Hide

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

OpenID

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Hide

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

» all commands
» commands with 3 up-votes (commandlinefu3)
» commands with 10 up-votes (commandlinefu10)
» commands tagged lsof

Hide

News

2011-03-12 - Confoo 2011 presentation: Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands: To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner: Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed: Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.

Hide

Functions

Hide

Credits

Site by David Winterbottom (user root).

Commands tagged lsof

Terminal - Commands tagged lsof - 30 results

lsof -i -n | grep ESTABLISHED

2013-04-03 09:14:09

User: techie

Functions: grep

Tags: grep netstat lsof tcp connections

Up
Down

find established tcp connections without using netstat!!

Fast and easy way to find all established tcp connections without using the netstat command.

Comments (1) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

watch "lsof -i -P |grep ESTABLISHED |awk '{printf \"%15.15s \\t%s\\n\", \$1, \$9}'"

2013-04-03 02:04:11

User: skarfacegc

Functions: watch

Tags: lsof watch networking awk grep

Up
Down

What addresses are your applications talking to?

Shows which applications are making connections, and the addresses they're connecting to. Refreshes every 2 seconds (watch's default). Test on OSX, should work anywhere watch and lsof work.

lsof -ni TCP

2013-03-20 22:51:16

User: tsener

Tags: lsof

Up
Down

Open Port Check

also could specify port number:

lsof -ni TCP:80

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof -i -P +c 0 +M | grep -i "$1"

2013-03-19 10:42:15

User: opexxx

Functions: grep

Tags: grep lsof

Up
Down

identify active network connections

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

watch -d=c -n3 'lsof -itcp -iudp -c php'

2013-03-14 01:24:50

User: AskApache

Functions: watch

Tags: lsof PHP watch

Up
Down

Watch your websites php

Shows files and processes of the command php

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof +c 15 | awk '{print $1}' | sort | uniq -c | sort -rn | head

2012-05-25 16:31:46

User: SEJeff

Functions: awk sort uniq

Tags: Linux lsof

Up
Down

Top 15 processes with the largest number of open files

See the summary.

lsof -Pi | grep LISTEN

2011-10-03 12:50:18

User: 5partan

Functions: grep

Tags: lsof networking

-2

Up
Down

check open ports (both ipv4 and ipv6)

This option is much faster, as it checks only network nodes.

lsof -i

2011-10-03 02:06:30

User: shsingh

Tags: lsof networking

-1

Up
Down

check open ports (both ipv4 and ipv6)

This option selects the listing of all Internet and x.25 (HP-UX) network files.

netstat -plntu

2011-10-01 12:16:38

User: bolthorn0

Functions: netstat

Tags: netstat lsof networking

Up
Down

check open ports (both ipv4 and ipv6)

Check open TCP and UDP ports

netstat -plnt

2011-09-30 19:56:32

User: DopeGhoti

Functions: netstat

Tags: netstat lsof networking

Up
Down

check open ports (both ipv4 and ipv6)

While `lsof` will work, why not use the tool designed explicitly for this job?

(If not run as root, you will only see the names of PID you own)

lsof -Pn | grep LISTEN

2011-09-29 18:21:51

User: pykler

Functions: grep

Tags: lsof networking

Up
Down

check open ports (both ipv4 and ipv6)

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof +D <dirname>

2011-09-18 00:01:25

User: ztank1013

Tags: lsof umount

Up
Down

Discovering all open files/dirs underneath a directory

It may be helpful in case you need to umount a directory and some process is preventing you to do so keeping the folder busy. The lsof may process the +D option slowly and may require a significant amount of memory because it will descend the full dir tree. On the other hand it will neither follow symlinks nor other file systems.

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

watch -n 1 "/usr/sbin/lsof -p PID |awk '/TCP/{split(\$8,A,\":\"); split(A[2],B,\">\") ; split(B[1],C,\"-\"); print A[1],C[1],B[2], \$9}' | sort | uniq -c"

2011-08-12 19:16:38

User: ideivid

Functions: watch

Tags: monitoring lsof

Up
Down

Monitor incoming connections of proxies and balancers.

