,
+		},
+		{
+			name:      "Invalid format - no colon",
+			addrPort:  "0100007F0050",
+			isIPv6:    false,
+			expectErr: true,
+		},
+		{
+			name:      "Invalid port hex",
+			addrPort:  "0100007F:ZZZZ",
+			isIPv6:    false,
+			expectErr: true,
+		},
+		{
+			name:      "Invalid IPv4 hex length",
+			addrPort:  "0100:0050",
+			isIPv6:    false,
+			expectErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ip, port, err := pm.parseAddress(test.addrPort, test.isIPv6)
+			if test.expectErr {
+				if err == nil {
+					t.Errorf("Expected error but got none")
+				}
+				return
+			}
+
+			if err != nil {
+				t.Errorf("Unexpected error: %v", err)
+				return
+			}
+
+			if ip != test.expectIP {
+				t.Errorf("Expected IP %s, got %s", test.expectIP, ip)
+			}
+
+			if port != test.expectPort {
+				t.Errorf("Expected port %d, got %d", test.expectPort, port)
+			}
+		})
+	}
+}
+
+// TestParseProcData tests parsing of mock /proc/net data
+func TestParseProcData(t *testing.T) {
+	pm := NewPortMonitor()
+
+	// Test TCP data with listening sockets
+	tcpData := `  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
+   0: 0100007F:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0        1
+   1: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0        2
+   2: 0100007F:1F90 0200007F:C350 01 00000000:00000000 00:00000000 00000000     0        0        3`
+
+	var result strings.Builder
+	result.WriteString("Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port\n")
+
+	// Create temp file with test data
+	tmpFile := "/tmp/test_tcp"
+	err := os.WriteFile(tmpFile, []byte(tcpData), 0o644)
+	if err != nil {
+		t.Fatalf("Failed to create temp file: %v", err)
+	}
+	defer os.Remove(tmpFile)
+
+	err = pm.parseProc(tmpFile, "tcp", &result)
+	if err != nil {
+		t.Fatalf("parseProc failed: %v", err)
+	}
+
+	output := result.String()
+	t.Logf("Generated output:\n%s", output)
+
+	// Should contain listening ports (state 0A = LISTEN)
+	if !strings.Contains(output, "127.0.0.1:80") {
+		t.Error("Expected to find 127.0.0.1:80 in output")
+	}
+	if !strings.Contains(output, "*:22") {
+		t.Error("Expected to find *:22 in output")
+	}
+	// Should not contain established connection (state 01)
+	if strings.Contains(output, "127.0.0.1:8080") {
+		t.Error("Should not find established connection 127.0.0.1:8080 in output")
+	}
+}
+
+// TestGetListeningPortsFromProcFallback tests the complete /proc fallback
+func TestGetListeningPortsFromProcFallback(t *testing.T) {
+	pm := NewPortMonitor()
+
+	// This test verifies the method runs without error
+	// The actual files may or may not exist, but it should handle both cases gracefully
+	output, err := pm.getListeningPortsFromProc()
+	if err != nil {
+		t.Logf("getListeningPortsFromProc failed (may be expected if /proc/net files don't exist): %v", err)
+		// Don't fail the test - this might be expected in some environments
+		return
+	}
+
+	t.Logf("Generated /proc fallback output:\n%s", output)
+
+	// Should at least have a header
+	if !strings.Contains(output, "Netid State") {
+		t.Error("Expected header in /proc fallback output")
+	}
+}
+
+// TestUpdatePortStateWithFallback tests updatePortState with both ss and /proc fallback
+func TestUpdatePortStateWithFallback(t *testing.T) {
+	pm := NewPortMonitor()
+	ctx := context.Background()
+
+	// Call updatePortState - should try ss first, then fall back to /proc if ss fails
+	pm.updatePortState(ctx)
+
+	// The method should complete without panicking
+	// We can't easily test the exact behavior without mocking, but we can ensure it runs
+	// Check if any port state was captured
+	pm.mu.Lock()
+	lastPorts := pm.lastPorts
+	pm.mu.Unlock()
+
+	t.Logf("Captured port state (length %d):", len(lastPorts))
+	if len(lastPorts) > 0 {
+		t.Logf("First 200 chars: %s", lastPorts[:min(200, len(lastPorts))])
+	}
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}