lsof Cheatsheet

# List all open files
lsof

# Count open files
lsof | wc -l

# Open files for a specific file
lsof /var/log/syslog

# Open files in a directory
lsof +D /var/log/

# Repeat every N seconds
lsof -r 2            # every 2 sec

# Output format
COMMAND  PID  USER  FD  TYPE  DEVICE  SIZE  NODE  NAME

# All network files
lsof -i

# Specific port
lsof -i :8080
lsof -i :80,443

# TCP only / UDP only
lsof -i tcp
lsof -i udp

# Specific protocol + port
lsof -i tcp:3000

# IPv4 / IPv6 only
lsof -i 4
lsof -i 6

# Connections to a host
lsof -i @192.168.1.1

# LISTEN only (servers)
lsof -i -sTCP:LISTEN

# ESTABLISHED only
lsof -i -sTCP:ESTABLISHED

# By PID
lsof -p 1234

# By process name
lsof -c nginx
lsof -c node

# Multiple processes
lsof -c nginx -c apache

# Exclude a command
lsof -c ^ssh

# Files opened by PID + children
lsof -R -p 1234

# Who has this file open?
lsof /path/to/file

# Deleted but still open files
lsof +L1

# Files opened in directory (recursive)
lsof +D /home/user/

# Files on mounted filesystem
lsof +f -- /mnt/usb

# File descriptor types
cwd   current working dir
rtd   root directory
txt   program text (code)
mem   memory-mapped file
0r    stdin (read)
1w    stdout (write)
2w    stderr (write)

# Files opened by user
lsof -u username

# Exclude a user
lsof -u ^root

# Files by UID
lsof -u 1000

# Multiple users (OR)
lsof -u user1 -u user2

# AND conditions (use -a)
lsof -a -u user1 -i tcp

# What's using port 3000?
lsof -i :3000 -sTCP:LISTEN

# Kill process on port
kill -9 $(lsof -t -i :3000)

# Node.js network activity
lsof -a -c node -i

# Large open files (>1MB)
lsof -s +1048576

# pid-only output (for scripts)
lsof -t -i :8080

# JSON-like output (TSV)
lsof -F pcn -i :80
# p=PID  c=command  n=name