System
lsof CLI
lsof commands for listing open files and network connections.
28 commands
Windows
MacOS
Linux
#process
#file-descriptors
Basic Usage
List all open files on the system
lsof
List open files by a specific user
lsof -u username
List files opened by a command name
lsof -c nginx
List files opened by a specific PID
lsof -p 1234
List open files in a directory
lsof +D /var/log
Network Connections
List all network connections
lsof -i
List processes using port 80
lsof -i :80
List processes using a port range
lsof -i :8080-9090
List all TCP connections
lsof -i tcp
List all UDP connections
lsof -i udp
List connections to a specific host
lsof -i @192.168.1.1
List all listening TCP ports
lsof -i tcp -s tcp:listen
File System
Show who has a file open
lsof /var/log/syslog
List all open files under a directory
lsof +D /tmp
List open files on a mounted filesystem
lsof +f -- /mnt/usb
List processes with specific file descriptors
lsof -d 0-2
Process Filtering
Exclude files opened by root
lsof -u ^root
List files by multiple commands
lsof -c nginx -c apache
List files by multiple PIDs
lsof -p 1234,5678
Combine user and network filters
lsof -u alice -a -i tcp
Advanced
Output only PIDs for port 3000
lsof -t -i :3000
Kill process using port 8080
kill -9 $(lsof -t -i :8080)
Repeat listing every 2 seconds
lsof -r 2 -i :80
Show network without name resolution
lsof -n -P -i
Machine-readable PID output
lsof -F p -i :22
Quick Commands
List processes using port 80
lsof -i :80
List all files opened by a specific process
lsof -p <pid>
Output only PIDs of processes using a port
lsof -t -i :<port>