lsof - LiSt Open Files

lsof is a particularly powerful tool for finding out what files are open by certain users/programs (and since in *nix systems, most everything is a file, that includes pretty much all resources, including network connections).

It can perform most of the tasks you'd use ps or netstat for, and a lot more besides.

This page is based on Daniel Miessler's very useful article over at http:dmiessler.com/study/nix/commands/lsof/ with kind permission from Daniel. ===== Useful examples ===== ==== Show Your Network Connections ==== Show all connections with -i: <code> lsof -i COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME dhcpcd 6061 root 4u IPv4 4510 UDP *:bootpc sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh→192.168.1.5:49901 (ESTABLISHED) </code> Show only TCP connections (works the same for UDP): <code> lsof -iTCP COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh→192.168.1.5:49901 (ESTABLISHED) </code> -i :port shows all networking related to a given port <code> lsof -i :22 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh→192.168.1.5:49901 (ESTABLISHED) </code> To show connections to a specific host, use @host: <code> lsof -i@192.168.1.5 sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh→192.168.1.5:49901 (ESTABLISHED) </code> Show connections based on the host and the port using @host:port <code> lsof -i@192.168.1.5:22 sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh→192.168.1.5:49901 (ESTABLISHED) </code> Grepping for “LISTEN” shows what ports your system is waiting for connections on: <code> lsof -i| grep LISTEN iTunes 400 daniel 16u IPv4 0x4575228 0t0 TCP *:daap (LISTEN) </code> Grepping for “ESTABLISHED” shows current active connections <code> lsof -i| grep ESTABLISHED firefox-b 169 daniel 49u IPv4 0x5af5228 0t0 TCP 1.2.3.3:1863→1.2.3.4:http (ESTABLISHED) </code> ==== Working with Users, Processes, and Files ==== You can also get information on various users, processes, and files on your system using lsof: Show what a given user has open using -u <code> lsof -u daniel – snipped – Dock 155 daniel txt REG 14,2 2798436 823208 /usr/lib/libicucore.A.dylib Dock 155 daniel txt REG 14,2 1580212 823126 /usr/lib/libobjc.A.dylib Dock 155 daniel txt REG 14,2 2934184 823498 /usr/lib/libstdc++.6.0.4.dylib Dock 155 daniel txt REG 14,2 132008 823505 /usr/lib/libgcc_s.1.dylib Dock 155 daniel txt REG 14,2 212160 823214 /usr/lib/libauto.dylib – snipped – </code> See what files and network connections a command is using with -c <code> lsof -c syslog-ng COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 7547 root cwd DIR 3,3 4096 2 / syslog-ng 7547 root rtd DIR 3,3 4096 2 / syslog-ng 7547 root txt REG 3,3 113524 1064970 /usr/sbin/syslog-ng syslog-ng 7547 root mem REG 0,0 0 [heap] syslog-ng 7547 root mem REG 3,3 105435 850412 /lib/libpthread-2.4.so syslog-ng 7547 root mem REG 3,3 1197180 850396 /lib/libc-2.4.so syslog-ng 7547 root mem REG 3,3 59868 850413 /lib/libresolv-2.4.so syslog-ng 7547 root mem REG 3,3 72784 850404 /lib/libnsl-2.4.so syslog-ng 7547 root mem REG 3,3 32040 850414 /lib/librt-2.4.so syslog-ng 7547 root mem REG 3,3 126163 850385 /lib/ld-2.4.so – snipped – </code> Pointing to a file shows what's interacting with that file <code> lsof /var/log/messages COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 7547 root 4w REG 3,3 217309 834024 /var/log/messages </code> The -p switch lets you see what a given process ID has open, which is good for learning more about unknown processes <code> lsof -p 10075 – snipped – sshd 10068 root mem REG 3,3 34808 850407 /lib/libnss_files-2.4.so sshd 10068 root mem REG 3,3 34924 850409 /lib/libnss_nis-2.4.so sshd 10068 root mem REG 3,3 26596 850405 /lib/libnss_compat-2.4.so sshd 10068 root mem REG 3,3 200152 509940 /usr/lib/libssl.so.0.9.7 sshd 10068 root mem REG 3,3 46216 510014 /usr/lib/liblber-2.3.so.0.2.12 sshd 10068 root mem REG 3,3 59868 850413 /lib/libresolv-2.4.so sshd 10068 root mem REG 3,3 1197180 850396 /lib/libc-2.4.so sshd 10068 root mem REG 3,3 22168 850398 /lib/libcrypt-2.4.so sshd 10068 root mem REG 3,3 72784 850404 /lib/libnsl-2.4.so sshd 10068 root mem REG 3,3 70632 850417 /lib/libz.so.1.2.3 sshd 10068 root mem REG 3,3 9992 850416 /lib/libutil-2.4.so – snipped – </code> ==== Advanced Usage ==== Using -a allows you to combine search terms, so the query below says, “show me everything running as daniel connected to 1.1.1.1”: <code> lsof -a -u daniel -i @1.1.1.1 bkdr 1893 daniel 3u IPv6 3456 TCP 10.10.1.10:1234→1.1.1.1:31337 (ESTABLISHED) </code> Using the -t and -c options together you can HUP processes: <code> kill -HUP `lsof -t -c sshd` </code> You can also use the -t with -u to kill everything a user has open: <code> kill -9 `lsof -t -u daniel` </code> lsof +L1 shows you all open files that have a link count less than 1, often indicative of a cracker trying to hide something: <code> lsof +L1 (hopefully nothing) </code>

 
linux/lsof.txt · Last modified: 2010/02/26 10:45 (external edit)
 
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki