Mastering lsof: Install, Filter, and Decode Open File Descriptors on Linux

The lsof command (list open files) enumerates all open file descriptors (fd) on a Linux system, treating sockets, pipes, and regular files uniformly as file descriptors.

Installation

On many distributions the command is not installed by default. Install it with:

yum install lsof

Basic Usage and Output

Running lsof prints a table with columns such as COMMAND, PID, USER, FD, TYPE, DEVICE, SIZE/OFF, NODE, and NAME. The NAME column shows the actual file, socket, or device path. For example, the output lists processes like systemd, nscd, and a custom imgserver with their respective file descriptors.

Filtering Results

Because the default output can be extensive, pipe it to grep to isolate a specific process, e.g., lsof -i | grep myapp.

To view descriptors for a particular PID, use lsof -p <pid>.

Permission Considerations

lsof only shows information that the current user has permission to read. For processes owned by other users, the rightmost column may display Permission denied , as demonstrated with sshd and bash examples.

Displaying Full Process Names

By default, the COMMAND column truncates names to a limited length. Use the +c option to set a maximum width, e.g., lsof +c 15 to show up to 15 characters. If the value exceeds the built‑in limit, lsof falls back to its default.

Network‑Related Options

Sockets are also file descriptors. To list only network connections, use the -i flag. By default, lsof shows IP addresses and ports using symbolic names; suppress this with -n (numeric IP) and -P (numeric ports). Combining them yields lsof -Pni, which mirrors netstat but with richer fd information.

Examples of Network Output

Images in the original article illustrate the direction of connections and the effect of -Pni on the displayed addresses.

Key Takeaways

Install lsof via the package manager.

Use grep or -p to narrow results.

Be aware of permission restrictions for non‑root processes.

Leverage +c for full command names.

Apply -i, -n, and -P to focus on network sockets.