Find deleted files still held open

More lsof commands

• ss: show listening sockets
  ss -tlnpcopy

  Show TCP listening ports with process names

• ss: show all TCP connections
  ss -tanp | grep ESTABcopy

  Filter established TCP connections with process info

• ss: show UDP sockets
  ss -ulnpcopy

  List UDP listening ports with process names

• ss: socket stats summary
  ss -scopy

  Print socket usage summary by state

• ss: filter by destination port
  ss -tnp dst :443copy

  Show connections going TO port 443

all 19 lsof commands →