This is our ongoing series of Linux commands and in this article, we are going to review lsof command with practical examples. lsof meaning ‘LiSt Open Files’ is used to find out which files are open by which Linux process.
As we all know Linux/Unix considers everything as a file (pipes, sockets, directories, devices, etc). One of the reasons to use the lsof command is when a disk cannot be unmounted as it says the files are being used. With the help of lsof command, we can easily identify the files which are in use.
Table of Contents
1. List All Open Files with lsof Command
In the below example, it will show a long listing of open files some of them are extracted for better understanding which displays the columns like Command, PID, USER, FD, TYPE, etc.
<strong># lsof</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME init 1 root <strong>cwd</strong> <strong>DIR</strong> 253,0 4096 2 / init 1 root <strong>rtd</strong> <strong>DIR</strong> 253,0 4096 2 / init 1 root <strong>txt</strong> <strong>REG</strong> 253,0 145180 147164 /sbin/init init 1 root <strong>mem</strong> <strong>REG</strong> 253,0 1889704 190149 /lib/libc-2.12.so init 1 root 0u <strong>CHR</strong> 1,3 0t0 3764 /dev/null init 1 root <strong>1u</strong> <strong>CHR</strong> 1,3 0t0 3764 /dev/null init 1 root 2u <strong>CHR</strong> 1,3 0t0 3764 /dev/null init 1 root 3r <strong>FIFO</strong> 0,8 0t0 8449 pipe init 1 root 4w <strong>FIFO</strong> 0,8 0t0 8449 pipe init 1 root 5r <strong>DIR</strong> 0,10 0 1 inotify init 1 root 6r <strong>DIR</strong> 0,10 0 1 inotify init 1 root 7u unix 0xc1513880 0t0 8450 socket
Sections and their values are self-explanatory. However, we’ll review FD & TYPE columns more precisely.
FD – stands for a File descriptor and may see some of the values as:
- cwd current working directory
- rtd root directory
- txt program text (code and data)
- mem memory-mapped file
Also in FD column numbers like 1u is actual file descriptor and followed by u,r,w of its mode as:
- r for read access.
- w for write access.
- u for read and write access.
TYPE – of files and it’s identification.
- DIR – Directory
- REG – Regular file
- CHR – Character special file.
- FIFO – First In First Out
2. List User Specific Opened Files
The below command will display the list of all opened files of user tecmint.
<strong># lsof -u tecmint</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1838 tecmint cwd DIR 253,0 4096 2 / sshd 1838 tecmint rtd DIR 253,0 4096 2 / sshd 1838 tecmint txt REG 253,0 532336 188129 /usr/sbin/sshd sshd 1838 tecmint mem REG 253,0 19784 190237 /lib/libdl-2.12.so sshd 1838 tecmint mem REG 253,0 122436 190247 /lib/libselinux.so.1 sshd 1838 tecmint mem REG 253,0 255968 190256 /lib/libgssapi_krb5.so.2.2 sshd 1838 tecmint mem REG 253,0 874580 190255 /lib/libkrb5.so.3.3
3. Find Processes Running on Specific Port
To find out all the running Linux processes of a specific port, just use the following command with option -i. The below example will list all the running processes of port 22.
<strong># lsof -i TCP:22</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1471 root 3u IPv4 12683 0t0 TCP *:ssh (LISTEN) sshd 1471 root 4u IPv6 12685 0t0 TCP *:ssh (LISTEN)
4. List Only IPv4 & IPv6 Open Files
In below example shows only IPv4 and IPv6 network files open with separate commands.
<strong># lsof -i 4</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954 rpcbind 1203 rpc 8u IPv4 11331 0t0 TCP *:sunrpc (LISTEN) avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600 <strong># lsof -i 6</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1203 rpc 9u IPv6 11333 0t0 UDP *:sunrpc rpcbind 1203 rpc 10u IPv6 11335 0t0 UDP *:954 rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN) rpc.statd 1277 rpcuser 10u IPv6 11858 0t0 UDP *:55800 rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN) cupsd 1346 root 6u IPv6 12112 0t0 TCP localhost:ipp (LISTEN)
5. List Open Files of TCP Port Ranges 1-1024
To list all the running process of open files of TCP Port ranges from 1-1024.
