65 lines
1.8 KiB
Markdown
65 lines
1.8 KiB
Markdown
---
|
|
tags: [shell, procedural]
|
|
created: Tuesday, March 04, 2025
|
|
---
|
|
|
|
# lsof
|
|
|
|
`lsof` stands for _list open files_. It lists opened files and the processes
|
|
using them.
|
|
|
|
## Directory
|
|
|
|
```sh
|
|
lsof /home/thomas
|
|
```
|
|
|
|
```
|
|
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
|
|
pipewire 1025 thomas cwd DIR 253,0 4096 7340035 /home/thomas
|
|
wireplumb 1026 thomas cwd DIR 253,0 4096 7340035 /home/thomas
|
|
```
|
|
|
|
## Pass in a pid
|
|
|
|
```sh
|
|
lsof -p 1175
|
|
```
|
|
|
|
```
|
|
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
|
|
at-spi-bu 1175 thomas cwd DIR 253,0 4096 7340035 /home/thomas
|
|
at-spi-bu 1175 thomas rtd DIR 259,2 4096 2 /
|
|
at-spi-bu 1175 thomas txt REG 259,2 26760 1225154 /usr/lib/at-spi-bus-launcher
|
|
```
|
|
|
|
## Networking
|
|
|
|
### List programs using or listening to ports
|
|
|
|
```sh
|
|
lsof -i
|
|
```
|
|
|
|
```
|
|
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
|
|
signal-de 3250 thomas 39u IPv4 149863 0t0 TCP archlinux:44304->ac88393aca5853df7.awsglobalaccelerator.com:https (ESTABLISHED)
|
|
slack 3602 thomas 18u IPv4 138442 0t0 TCP archlinux:57950->ec2-18-169-55-40.eu-west-2.compute.amazonaws.com:https (ESTABLISHED)
|
|
firefox 6177 thomas 147u IPv4 138842 0t0 TCP archlinux:cresco-control->93.243.107.34.bc.googleusercontent.com:https (ESTABLISHED)
|
|
```
|
|
|
|
### Filter by specific port
|
|
|
|
```sh
|
|
lsof -i:22
|
|
lsof -i4:22 # limit to IPv4 addresses
|
|
|
|
```
|
|
|
|
```
|
|
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
|
|
sshd 45448 root 3u IPv4 640237 0t0 TCP *:ssh (LISTEN)
|
|
sshd 45448 root 4u IPv6 640239 0t0 TCP *:ssh (LISTEN)
|
|
sshd 185660 root 4u IPv4 2554538 0t0 TCP static.18.113.203.116.clients.your-server.de:ssh->0542cb12.skybroadband.com:57744 (ESTABLISHED)
|
|
|
|
```
|