Mastering lsof: List Open Files, Processes, and Network Connections on Linux

lsof (list open files) is a command‑line utility that displays information about files opened by processes on Linux, where everything—including pipes, sockets, directories, and devices—is treated as a file.

1. lsof Overview

Running # lsof shows all open files for all active processes. The output includes columns such as COMMAND, PID, USER, FD, TYPE, DEVICE, SIZE/OFF, NODE, and NAME.

# lsof

COMMAND  PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 8,1 4096 2 / ...

Key columns:

cwd – current working directory

txt – program text (code) file

mem – memory‑mapped file

mmap – memory‑mapped device

NUMBER – actual file descriptor; suffixes like 1u indicate mode (r read, w write, u read/write).

TYPE indicates the file type, e.g., REG (regular file), DIR (directory), FIFO (named pipe), CHR (character device).

2. List Processes Opening a Specific File

Provide a filename to list only processes that have that file open:

# lsof /var/log/syslog

3. List Files Opened Under a Directory

Use +D to list processes with files open under a directory (recursively). Use +d for a non‑recursive listing:

# lsof +D /var/log

4. List Files Opened by Process Name

Use -c followed by a string to match the beginning of process names. Multiple -c switches can be combined:

# lsof -c ssh -c init

5. Find Processes Using a Mount Point

When a mount point is busy, list processes using it: # lsof /home Or recursively:

# lsof +D /home/

6. List Files Opened by a Specific User

Use -u to filter by user: # lsof -u lakshmanan To list all users except one, prefix the username with ^:

# lsof -u ^lakshmanan

7. List All Files Opened by a Specific PID

# lsof -p 1753

8. Kill All Processes Belonging to a User

Combine -t (output only PIDs) with kill:

# kill -9 `lsof -t -u lakshmanan`

9. Combine List Options with OR/AND

Multiple options are ORed by default. Use -a to require all conditions (AND):

# lsof -u lakshmanan -c init -a

10. Repeating Mode

Use -r or +r to repeat the listing at intervals. +r stops when no files are found; -r continues until interrupted.

# lsof -u lakshmanan -c init -a -r5
===
...output...
===

Finding Network Connections

Network sockets are also files, so lsof can list them.

11. List All Network Connections

# lsof -i

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
avahi-daemon 515 avahi 13u IPv4 6848 0t0 UDP *:mdns
...

Use -i4 or -i6 to limit to IPv4 or IPv6.

12. List Network Files Used by a Specific Process

# lsof -i -a -p 234

13. List Processes Listening on a Specific Port

# lsof -i :25

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
exim4 2541 Debian-exim 3u IPv4 8677 TCP localhost:smtp (LISTEN)

14. List All TCP or UDP Connections

# lsof -i tcp; lsof -i udp

15. List All NFS Files

# lsof -N -u lakshmanaan -a