lsof Command in Linux: Syntax, Options & Practical Examples (Ubuntu)

lsof lists open files, directories, devices, and network sockets for running processes on Linux. Admins use it to find which process holds a port, a log file, or a deleted-but-still-open path.

Published Nov 18, 2021

Updated Jul 1, 2026

Author Rohan Timalsina

Read time 9 min read

Reviewed Jul 1, 2026 byDeepak Prasad

About	lsof lists open files, directories, devices, and network sockets for running processes on Linux. Admins use it to find which process holds a port, a log file, or a deleted-but-still-open path.
Tested on	Ubuntu 25.04 (Plucky Puffin); lsof 4.99.4; kernel 7.0.0-27-generic
Package	lsof (apt/deb) · lsof (dnf/rpm)
Man page	lsof(8)
Privilege	none (sees all processes on this host by default)
Distros	Most Linux distributions (lsof package). Socket-focused listing: ss or netstat.

lsof — quick reference

Selection by process or user

Narrow the listing to one user, command, or PID. Prefix with ^ to exclude.

When to use	Command
All open files (can be very long)	`lsof`
Files opened by a user	`lsof -u USER`
Exclude one user	`lsof -u ^USER`
Files opened by processes whose command starts with NAME	`lsof -c ssh`
Files opened by a specific PID	`lsof -p PID`
Exclude a PID	`lsof -p ^PID`
Terse output — PIDs only, no header	`lsof -t`

Network sockets

Filter by protocol, address, or port. Combine with -iTCP and state filters.

When to use	Command
All IPv4 network files	`lsof -i4`
All IPv6 network files	`lsof -i6`
TCP sockets only	`lsof -iTCP`
UDP sockets only	`lsof -iUDP`
Sockets on port 22 (service name or number)	`lsof -i :22`
Listening TCP sockets	`lsof -iTCP -sTCP:LISTEN`
UNIX domain sockets	`lsof -U`

Paths and directories

When to use	Command
Files opened under a directory tree (can be slow)	`lsof +D /path`
Files with a path in the NAME column	`lsof /var/log/syslog`

Output format

When to use	Command
Numeric hosts (no DNS)	`lsof -n`
Numeric ports (no service names)	`lsof -P`
Numeric hosts and ports together	`lsof -n -P`
Show UID numbers instead of login names	`lsof -l`
Include parent PID column	`lsof -R`
Avoid blocking kernel calls on stale mounts	`lsof -b`

Help and version

When to use	Command
Show usage	`lsof -h`
Show lsof version	`lsof -v`

lsof — command syntax

Synopsis from lsof -h on Ubuntu 25.04 (lsof 4.99.4):

text


lsof [-?abhHKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-E] [+|-e s] [+|-f[gG]]
     [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
     [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]

lsof reads /proc and reports what processes have open. It does not close files or kill processes. On Ubuntu 25.04, unprivileged users can list all processes' files.

lsof — command examples

Essential Which process listens on TCP ports

When a port is in use, lsof maps the listening socket to a command — similar to ss -tlnp but from the file-descriptor view.

Run the command:

bash

lsof -iTCP -sTCP:LISTEN

Sample output:

text


COMMAND    PID            USER  FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd      1            root 261u  IPv4  11755      0t0  TCP *:ssh (LISTEN)
systemd      1            root 262u  IPv6  11757      0t0  TCP *:ssh (LISTEN)
cupsd     1436            root   7u  IPv4  13830      0t0  TCP localhost:ipp (LISTEN)
sshd      1472            root   3u  IPv4  11755      0t0  TCP *:ssh (LISTEN)

The NAME column shows the local endpoint; LISTEN is the TCP state.

Essential Find what is using port 22

A focused check when SSH fails to bind or you see an unexpected listener on port 22.

Run the command:

bash

lsof -i :22

Sample output:

text


COMMAND    PID USER  FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd      1 root 261u  IPv4  11755      0t0  TCP *:ssh (LISTEN)
systemd      1 root 262u  IPv6  11757      0t0  TCP *:ssh (LISTEN)
sshd      1472 root   3u  IPv4  11755      0t0  TCP *:ssh (LISTEN)
sshd      1472 root   4u  IPv6  11757      0t0  TCP *:ssh (LISTEN)

Multiple lines can reference the same socket through systemd socket activation and sshd.

Essential List open files for one user (-u)

See everything one account has open — useful on multi-user servers.