Maybe this will help you to monitor your load balancers or reverse proxies if you happen to use them. This is useful to discover TIME OUTS and this will let you know if one or more of your application servers is not connected by checking.

lsof -nPi | txt2html > ~/lsof.html | gnome-open lsof.html

2011-07-28 21:59:07

User: hippie

Tags: bash lsof

Up
Down

View internet connection activity in a browser

In addition to generating the current connections, it also opens then in your default browser on gnome.

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof -nPi | txt2html > ~/lsof.html

2011-07-28 14:01:21

User: zlemini

Tags: perl cpan lsof

Up
Down

View internet connection activity in a browser

The output of lsof is piped to txt2html which converts it to html.

# Perl module HTML::TextToHTML needed

lsof -i :22

2011-03-11 16:48:37

User: bucciarati

Tags: netcat lsof nc

Up
Down

determine if tcp port is open

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof | awk '/*:https?/{print $2}' | sort -u

2011-02-04 01:37:17

User: sugitaro

Functions: awk sort

Tags: sort awk lsof

-1

Up
Down

pid list by httpd listen port

% lsof -v

lsof version information:

revision: 4.78

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate

lsof -nP -c COMMAND | egrep -o '(TCP|UDP).*$' | sort -u

2011-01-25 12:04:13

User: forcefsck

Functions: egrep sort

Tags: egrep lsof udp tcp

Up
Down

Display any udp/tcp connections by process name or by process id

Where COMMAND is the process(es) name. I prefer to get all states but you may add ESTABLISHED in the grep regex.

lsof -c apache2 | egrep -o 'TCP.*ESTABLISHED.*$'

-nP flags are optional and UDP is irrelevant for established connections

Similar but using the process id:

lsof -nP -p PID | egrep -o '(TCP|UDP).*$'

lsof /folder

2010-09-06 05:10:06

User: dotanmazor

Tags: lsof umount

Up
Down

Show which process is blocking umount (Device or resource is busy)

Instead of using force un-mounting, it's better to find the processes that currently use the relevant folder.

Taken from:

http://www.linuxhowtos.org/Tips%20and%20Tricks/findprocesses.htm

lsof /dev/snd/pcm*p /dev/dsp | awk ' { print $2 }' | xargs kill

2010-07-23 20:24:16

User: alustenberg

Functions: awk xargs

Tags: awk flash xargs kill sound lsof alsa

Up
Down

give me back my sound card

for when a program is hogging the sound output. finds, and kills. add -9 to the end for wedged processes. add in 'grep ^program' after lsof to filter.

lsof -Pan -i tcp -i udp

This is sample output - yours may be different.

