C.7 lsof Program

The name lsof stands for "list open files." Like tcpdump, it is a publicly available tool that is handy for debugging and has been ported to many versions of Unix.

One common use for lsof with networking is to find which process has a socket open on a specified IP address or port. netstat tells us which IP addresses and ports are in use, and the state of the TCP connections, but it does not identify the process. For example, to find out which process provides the daytime server, we execute the following:

freebsd % lsof -i TCP:daytime
COMMAND   PID USER    FD       TYPE             DEVICE SIZE/OFF NODE NAME
inetd     561 root     5u      IPv4 0xfffff8003027a260      0t0  TCP *:daytime (LISTEN)
inetd     561 root     7u      IPv6 0xfffff800302b6720      0t0  TCP *:daytime

This tells us the command (this service is provided by the inetd server), its PID, the owner, descriptor (5 for IPv4 and 7 for IPv6, and the u means it is open for read/write), type of socket, address of the protocol control block, size or offset of the file (not meaningful for a socket), protocol type, and name.

One common use for this program is when we start a server that binds its well-known port and get the error that the address is already in use. We then use lsof to find the process that is using the port.

Since lsof reports on open files, it cannot report on network endpoints that are not associated with an open file: TCP endpoints in the TIME_WAIT state.

ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/ is the location for this program. It was written by Vic Abell.

Some vendors supply their own utility that does similar things. For example, FreeBSD supplies the fstat program. The advantage in lsof is that it works under so many versions of Unix, and using a single tool in a heterogeneous environment, instead of a different tool for each environment, is a big advantage.