Mastering lsof: How to List Open Files and Network Connections on Linux

1. Introduction to lsof

lsof (list open files) is a command‑line utility that displays information about files opened by processes. In Linux, everything is a file (pipes, sockets, directories, devices, etc.), so lsof can reveal details of any open file. # lsof Typical output columns include COMMAND, PID, USER, FD (file descriptor), TYPE, DEVICE, SIZE/OFF, NODE, and NAME. FD values such as cwd, txt, mem, mmap, and numbers with mode letters (r, w, u) indicate the file’s role and access mode.

cwd – current working directory

txt – program text (executable)

mem – memory‑mapped file

mmap – memory‑mapped device

NUMBER – actual file descriptor; suffixes u (read/write), r (read), w (write)

REG – regular file

DIR – directory

FIFO – FIFO (named pipe)

CHR – character special file

2. List processes that opened a specific file

# lsof /var/log/syslog

3. List files opened under a directory

Use +D to list files opened in a directory recursively; +d for a non‑recursive listing.

# lsof +D /var/log/

4. List files opened by process name

# lsof -c ssh -c init

5. List processes using a mount point

# lsof /home

6. List files opened by a specific user

# lsof -u lakshmanan

Prefix the user with ^ to exclude that user.

7. List files opened by a specific PID

# lsof -p 1753

8. Kill all processes belonging to a user that have open files

# kill -9 `lsof -t -u lakshmanan`

9. Combine list options with OR logic (default) or AND logic using -a

Example (OR): list processes of user lakshmanan OR names starting with init: # lsof -u lakshmanan -c init Example (AND): list processes that satisfy both conditions:

# lsof -u lakshmanan -c init -a

10. Repeating mode

Use -r or +r to repeat the listing at intervals; -r continues indefinitely, +r stops when no files are found.

# lsof -u lakshmanan -c init -a -r5

Finding Network Connections

11. List all network connections

# lsof -i

Use -i4 or -i6 to restrict to IPv4 or IPv6.

12. List network files used by a specific process

# lsof -i -a -p 234

13. List processes listening on a specific port

# lsof -i :25

14. List all TCP or UDP connections

# lsof -i tcp
# lsof -i udp

15. List all NFS files

# lsof -N -u lakshmanan -a

These examples demonstrate how lsof can be used for detailed inspection of open files, directories, users, processes, and network sockets on a Linux system.