lsof Cheatsheet - Linux Process & Port Diagnostics Reference
Lsof's core strength is reversing the questions — give it a port and it names the process, give it a user and it lists every open file. Port-already-in-use, file-held-by-an-old-process, and disk-space-not-released are all the same root cause, a lingering open handle; this table groups lookups by axis and adds +L1 for the deleted-file case so the usual suspects surface quickly.
By Process 6
lsof -p 1234Files opened by a given PID
lsof -c nginxFiles opened by the nginx process
lsof -c /^nginx/Match process name by regex
lsof -u tomFiles opened by a given user
lsof -u ^rootExclude the root user
lsof -p 1234,5678Files opened by multiple PIDs
By Port 6
lsof -i :80Process using port 80
lsof -i :8080 -i :8443Check multiple ports
lsof -i tcp:80TCP port 80 only
lsof -i udp:53UDP port 53 only
lsof -i @192.168.1.1:80Specific IP and port
lsof -i :1-1024All privileged ports (1-1024)
By File 4
lsof /var/log/syslogWho opened a given file
lsof +D /var/log/All open files under a directory (recursive)
lsof +d /var/log/Current directory only (non-recursive)
lsof /dev/sda1Who is using a given device
Network 8
lsof -iAll network connections
lsof -i -nNo name resolution (faster)
lsof -i -PNo port-name resolution (numeric ports)
lsof -i -n -PCombined (fastest)
lsof -i tcp@192.168.1.1:22SSH connections to a host
lsof -i -sTCP:ESTABLISHEDEstablished connections only
lsof -i 4 -P -nIPv4 connections only (no resolution)
lsof -i 6 -P -nIPv6 connections only
By Type / Format 4
lsof -tOutput PIDs only (good for pipes)
lsof -F pfcOutput formatted fields (PID/command/user)
lsof -a -p 1234 -c nginxAND-combine conditions
lsof -Or -p 1234 -p 5678OR-combine conditions
Troubleshooting 7
lsof -i :80 | grep LISTENFind the process listening on port 80
lsof +L1Deleted-but-open files (when disk is full)
lsof -nP -iTCP -sTCP:LISTENAll listening TCP ports
lsof -i :22 | grep ESTABLISHEDEstablished SSH connections
lsof -u tom | wc -lCount files opened by a user
kill $(lsof -t -i :8080)Kill the process occupying port 8080
lsof -i :80 -r 5Monitor port 80 every 5 seconds
Tips
- lsof needs root to see all users' files; ordinary users see only their own.
- For port conflicts, first find the PID with lsof -i :port, then kill it or change config.
- When the disk is full but no large file shows, use lsof +L1 to find deleted-but-open files.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us