Open a cache of riches with lsof
With Great Power
Now imagine a scenario in which you've found a file in /tmp
and have no idea where this potentially dangerous file has come from. To find all the processes using this file, you could run the lsof
command in Listing 3.
Listing 3
Finding Processes
As requested, lsof quickly reports the results, as seen in Figure 9.
Around in circles you go: By looking up what lsof knows about PID 14332:
# lsof -p 14332
you reveal a mountain of information (too much to display) relating to the word processor LibreOffice. Therefore, it's most likely not a file to be worried about but instead a temporary copy of a document being written.
Open Up and Lock Down
Now I want to look for open files. I'm running my desktop off a loop disk [1], and I can query all the open files on that (filesystem) device with:
# lsof /dev/loop0
The resulting output scrolls up my screen for a full two seconds with screeds of information. I can also request to list only Unix sockets with:
# lsof -U
Although I've already looked at a specific network port, what about querying all open network ports? Try running this simple command:
# lsof -i
With that entered, my system reports some useful security issues (ports that can be closed down because they're not needed or in use at all), as well as full hostnames, not just IP addresses (listed using DNS so I can immediately tell what my system is connecting to as I type), and which user, which PID, and which commands are responsible for spawning the process to open that port. Figure 10 shows this concisely. You can also see the port that you're connecting to if you look closely. For example, the first ESTABLISHED connection shown (Figure 10, right-hand side near the bottom) is using the remote port 5228.
If that doesn't meet your needs, you can switch off DNS lookups with -n
and just show port numbers without the names with -P
:
# lsof -n -i -P
Checking everything, in the sense of all ports using any protocol, that a remote host is doing is one of my favorite lsof commands:
# lsof -i @another-chris-server.tld
Additional features just keep coming; you can mix up one host with multiple ports or, in this case, a range of ports:
# lsof -i @another-chris-server.tld::5228-6502
Also, you can gain visibility of which files use which file descriptors for every process,
# lsof -d 111,34,67
or simply comma-separate a list of descriptors for a more fine-grained output.
Belly of the Beast
A little more background might increase your understanding of how lsof achieves its powerful output. According to the man page, the magical lsof procures its power from four main files.
It draws information from both the kernel virtual memory device, /dev/kmem
(which isn't present on my desktop, although it appears in linux-headers
) and the physical memory device, /dev/mem
. According to the mem
man page, "The file kmem is the same as mem, except that the kernel virtual memory rather than physical memory is accessed."
The command lsof also references the system swap file, conveniently found at /dev/swap
, and a cache generated partly from a gethostname
lookup.
In other words, it's a busy little utility, and whereas other tools can claim to harvest much of the information held within these ever-changing system files there's certainly an argument that lsof pulls it altogether the most gracefully.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.