<strong># lsof -i TCP:1-1024</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN) cupsd 1346 root 7u IPv4 12113 0t0 TCP localhost:ipp (LISTEN) sshd 1471 root 4u IPv6 12685 0t0 TCP *:ssh (LISTEN) master 1551 root 13u IPv6 12898 0t0 TCP localhost:smtp (LISTEN) sshd 1834 root 3r IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED) sshd 1838 tecmint 3u IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED) sshd 1871 root 3r IPv4 15842 0t0 TCP 192.168.0.2:ssh->192.168.0.1:groove (ESTABLISHED) httpd 1918 root 5u IPv6 15991 0t0 TCP *:http (LISTEN) httpd 1918 root 7u IPv6 15995 0t0 TCP *:https (LISTEN)
6. Exclude User with ‘^’ Character
Here, we have excluded the root user. You can exclude a particular user using ‘^’ with the command as shown above.
<strong># lsof -i -u^root</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954 rpcbind 1203 rpc 8u IPv4 11331 0t0 TCP *:sunrpc (LISTEN) rpcbind 1203 rpc 9u IPv6 11333 0t0 UDP *:sunrpc rpcbind 1203 rpc 10u IPv6 11335 0t0 UDP *:954 rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN) avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600 rpc.statd 1277 rpcuser 5r IPv4 11836 0t0 UDP *:soap-beep rpc.statd 1277 rpcuser 8u IPv4 11850 0t0 UDP *:55146 rpc.statd 1277 rpcuser 9u IPv4 11854 0t0 TCP *:32981 (LISTEN) rpc.statd 1277 rpcuser 10u IPv6 11858 0t0 UDP *:55800 rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN)
7. Find Out who’s Looking What Files and Commands?
The below example shows user tecmint is using commands like ping and /etc directory.
<strong># lsof -i -u tecmint</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 1839 tecmint cwd DIR 253,0 12288 15 /etc ping 2525 tecmint cwd DIR 253,0 12288 15 /etc
8. List all Network Connections
The following command with option ‘-i’ shows the list of all network connections ‘LISTENING & ESTABLISHED’.
<strong># lsof -i</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954 rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN) avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600 rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN) cupsd 1346 root 6u IPv6 12112 0t0 TCP localhost:ipp (LISTEN) cupsd 1346 root 7u IPv4 12113 0t0 TCP localhost:ipp (LISTEN) sshd 1471 root 3u IPv4 12683 0t0 TCP *:ssh (LISTEN) master 1551 root 12u IPv4 12896 0t0 TCP localhost:smtp (LISTEN) master 1551 root 13u IPv6 12898 0t0 TCP localhost:smtp (LISTEN) sshd 1834 root 3r IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED) httpd 1918 root 5u IPv6 15991 0t0 TCP *:http (LISTEN) httpd 1918 root 7u IPv6 15995 0t0 TCP *:https (LISTEN) clock-app 2362 narad 21u IPv4 22591 0t0 TCP 192.168.0.2:45284->www.gov.com:http (CLOSE_WAIT) chrome 2377 narad 61u IPv4 25862 0t0 TCP 192.168.0.2:33358->maa03s04-in-f3.1e100.net:http (ESTABLISHED) chrome 2377 narad 80u IPv4 25866 0t0 TCP 192.168.0.2:36405->bom03s01-in-f15.1e100.net:http (ESTABLISHED)
9. Search by PID
The below example only shows whose PID is 1 [One].
<strong># lsof -p 1</strong> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME init 1 root cwd DIR 253,0 4096 2 / init 1 root rtd DIR 253,0 4096 2 / init 1 root txt REG 253,0 145180 147164 /sbin/init init 1 root mem REG 253,0 1889704 190149 /lib/libc-2.12.so init 1 root mem REG 253,0 142472 189970 /lib/ld-2.12.so
10. Kill all Activity of Particular User
Sometimes you may have to kill all the processes for a specific user. The below command will kill all the processes of the tecmint user.
