View Network Connections

Lsof is commonly used to find the name and number of files opened by an application. It can be used to find out where a specific application Records log data or is tracking a problem.
The syntax format of lsof is:

Lsof [Options] filename

List of common parameters:

Lsof filename displays all processes that open the specified file

Lsof-A indicates that the result is displayed only when both parameters are met.

Lsof-C string displays all open files of the process whose command column contains the specified characters.

Lsof-u Username: displays the files opened by the user process

Lsof-g gid: displays the processes that belong to the GID.

Lsof + D/DIR/displays files opened by processes in the directory

Lsof + D/DIR/is the same as above, but all directories under the directory will be searched for a relatively long time

Lsof-d fd displays the process of the specified file descriptor

Lsof-N does not convert the IP address to the hostname. The-N parameter is not added by default.

Lsof-I is used to display qualified Processes

Lsof-I [46] [Protocol] [@ hostname | hostaddr] [: Service | Port]

46 --> IPv4 or IPv6

Protocol --> TCP or UDP

Hostname --> Internet host name

Hostaddr --> IPv4 address

Service --> service name in/etc/service (more than one)

Port --> port number (either)

For example, check the current running status of port 22.

# Lsof-I: 22

Command PID user FD type device size node name

Sshd 1409 root 3u ipv6-5678 tcp *: SSH (Listen)

View the TXT file opened by the root user process:

# Lsof-a-u root-D txt

Netstat-APN
View all processes and port usage.

2. netstat
The netstat command displays network connection, route table, and network interface information, allowing you to know which network connections are currently in operation.
-A displays all sockets, including those being monitored.

-C is re-displayed every one second until the user interrupts it.

-I displays information of all network interfaces in the same format as "ifconfig-e ".

-N is replaced by a network IP address to show network connection conditions.

-R displays the core route table in the same format as "route-e ".

-T shows the TCP connection status.

-U: displays the connections of the UDP protocol.

-V: displays ongoing work.