Mastering lsof: List Open Files, Processes, and Network Connections on Linux

It is a command‑line utility that lists information about files opened by processes. In Linux everything is a file (pipes, sockets, directories, devices, etc.), so using lsof you can obtain details of any open file.

1. Introduction to lsof

Running lsof without arguments prints all open files for all active processes.

# lsof

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
init       1 root   cwd   DIR   8,1   4096   2   /
...

Each column is self‑explanatory; the article explains the FD (file descriptor) and TYPE columns.

cwd – current working directory

txt – program text (executable)

mem – memory‑mapped file

mmap – memory‑mapped device

NUMBER – actual file descriptor; suffix ‘u’, ‘r’, ‘w’ indicate read/write mode.

TYPE indicates the file type, e.g. REG (regular file), DIR (directory), FIFO (named pipe), CHR (character device).

2. List processes that have a specific file open

Provide a pathname as an argument:

# lsof /var/log/syslog

3. List files opened under a directory

Use +D to list files under a directory recursively, or +d for a non‑recursive listing.

# lsof +D /var/log

4. List files opened by processes matching a name

Use -c followed by a string; multiple -c switches are allowed.

# lsof -c ssh -c init

5. Find processes using a mount point

Useful when a filesystem cannot be unmounted because it is busy.

# lsof /home
# lsof +D /home

6. List files opened by a specific user

Use -u followed by the username.

# lsof -u lakshmanan

7. List files opened by a specific PID

Use -p with the process ID.

# lsof -p 1753

8. Kill all processes belonging to a user

Combine lsof -t -u USER to get PIDs and feed them to kill.

# kill -9 `lsof -t -u lakshmanan`

9. Combine list options with OR/AND

Multiple options are ORed by default; use -a to require all conditions.

# lsof -u lakshmanan -c init          # OR
# lsof -u lakshmanan -c init -a       # AND (no output if no such process)

10. Repeating mode

Use -r or +r to repeat the listing at intervals; +r stops when no files are found.

# lsof -u lakshmanan -c init -a -r5

Finding network connections

Network sockets are also files, so lsof can list them.

11. List all network connections

# lsof -i

12. List network files used by a specific process

# lsof -i -a -p 234
# lsof -i -a -c ssh

13. List processes listening on a specific port

# lsof -i :25

14. List all TCP or UDP connections

# lsof -i tcp
# lsof -i udp

15. List NFS files

# lsof -N -u lakshmanan -a