<strong># kill -9 `lsof -t -u tecmint`</strong>
Note: Here, it’s not possible to give examples of all available options, this guide is only to show how lsof command can be used. You may refer man page of lsof command to know more about it. Please share it if you find this article is useful through our comment box below.
The above is the detailed content of 10 lsof (List of Open Files) Command Examples in Linux. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
5 Best Open Source Mathematical Equation Editors for Linux
Jun 18, 2025 am 09:28 AM
Are you looking for good software to write mathematical equations? If so, this article provides the top 5 equation editors that you can easily install on your favorite Linux distribution.In addition to being compatible with different types of mathema
SCP Linux Command – Securely Transfer Files in Linux
Jun 20, 2025 am 09:16 AM
Linux administrators should be familiar with the command-line environment. Since GUI (Graphical User Interface) mode in Linux servers is not commonly installed.SSH may be the most popular protocol to enable Linux administrators to manage the servers
What is a PPA and how do I add one to Ubuntu?
Jun 18, 2025 am 12:21 AM
PPA is an important tool for Ubuntu users to expand their software sources. 1. When searching for PPA, you should visit Launchpad.net, confirm the official PPA in the project official website or document, and read the description and user comments to ensure its security and maintenance status; 2. Add PPA to use the terminal command sudoadd-apt-repositoryppa:/, and then run sudoaptupdate to update the package list; 3. Manage PPAs to view the added list through the grep command, use the --remove parameter to remove or manually delete the .list file to avoid problems caused by incompatibility or stopping updates; 4. Use PPA to weigh the necessity and prioritize the situations that the official does not provide or require a new version of the software.
Gogo - Create Shortcuts to Directory Paths in Linux
Jun 19, 2025 am 10:41 AM
Gogo is a remarkable tool to bookmark directories inside your Linux shell. It helps you create shortcuts for long and complex paths in Linux. This way, you no longer need to type or memorize lengthy paths on Linux.For example, if there's a directory
Install LXC (Linux Containers) in RHEL, Rocky & AlmaLinux
Jul 05, 2025 am 09:25 AM
LXD is described as the next-generation container and virtual machine manager that offers an immersive for Linux systems running inside containers or as virtual machines. It provides images for an inordinate number of Linux distributions with support
How to create a file of a specific size for testing?
Jun 17, 2025 am 09:23 AM
How to quickly generate test files of a specified size? It can be achieved using command line tools or graphical software. On Windows, you can use fsutilfilecreatenew file name size to generate a file with a specified byte; macOS/Linux can use ddif=/dev/zeroof=filebs=1Mcount=100 to generate real data files, or use truncate-s100M files to quickly create sparse files. If you are not familiar with the command line, you can choose FSUtilGUI, DummyFileGenerator and other tool software. Notes include: pay attention to file system limitations (such as FAT32 file size upper limit), avoid overwriting existing files, and some programs may
NVM - Install and Manage Multiple Node.js Versions in Linux
Jun 19, 2025 am 09:09 AM
Node Version Manager (NVM) is a simple bash script that helps manage multiple Node.js versions on your Linux system. It enables you to install various Node.js versions, view available versions for installation, and check already installed versions.NV
How to install Linux alongside Windows (dual boot)?
Jun 18, 2025 am 12:19 AM
The key to installing dual systems in Linux and Windows is partitioning and boot settings. 1. Preparation includes backing up data and compressing existing partitions to make space; 2. Use Ventoy or Rufus to make Linux boot USB disk, recommend Ubuntu; 3. Select "Coexist with other systems" or manually partition during installation (/at least 20GB, /home remaining space, swap optional); 4. Check the installation of third-party drivers to avoid hardware problems; 5. If you do not enter the Grub boot menu after installation, you can use boot-repair to repair the boot or adjust the BIOS startup sequence. As long as the steps are clear and the operation is done properly, the whole process is not complicated.