Run the command:

bash

lsof -u root | head -8

Sample output:

text


COMMAND PID USER  FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd   1 root cwd       DIR              252,0     4096          2 /
systemd   1 root rtd       DIR              252,0     4096          2 /
systemd   1 root txt       REG              252,0   137680    1058070 /usr/lib/systemd/systemd
systemd   1 root mem       REG              252,0  3063024    1058074 /usr/lib/systemd/libsystemd-shared-257.so

Pipe to less or add -c COMMAND when the list is long.

Run ssh as in the example below; the ssh command is a quick reference for syntax, flags, and troubleshooting.

Common Files opened by ssh processes (-c)

The -c selector matches the beginning of the command name — here, SSH-related daemons and sessions.

Run the command:

bash

lsof -c ssh | head -8

Sample output:

text


COMMAND    PID USER  FD   TYPE             DEVICE SIZE/OFF    NODE NAME
sshd      1472 root cwd    DIR              252,0     4096       2 /
sshd      1472 root rtd    DIR              252,0     4096       2 /
sshd      1472 root txt    REG              252,0   469976 1058158 /usr/sbin/sshd
sshd      1472 root mem    REG              252,0  3063024 1058074 /usr/lib/systemd/libsystemd-shared-257.so

Add -a to AND selections — for example lsof -a -c nginx -u www-data.

Common Numeric hosts and ports (-n -P)

Skip DNS and /etc/services lookups so scripts parse addresses reliably.

Run the command:

bash

lsof -n -P -i4 | head -8

Sample output:

text


COMMAND    PID            USER  FD   TYPE DEVICE SIZE/OFF NODE NAME
systemd      1            root 261u  IPv4  11755      0t0  TCP *:22 (LISTEN)
systemd-r  338 systemd-resolve  15u  IPv4   4856      0t0  TCP 127.0.0.53:53 (LISTEN)
cupsd     1436            root   7u  IPv4  13830      0t0  TCP 127.0.0.1:631 (LISTEN)
sshd      1472            root   3u  IPv4  11755      0t0  TCP *:22 (LISTEN)

Port 22 appears as a number instead of the service name ssh.

Common Open files under a directory (+D)

Find which processes keep files open under /tmp or a mount you need to unmount.

Run the command:

bash

lsof +D /tmp | head -8

Sample output:

text


COMMAND    PID         USER  FD   TYPE             DEVICE SIZE/OFF  NODE NAME
VBoxDRMCl 2203         root   6u  unix 0xffff89d2859c8000      0t0 17426 /tmp/.iprt-localipc-DRMIpcServer type=STREAM (LISTEN)
gnome-ses 3234 golinuxcloud  11u  unix 0xffff89d2884a8000      0t0 19982 /tmp/.ICE-unix/3234 type=STREAM (LISTEN)

+D walks the full directory tree and can be slow on large paths — use +d for one level only.

Common All open files for PID 1 (-p)

Inspect every descriptor held by one process — often the first step before restarting a stuck daemon.

Run the command:

bash

lsof -p 1 | head -8

Sample output:

text


COMMAND PID USER  FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd   1 root cwd       DIR              252,0     4096          2 /
systemd   1 root rtd       DIR              252,0     4096          2 /
systemd   1 root txt       REG              252,0   137680    1058070 /usr/lib/systemd/systemd
systemd   1 root mem       REG              252,0  3063024    1058074 /usr/lib/systemd/libsystemd-shared-257.so

Compare FD numbers with /proc/PID/fd/ when you need the exact symlink target.

Advanced Terse PID list (-t)

-t prints only PIDs — handy for piping into kill or loop processing.

Run the command:

bash

lsof -t -i :22 | head -5

Sample output:

Each number is a process with port 22 open. Verify before sending signals.

Advanced UNIX domain sockets (-U)

Local IPC sockets (Docker, DB sockets, X11, systemd) show up here — not in plain netstat -t.

Run the command:

bash

lsof -U | head -8

Sample output:

text


COMMAND    PID             USER  FD   TYPE             DEVICE SIZE/OFF  NODE NAME
systemd      1             root  10u  unix 0xffff89d2b5aead00      0t0 24700 /run/systemd/journal/stdout type=STREAM (CONNECTED)
systemd      1             root  23u  unix 0xffff89d28bae8900      0t0  4267 type=DGRAM (CONNECTED)
systemd      1             root  24u  unix 0xffff89d28abdcd80      0t0  4268 type=DGRAM (CONNECTED)

The NAME column shows the filesystem path or abstract socket name.

