Use of lsof Command in Linux

lsof command stands for “List Of Open File”, used to report a list of all open files and the processes that opened them. With one go it lists out all open files in output console.
lsof command is used to show that which file is open by which process.It does not list only regular files but we can list a directory, a character special file, an internet socket, a block special file, a regular pipe, a shared library, a named pipe and many others. In this blog, you gonna learn the use of lsof command.

Syntax:

$lsof [option][user name]

If “lsof” is not working on your system, simple run following command in order to install it.

dnf install -y lsof

List all open files

Run following command to list all open files.

lsof

Command: The name of the command associated with the process that opened the file.
PID: Process ID of the process that opened the file.
TID: Task or thread Identification number. If its blank it means it’s not a task it’s a process.
User: User ID or the owner name of the process.
FD: Shows file descriptor of the file.
Type: type of node associated with the file.
Device: Contains device numbers.
Size/Off: Shows the size of the file in bytes.
Node: Shows the node number of a local file.
Name: Shows the name of the mount point and file system on which the file placed.

List Files Opened By a User

Following command will show the list of all opened files of user “nabeel”

lsof -u nabeel

List all Network Connections

lsof -i

List files based on IPv4 Address

lsof -i 4

List files based on IPv6 Address

lsof -i 6

List Processes of TCP Specific Port

To show all running process of a specific port, we need to use -i option with lsof command. In following command we gonna show running process of port 22.

lsof -i TCP:22

List Processes of TCP Ports range

Following command will show all files processes from port 500 to port 1024

lsof -i TCP:500-1024

Let’s check who is Looking Which Files and Commands

lsof -i -u nabeel

List files by PID

Following command will show you who is running on process 989

lsof -p 989

To get more details about the lsof command you can check man pages by running command “man lsof“