Lsof is commonly used to find the name and number of files opened by an application. It can be used to find out where a specific application Records log data or is tracking a problem.
The syntax format of lsof is:
Lsof [Options] filename
List of common parameters:
Lsof filename displays all processes that open the specified file
Lsof-A indicates that the result is displayed only when both parameters are met.
Lsof-C string displays all open files of the process whose command column contains the specified characters.
Lsof-u Username: displays the files opened by the user process
Lsof-g gid: displays the processes that belong to the GID.
Lsof + D/DIR/displays files opened by processes in the directory
Lsof + D/DIR/is the same as above, but all directories under the directory will be searched for a relatively long time
Lsof-d fd displays the process of the specified file descriptor
Lsof-N does not convert the IP address to the hostname. The-N parameter is not added by default.
Lsof-I is used to display qualified Processes
Lsof-I [46] [Protocol] [@ hostname | hostaddr] [: Service | Port]
46 --> IPv4 or IPv6
Protocol --> TCP or UDP
Hostname --> Internet host name
Hostaddr --> IPv4 address
Service --> service name in/etc/service (more than one)
Port --> port number (either)
For example, check the current running status of port 22.
# Lsof-I: 22
Command PID user FD type device size node name
Sshd 1409 root 3u ipv6-5678 tcp *: SSH (Listen)
View the TXT file opened by the root user process:
# Lsof-a-u root-D txt
Netstat-APN
View all processes and port usage.
2. netstat
The netstat command displays network connection, route table, and network interface information, allowing you to know which network connections are currently in operation.
-A displays all sockets, including those being monitored.
-C is re-displayed every one second until the user interrupts it.
-I displays information of all network interfaces in the same format as "ifconfig-e ".
-N is replaced by a network IP address to show network connection conditions.
-R displays the core route table in the same format as "route-e ".
-T shows the TCP connection status.
-U: displays the connections of the UDP protocol.
-V: displays ongoing work.