################################################################################
lsof 사용법
################################################################################
——————————————————————————–
FD – stands for File descriptor and may seen some of the values as:
——————————————————————————–
cwd current working directory
rtd root directory
txt program text (code and data)
mem memory-mapped file

r for read access.
w for write access.
u for read and write access.

——————————————————————————–
TYPE – of files and it’s identification.
——————————————————————————–
DIR – Directory
REG – Regular file
CHR – Character special file.
FIFO – First In First Out

——————————————————————————–
List User Specific Opened Files
——————————————————————————–
lsof -u tecmint

——————————————————————————–
Find Processes running on Specific Port
——————————————————————————–
lsof -i TCP:22

——————————————————————————–
List Only IPv4 & IPv6 Open Files
——————————————————————————–
# lsof -i 4

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc
rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954
rpcbind 1203 rpc 8u IPv4 11331 0t0 TCP *:sunrpc (LISTEN)
avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns
avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600

# lsof -i 6

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 9u IPv6 11333 0t0 UDP *:sunrpc
rpcbind 1203 rpc 10u IPv6 11335 0t0 UDP *:954
rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 1277 rpcuser 10u IPv6 11858 0t0 UDP *:55800
rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN)
cupsd 1346 root 6u IPv6 12112 0t0 TCP localhost:ipp (LISTEN)

——————————————————————————–
Search by PID
——————————————————————————–
lsof -p 1

——————————————————————————–
Kill all Activity of Particular User
——————————————————————————–
# kill -9 `lsof -t -u tecmint`

——————————————————————————–
List Open Files of TCP Port ranges 1-1024
——————————————————————————–
lsof -i TCP:1-1024

——————————————————————————–
Exclude User with ‘^’ Character
——————————————————————————–
lsof -i -u^root

——————————————————————————–
Find Out who’s Looking What Files and Commands
——————————————————————————–
# lsof -i -u tecmint

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 1839 tecmint cwd DIR 253,0 12288 15 /etc
ping 2525 tecmint cwd DIR 253,0 12288 15 /etc

——————————————————————————–
List all Network Connections
——————————————————————————–
lsof -i

——————————————————————————–
List opened files under a directory
——————————————————————————–
lsof +D /var/log/

——————————————————————————–
List opened files based on process names starting with
——————————————————————————–
lsof -c ssh -c init

——————————————————————————–
List processes using a mount point
——————————————————————————–
lsof /home
@@ The following will also work.
lsof +D /home/

——————————————————————————–
List all open files by a specific process
——————————————————————————–
lsof -p 1753

——————————————————————————–
Combine more list options using OR/AND
——————————————————————————–
@@ -c 는 COMMAND를 의미
lsof -u lakshmanan -c init

——————————————————————————–
List processes which are listening on a particular port
——————————————————————————–
lsof -i :25

——————————————————————————–
List all TCP or UDP connections
——————————————————————————–
lsof -i tcp; lsof -i udp;