Mastering the lsof Command: A Comprehensive Guide

In the world of Linux system administration and cybersecurity, lsof (List Open Files) is an indispensable tool for investigating what processes are interacting with the system's files, devices, and network sockets. Despite its name, lsof goes beyond just files—it can reveal active network connections, identify which process is using a specific port, or even help detect malicious activity. Understanding how to use it effectively is a key skill for both troubleshooting and security analysis.

Understanding lsof

In Unix-like systems, everything is treated as a file—from regular text files to directories, devices, sockets, and pipes. The lsof command lists all open files and the processes that opened them. This is valuable because it gives administrators a real-time map of system activity, helping them pinpoint resource usage, locate configuration issues, and monitor suspicious behaviors.

Installing lsof

On most modern Linux distributions, lsof comes pre-installed. If it's missing, you can install it using your package manager:

# On Debian/Ubuntu
sudo apt install lsof
 
# On CentOS/RHEL
sudo yum install lsof

Basic Usage

Running lsof without arguments lists all open files:

lsof

Since the output can be massive, it's common to combine it with filtering options.

Commonly Used Options

1. Find processes using a specific file

lsof /var/log/syslog

Shows which process has /var/log/syslog open—useful for log monitoring.

2. Identify processes on a specific port

lsof -i :443

Reveals which process is using port 443 (HTTPS).

3. Show network connections

lsof -i

Lists all processes with network connections.

4. Filter by protocol

lsof -iTCP
lsof -iUDP

Shows only TCP or UDP connections.

5. Find files opened by a user

lsof -u john

Displays all files opened by the user john.

6. List files opened by a specific PID

lsof -p 1234

Lists files opened by process with PID 1234.

7. Exclude a user

lsof -u ^root

Shows all open files not owned by root.

Real-World Use Cases

1. Troubleshooting “Port Already in Use” Errors

When a service fails to start because a port is in use:

sudo lsof -i :8080

This reveals the PID of the process using port 8080, allowing you to stop it or reconfigure the service.

2. Detecting Suspicious Network Activity

If you suspect malware or unauthorized access:

sudo lsof -i

Review active connections, looking for unexpected IP addresses or services.

3. Finding Deleted Files Still in Use

Sometimes a large file is deleted but still occupies disk space because a process holds it open:

sudo lsof | grep deleted

This helps you identify the process so you can stop it and reclaim space.

4. Forensic Analysis

Security teams use lsof to quickly see which files a compromised process accessed:

sudo lsof -p <pid>

Output Breakdown

The default lsof output columns include:

Column	Meaning
COMMAND	The name of the process.
PID	Process ID.
USER	Process owner.
FD	File descriptor (e.g., `cwd`, `txt`, `mem`, `0u`).
TYPE	Type of node (e.g., `REG`, `DIR`, `CHR`, `FIFO`).
DEVICE	Device numbers.
SIZE/OFF	Size or offset of the file.
NODE	Inode number.
NAME	Name of the file or resource.

Best Practices

Run with sudo for complete results—some processes are hidden from regular users.
Filter aggressively to avoid huge outputs; target specific PIDs, users, or ports.
Combine with other tools like grep, awk, and netstat for deeper analysis.
Use in scripts for automated monitoring or forensic evidence gathering.

Security Considerations

Because lsof exposes detailed system activity, it requires proper permissions and should only be used by trusted administrators. In the wrong hands, it can help attackers map the system's active services and processes.

Conclusion

The lsof command is a powerful, versatile tool for system administrators, developers, and cybersecurity professionals. From diagnosing stubborn “file in use” errors to detecting unauthorized activity, it gives you an unmatched view of the system's internals. Learning how to filter and interpret its output will not only make you a better troubleshooter but also a more vigilant security practitioner.