lsof

stands for list open files

stick figure, distraught: somebody has that file open, WHO IS IT?
lsof, represented by a rectangle with a goofy face: I can tell you!

what lsof tells you

for each open file:

• pid
• file type (regular? directory? FIFO? socket?)
• file descriptor (FD column)
• user
• filename/socket address

-p PID

list the files PID has open

lof /some /dir

list just the open files in some/dir

-i

list open network sockets (sockets are files!)

examples:

• -i -n P (-n & -P mean “don’t resolve host names/ports” [also -Pni])"
• -i : 8080
• -i TCP
• -i -s TCP:LISTEN

find deleted files

$lsof | grep deleted

will show you deleted files!

You can recover open deleted files from proc/<pid>/fd/<fd> (<pid> is the process that opened the file)

netstat

another way to list open sockets on Linux is:

netstat -tunapl (tuna, please!)

On Mac, netstat has different args.