Advanced Avoid blocking on stale NFS (-b)

When lsof hangs on an unreachable mount, -b skips kernel calls that might block.

Run the command:

bash

lsof -b | head -5

Sample output:

text


lsof: avoiding readlink(/sys): -b was specified.
lsof: avoiding stat(/sys): -b was specified.
lsof: WARNING: can't stat() sysfs file system /sys
      Output information may be incomplete.
COMMAND PID USER  FD      TYPE DEVICE SIZE/OFF NODE NAME

Output may be incomplete, but the command returns instead of hanging.

lsof — when to use / when not

Use lsof when	Use something else when
You need to know which process has a file, log, device, or socket open A port is busy and you want the owning command and PID You cannot unmount a filesystem because files are still open You are tracking deleted files still held open (space not freed until close)	You only need a table of connection states and queues → ss You want to kill processes using a file or mount → fuser You are scanning remote hosts → nmap Full-tree `+D` on huge directories is too slow → narrow with `-c`, `-p`, or path arguments

lsof vs ss

	lsof	ss
Primary view	Open files and FDs per process	Kernel socket table
Network focus	`-i` filters among all file types	Built for sockets
Non-network files	Yes (logs, dirs, devices)	No
Speed on many sockets	Can be slower	Optimized for sockets

Use lsof when the question is "who has this path or port open?" Use ss when the question is "what connections exist and in what state?"

Command	One line
lsof	Open files and sockets by process (this page)
ss	Socket states and filters
netstat	Legacy socket listing
strace	Trace system calls including open()

Browse the full index in our Linux commands reference.

lsof — interview corner

What does lsof stand for and what does it do?

lsof means list open files. On Linux, almost everything is a file — regular files, directories, pipes, devices, and sockets. lsof walks process file descriptors and prints who holds what.

bash

lsof -i :22

A strong answer is:

"lsof lists open file descriptors per process — including network sockets via -i. I use it to find which PID owns a port or a busy file."

How do you find deleted files still using disk space?

If someone deletes a large log while an app still has it open, the blocks stay allocated until the process closes the FD. Look for (deleted) in the NAME column or search under the mount.

bash

lsof +L1

A strong answer is:

"Deleted but open files show (deleted) in lsof. The space returns when the process closes the file or exits — or I truncate via /proc/PID/fd if policy allows."

lsof vs fuser?

lsof lists details — command, user, FD type, path. fuser focuses on which processes use a path and can send signals with -k.

A strong answer is:

"lsof gives rich detail on open files and sockets. fuser answers 'who is using this path' and can kill them — I pick based on whether I need info or action."

How does the -i network filter work?

-i selects internet and network files. Syntax: [46][protocol][@host][:port]. Examples: lsof -iTCP, lsof -i :443, lsof -i @192.168.0.4.

bash

lsof -iTCP -sTCP:LISTEN

A strong answer is:

"The -i option filters network sockets by protocol, host, and port. I combine it with -sTCP:LISTEN for listening ports or :PORT for a specific service."

What is the difference between +d and +D?

+d lists processes that opened files in a single directory (non-recursive). +D recurses into subdirectories — more complete but slower on large trees.

A strong answer is:

"+d is one directory level; +D walks the whole tree. I use +D when unmount fails and I need every open file under the mount path."

Troubleshooting

Symptom	Likely cause	Fix
`lsof` hangs	Stale NFS or FUSE mount	Retry with `-b`; fix or unmount bad mount
Warnings about `fuse.gvfsd-fuse`	Desktop FUSE mounts	Usually safe to ignore on workstations
Empty result for a known port	Wrong selector syntax	Try `lsof -i :PORT` or `lsof -iTCP -sTCP:LISTEN`
Permission denied on some PIDs	Other user's private `/proc`	Run with `sudo` on hardened systems
Very slow `+D /`	Full filesystem walk	Narrow path or use `-c`/`-p` filters

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

lsof — quick reference

Selection by process or user

Network sockets

Paths and directories

Output format

Help and version

lsof — command syntax

lsof — command examples

lsof — when to use / when not

lsof vs ss

Related commands

lsof — interview corner

Troubleshooting

Search GoLinuxCloud