COMMAND     PID        USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
nmbd       1381        root   10u  IPv4 37683465      0t0  UDP *:137
nmbd       1381        root   13u  IPv4 37683466      0t0  UDP *:138
nmbd       1381        root   14u  IPv4 37683468      0t0  UDP 192.168.1.66:137
nmbd       1381        root   15u  IPv4 37683469      0t0  UDP 192.168.1.66:138
nmbd       1381        root   16u  IPv4 37683470      0t0  UDP 192.168.1.6:137
nmbd       1381        root   17u  IPv4 37683471      0t0  UDP 192.168.1.6:138
smbd       1384        root   25u  IPv6 37683528      0t0  TCP *:445 (LISTEN)
smbd       1384        root   26u  IPv6 37683530      0t0  TCP *:139 (LISTEN)
smbd       1384        root   27u  IPv4 37683532      0t0  TCP *:445 (LISTEN)
smbd       1384        root   28u  IPv4 37683534      0t0  TCP *:139 (LISTEN)
portmap    1642      daemon    4u  IPv4     4146      0t0  UDP *:111
portmap    1642      daemon    5u  IPv4     4161      0t0  TCP *:111 (LISTEN)
rpc.statd  1658       statd    4u  IPv4     4186      0t0  UDP *:986
rpc.statd  1658       statd    6u  IPv4     4195      0t0  UDP *:50215
rpc.statd  1658       statd    7u  IPv4     4198      0t0  TCP *:37962 (LISTEN)
cupsd      1689        root    5u  IPv4 51957733      0t0  TCP *:631 (LISTEN)
cupsd      1689        root   16u  IPv6 51957734      0t0  TCP *:631 (LISTEN)
cupsd      1689        root   18u  IPv4 51957737      0t0  UDP *:631
dhclient   2031        root    5u  IPv4     5307      0t0  UDP *:68
apache2    2093        root    4u  IPv6     5480      0t0  TCP *:80 (LISTEN)
avahi-dae  2281       avahi   13u  IPv4     5670      0t0  UDP *:5353
avahi-dae  2281       avahi   14u  IPv6     5671      0t0  UDP *:5353
avahi-dae  2281       avahi   15u  IPv4     5672      0t0  UDP *:60574
avahi-dae  2281       avahi   16u  IPv6     5673      0t0  UDP *:37378
hddtemp    2705        root    0u  IPv4     6851      0t0  TCP 127.0.0.1:7634 (LISTEN)
dhclient   3115        root    5u  IPv4    10765      0t0  UDP *:68
exim4     13674 Debian-exim    4u  IPv4 45844908      0t0  TCP 127.0.0.1:25 (LISTEN)
sshd      26220        root    3u  IPv4 16151998      0t0  TCP *:22 (LISTEN)
sshd      26220        root    4u  IPv6 16152000      0t0  TCP *:22 (LISTEN)
apache2   30313    www-data    4u  IPv6     5480      0t0  TCP *:80 (LISTEN)
apache2   30316    www-data    4u  IPv6     5480      0t0  TCP *:80 (LISTEN)

2010-06-07 15:22:44

User: atoponce

Tags: netstat lsof

Up
Down

Lists all listening ports together with the PID of the associated process

This command is more portable than it's cousin netstat. It works well on all the BSDs, GNU/Linux, AIX and Mac OS X. You won't find lsof by default on Solaris or HPUX by default, but packages exist around the web for installation, if needed, and the command works as shown. This is the most portable command I can find that lists listening ports and their associated pid.

lsof | grep pcm

2010-05-16 12:12:01

User: Miles

Functions: grep

Tags: sound lsof process

Up
Down

List processes playing sound

When trying to play a sound you may sometimes get an error saying that your sound card is already used, but not by what process. This will list all processes playing sound, useful to kill processes that you no longer need but that keep using your sound card.

lsof -p $(pidof firefox) | awk '/.mozilla/ { s = int($7/(2^20)); if(s>0) print (s)" MB -- "$9 | "sort -rn" }'

2010-01-13 22:45:53

User: tzk

Functions: awk pidof

Tags: sort awk firefox lsof

Up
Down

Check which files are opened by Firefox then sort by largest size.

Just refining last proposal for this check, showing awk power to make more complex math (instead /1024/1024, 2^20). We don't need declare variable before run lsof, because $(command) returns his output. Also, awk can perform filtering by regexp instead to call grep. I changed the 0.0000xxxx messy output, with a more readable form purging all fractional numbers and files less than 1 MB.

lsof -P -i -n | cut -f 1 -d " "| uniq | tail -n +2

2009-09-19 21:23:54

User: edo

Functions: cut tail uniq

Tags: bash grep lsof internet

Up
Down

Show apps that use internet connection at the moment.

show only the name of the apps that are using internet

FFPID=$(pidof firefox-bin) && lsof -p $FFPID | awk '{ if($7>0) print ($7/1024/1024)" MB -- "$9; }' | grep ".mozilla" | sort -rn

2009-08-16 08:58:22

User: josue

Functions: awk grep pidof sort

Tags: sort awk grep firefox lsof

Up
Down

Check which files are opened by Firefox then sort by largest size.

Check which files are opened by Firefox then sort by largest size (in MB). You can see all files opened by just replacing grep to "/". Useful if you'd like to debug and check which extensions or files are taking too much memory resources in Firefox.

1 2 >