lsof commands

19 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 19 shown

  • List open files by process
    lsof -p $(pgrep nginx) | head -30

    Show all files (sockets, regular, pipes) opened by nginx

    linux · debug

  • Who is using a port
    lsof -i :8080

    Find which process is listening on port 8080

    linux · network · debug

  • List all network connections
    lsof -i -n -P

    Show all open network connections without DNS resolution

    linux · network

  • Find open files on a filesystem
    lsof +D /var/log

    Show all processes with open files under /var/log

    linux · debug

  • Find deleted files still held open
    lsof | grep '(deleted)'

    Find files deleted but still held open by processes (disk bloat)

    linux · debug

  • ss: show listening sockets
    ss -tlnp

    Show TCP listening ports with process names

    linux · network

  • ss: show all TCP connections
    ss -tanp | grep ESTAB

    Filter established TCP connections with process info

    linux · network

  • ss: show UDP sockets
    ss -ulnp

    List UDP listening ports with process names

    linux · network

  • ss: socket stats summary
    ss -s

    Print socket usage summary by state

    linux · network · monitoring

  • ss: filter by destination port
    ss -tnp dst :443

    Show connections going TO port 443

    linux · network

  • Find owner of port
    lsof -nP -i :<port>

    Show which process owns a port; -nP skips DNS/service name lookups for speed

    network · troubleshooting · debug

  • All listening sockets
    lsof -nP -iTCP -sTCP:LISTEN

    List every TCP listener with PID, no name resolution; modern: ss -ltnp

    network · monitoring · troubleshooting

  • Deleted open files
    lsof +L1

    Find unlinked files still held open eating disk; df shows full but du does not

    disk · troubleshooting · debug

  • Who holds a file before umount
    lsof /mnt/<name>

    Reveal processes blocking a 'device busy' umount; pass the mountpoint path

    disk · troubleshooting · debug

  • Free a stuck port
    lsof -t -i:<port> | xargs -r kill

    Kill whatever owns a port; -t prints bare PIDs, -r avoids running kill on empty input

    network · troubleshooting · debug

  • Detect CLOSE_WAIT leaks
    lsof -nP -i -sTCP:CLOSE_WAIT

    Spot sockets the app forgot to close; growing CLOSE_WAIT = fd/connection leak

    network · performance · troubleshooting

  • Connections to remote host
    lsof -nP -i @<host>:<port>

    Show only sockets talking to a specific peer host/port, both ends matched

    network · monitoring · debug

  • Binaries and libs of a PID
    lsof -p <pid> -a -d txt,mem

    Show only mapped executable and shared libs; -a ANDs the filters, great after a deploy

    debug · troubleshooting · performance

  • Count open fds of a PID
    lsof -nP -p <pid> | wc -l

    Quick fd count to spot leaks vs ulimit -n; faster: ls /proc/<pid>/fd | wc -l

    performance · troubleshooting · debug