List Opening Files

Watch Network Service Activity in Real-time

lsof -i

Show apps that use internet connection at the moment

lsof -P -i -n

Open Port Check

lsof -ni TCP

Capture all files that is being used by a package

lsof -c screen

To list all IPv4 network files

lsof -i4

To list all IPv6 network files

lsof -i6

To list all open sockets

lsof -i

To list all listening ports

lsof -Pnl -i4TCP -sTCP:LISTEN

To find which program is using the port 80

lsof -iTCP:80

To list all connections to a specific host

lsof -i@192.168.1.1

To list all processes accessing a particular file/directory

lsof <path>

To list all files open for a particular user

lsof -u <username>

To list all files/network connections a command is using

lsof -c sshfs

Show listening tools

lsof -nP -iTCP -sTCP:LISTEN

Show ip-addresses connected to a port

lsof -nP -iTCP:443 -sTCP:LISTEN

Show ip-addresses connected to a port by ip-number

lsof -iTCP -sTCP:LISTEN -P -n

Kill all Activity of Particular User

kill -9 `lsof -t -u username`

List open files that have no links to them on the filesystem

lsof +L1

Show apps that use internet connection at the moment.

lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2

List processes with established tcp connections (without netstat)

lsof -i -n | grep ESTABLISHED

List files opened by a pid

lsof -p <pid>

Check open ports without netstat or lsof

declare -a array=($(tail -n +2 /proc/net/tcp | cut -d":" -f"3"|cut -d" " -f"1")) && for port in ${array[@]}; do echo $((0x$port)); done

Determine if tcp port is open

lsof -i :22

Find size in megabyte of files that are deleted but still in use and therefore consumes diskspace

lsof -ns | grep REG | grep deleted | awk '{s+=$7} END {printf "%.2f MB\n", s/1024/1024}'

Show top running processes by the number of open filehandles they have

lsof | awk '{print $1}' | sort | uniq -c | sort -rn | head

Check open ports (both ipv4 and ipv6)

lsof -Pn | grep LISTEN

List all opened ports on host

lsof -P -i -n -sTCP:LISTEN

List Active Listening Ports for Firewall Configuration

lsof -nP -i | awk '{print $9, $8, $1}' | sed 's/.*://' | sort -u

Show Disk Space Still Used by Deleted Files (Per Process)

lsof -ns | grep REG | grep deleted | awk '{a[$1]+=$7;}END{for(i in a){printf("%s %.2f MB\n", i, a[i]/1048576);}}'

List all the files that have been deleted while they were still open

lsof | egrep "^COMMAND|deleted"

To find the count of each open file on a system (that supports losf)

lsof | awk '{printf("%s %s %s\n", $1, $3, $NF)}' | grep -v "(" | sort -k 4 | gawk '$NF==prv{ct++;next} {printf("%d %s\n",ct,$0);ct=1;prv=$NF}' | uniq | sort -nr

Find out which directories in /home have the most files currently open

lsof |awk ' {if ( $0 ~ /home/) print substr($0, index($0,"/home") ) }'|cut -d / -f 1-4|sort|uniq -c|sort -bgr