Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Fetching contributors…
Cannot retrieve contributors at this time
48 lines (32 sloc) 1.52 KB
lsof -i
-- Show all connections
lsof -iTCP
-- Show only TCP connections (works the same for UDP)
lsof -i :22
-- -i :port shows all networking related to a given port
lsof -i@
-- To show connections to a specific host, use @host
lsof -i@
-- Show connections based on the host and the port using @host:port
lsof -i| grep LISTEN
-- Grepping for "LISTEN" shows what ports your system is waiting for connections on
lsof -i| grep ESTABLISHED
-- Grepping for "ESTABLISHED" shows current active connections
lsof -u ecable
-- Show what a given user has open using -u
lsof -c syslog-ng
-- See what files and network connections a command is using with -c
lsof /var/log/messages
-- Pointing to a file shows what's interacting with that file
lsof -p 10075
-- The -p switch lets you see what a given process ID has open, which is good for learning more about unknown processes
lsof -t -c Mail
-- The -t option returns just a PID
lsof -a -u ecable -i @
-- Using-a allows you to combine search terms, so the query below says, "show me everything running as daniel connected to"
kill -HUP `lsof -t -c sshd`
-- Using the -t and -c options together you can HUP processes
kill -9 `lsof -t -u daniel`
-- You can also use the -t with -u to kill everything a user has open
lsof +L1
-- lsof +L1 shows you all open files that have a link count less than 1, often indicative of a cracker trying to hide something
Jump to Line
Something went wrong with that request. Please try again.