lsof

What it does

lsof (list open files) enumerates every file descriptor currently open on the system — which, on Unix-like systems, includes not just regular files but directories, network sockets, pipes, and shared libraries too. Each line ties an open file back to the process that holds it, which makes lsof the go-to tool for answering "what has this file/port/ device open" — whether you're trying to unmount a busy filesystem, find what's bound to a port, or track down a file descriptor leak.

Beginner examples

• lsof — list every open file on the system (very long, rarely run bare)
• lsof -u alice — list open files belonging to processes owned by user alice
• lsof -p 1234 — list open files for process ID 1234
• lsof -i :8080 — list processes with a network socket on port 8080

sudo lsof -i :8080

Advanced examples

• Find every process with files open under a directory before unmounting it: lsof +D /mnt/data
• Get just PIDs for scripting (e.g. to kill them): lsof -t -i :3000
• Filter to only TCP sockets in the LISTEN state: lsof -i tcp -sTCP:LISTEN
• Show all open files for processes matching a command name: lsof -c nginx
• Combine filters: list a specific user's open network connections: lsof -u www-data -i

lsof -i tcp -sTCP:LISTEN -n -P

Common mistakes

• Running bare lsof on a busy production server and getting an overwhelming wall of output instead of narrowing with -u, -p, -c, or -i first.
• Forgetting sudo when checking sockets or files owned by other users/processes — without root, lsof can only see your own processes' details for some fields.
• Assuming a port with nothing in lsof -i :PORT means nothing is listening, when actually the process may be running as a different user and needs sudo to be visible.
• Trying to unmount a device that's "busy" without first checking lsof +D /mount/point to see which process is holding it open.

Tips

• Use -t (terse, PID-only output) to feed directly into kill: kill -9 $(lsof -t -i :8080).
• Add -n -P to skip both hostname and port-name resolution when you want fast output and raw numeric addresses/ports.
• lsof -i tcp -sTCP:LISTEN is a quick way to see every listening TCP service on the machine, similar to netstat -tlnp.
• Combine -a with other filters to AND conditions together, e.g. lsof -a -u alice -i shows only alice's network-related open files.

Best practices

• Always narrow scope with a filter (-u, -p, -c, -i, +D) rather than parsing the full unfiltered dump — it's faster and easier to read.
• Run with sudo when investigating system-wide issues so you see other users' and root-owned processes' file descriptors too.
• Use lsof -t in scripts specifically because it's designed for machine consumption (bare PIDs, one per line), unlike the human-readable default format.
• Before force-unmounting or deleting a "busy" resource, confirm with lsof +D or lsof | grep <path> which processes are responsible, so you stop the right thing.

Real-world use cases

• Finding which process is bound to a port that's supposedly free, when a new service fails to start with "address already in use."
• Diagnosing a "too many open files" error by counting a process's open file descriptors with lsof -p <PID> | wc -l and comparing against its ulimit -n.
• Safely unmounting a network share or USB drive by first checking lsof +D /mnt/usb to make sure no process still has files open there.

Common interview questions

• How would you find what process is using a specific port? sudo lsof -i :PORT lists any process with a socket bound to or connected on that port, along with its PID and user.
• How do you find and kill whatever is holding a file or port open? Use lsof -t to get bare PIDs (lsof -t -i :8080) and pipe them into kill, e.g. kill -9 $(lsof -t -i :8080).
• What counts as a "file" in lsof's output besides regular files? Directories, network sockets (TCP/UDP), pipes, shared libraries/memory-mapped files, and device files — lsof treats anything with a file descriptor as an "open file."