Open a cache of riches with lsof
With Great Power
Now imagine a scenario in which you've found a file in /tmp
and have no idea where this potentially dangerous file has come from. To find all the processes using this file, you could run the lsof
command in Listing 3.
Listing 3
Finding Processes
As requested, lsof quickly reports the results, as seen in Figure 9.

Around in circles you go: By looking up what lsof knows about PID 14332:
# lsof -p 14332
you reveal a mountain of information (too much to display) relating to the word processor LibreOffice. Therefore, it's most likely not a file to be worried about but instead a temporary copy of a document being written.
Open Up and Lock Down
Now I want to look for open files. I'm running my desktop off a loop disk [1], and I can query all the open files on that (filesystem) device with:
# lsof /dev/loop0
The resulting output scrolls up my screen for a full two seconds with screeds of information. I can also request to list only Unix sockets with:
# lsof -U
Although I've already looked at a specific network port, what about querying all open network ports? Try running this simple command:
# lsof -i
With that entered, my system reports some useful security issues (ports that can be closed down because they're not needed or in use at all), as well as full hostnames, not just IP addresses (listed using DNS so I can immediately tell what my system is connecting to as I type), and which user, which PID, and which commands are responsible for spawning the process to open that port. Figure 10 shows this concisely. You can also see the port that you're connecting to if you look closely. For example, the first ESTABLISHED connection shown (Figure 10, right-hand side near the bottom) is using the remote port 5228.
If that doesn't meet your needs, you can switch off DNS lookups with -n
and just show port numbers without the names with -P
:
# lsof -n -i -P
Checking everything, in the sense of all ports using any protocol, that a remote host is doing is one of my favorite lsof commands:
# lsof -i @another-chris-server.tld
Additional features just keep coming; you can mix up one host with multiple ports or, in this case, a range of ports:
# lsof -i @another-chris-server.tld::5228-6502
Also, you can gain visibility of which files use which file descriptors for every process,
# lsof -d 111,34,67
or simply comma-separate a list of descriptors for a more fine-grained output.
Belly of the Beast
A little more background might increase your understanding of how lsof achieves its powerful output. According to the man page, the magical lsof procures its power from four main files.
It draws information from both the kernel virtual memory device, /dev/kmem
(which isn't present on my desktop, although it appears in linux-headers
) and the physical memory device, /dev/mem
. According to the mem
man page, "The file kmem is the same as mem, except that the kernel virtual memory rather than physical memory is accessed."
The command lsof also references the system swap file, conveniently found at /dev/swap
, and a cache generated partly from a gethostname
lookup.
In other words, it's a busy little utility, and whereas other tools can claim to harvest much of the information held within these ever-changing system files there's certainly an argument that lsof pulls it altogether the most gracefully.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.
-
Linux Kernel 6.2 Released with New Hardware Support
Find out what's new in the most recent release from Linus Torvalds and the Linux kernel team.