lsof is system management/ security Uber tools. Call this tool lsof a real name, because it means "lists open files". One thing to remember is that in Unix, everything (including network sockets) is a file.
Interestingly, lsof is also one of the Linux/Unix commands with the most switches. It has so many switches, and it has many options to support the use of - and + prefixes.
1. usage: [-?abhlnNoOPRstUvV] [+|-c c] [+|-d s] [+D D] [+|-f[cgG]] 2. [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+|-M] [-o [o]] 3. [-p s] [+|-r [t]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
As you can see, lsof has an amazing number of options. You can use it to get information about the devices on your system. You can know what the specified user is touching at the specified location, or even what files or network connections a process is using.
For me, lsof replaces all the work of netstat and ps. It can bring everything those tools can bring, and much more than those tools. Let's take a look at some of its basic capabilities:
Key options
It is important to understand some key things about how lsof works. Most importantly, when you pass options to it, the default behavior is to "or" the result. Therefore, if you use - i to pull out a port list and - p to pull out a process list, you will get both results by default.
Here are some other things to keep in mind:
- Default: no option, lsof lists all open files of the active process
- Combination: you can combine options together, such as - abc, but be careful which options require parameters
- -a: the result is "and" (not "or")
- -l: display the user ID instead of the user name in the output
- -h: get help
- -t: get process ID ONLY
- -U: get UNIX socket address
- -F: format output results for other commands. It can be formatted in many ways, such as - F pcfn (for process id, command name, file descriptor, file name, and null termination)
Get network information
As I said, I mainly use lsof to get information about how the system interacts with the network. Here are some topics about this information:
Use - i to display all connections
Some people like to use netstat to get a network connection, but I prefer to use lsof to do this. The results are presented in a very intuitive way for me. I can get more information through the same command just by changing my grammar.
Syntax: lsof -i[46] [protocol][@hostname|hostaddr][:service|port]
1. # lsof -i 3. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME 4. dhcpcd 6061 root 4u IPv4 4510 UDP *:bootpc 5. sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) 6. sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh->192.168.1.5:49901 (ESTABLISHED)
Use -i 6 to get IPv6 traffic only
1. # lsof -i 6
Only TCP connections are displayed (similarly, UDP connections can be obtained)
You can also display only TCP or UDP connection information by providing the corresponding protocol after - i.
1. # lsof -iTCP 3. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME 4. sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) 5. sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh->192.168.1.5:49901 (ESTABLISHED)
Use - i:port to display network information related to the specified port
Alternatively, you can also search through the port, which is great to find out what prevents another application from binding to the specified port.
1. # lsof -i :22 3. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME 4. sshd 7703 root 3u IPv6 6499 TCP *:ssh (LISTEN) 5. sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh->192.168.1.5:49901 (ESTABLISHED)
Use @ host to display the connection to the specified host
This is very useful when you check whether to open the connection to a specified host in the network or on the Internet.
1. # lsof -i@172.16.12.5 3. sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh->172.16.12.5:49901 (ESTABLISHED)
Use @ host:port to display host to port based connections
You can also combine the display information of host and port.
1. # lsof -i@172.16.12.5:22 3. sshd 7892 root 3u IPv6 6757 TCP 10.10.1.5:ssh->172.16.12.5:49901 (ESTABLISHED)
Find the listening port
Find the port waiting to connect.
1. # lsof -i -sTCP:LISTEN
You can also grep "LISTEN" to complete the task.
1. # lsof -i | grep -i LISTEN 3. iTunes 400 daniel 16u IPv4 0x4575228 0t0 TCP *:daap (LISTEN)
Find the established connection
You can also display any connected connections.
1. # lsof -i -sTCP:ESTABLISHED
You can also complete this task by grep searching for "ESTABLISHED".
1. # lsof -i | grep -i ESTABLISHED 3. firefox-b 169 daniel 49u IPv4 0t0 TCP 1.2.3.3:1863->1.2.3.4:http (ESTABLISHED)
User information
You can also get information about various users and what they are doing on the system, including their network activities, file operations, etc.
Use - u to display what is opened by the specified user
1. # lsof -u daniel 3. -- snipped -- 4. Dock 155 daniel txt REG 14,2 2798436 823208 /usr/lib/libicucore.A.dylib 5. Dock 155 daniel txt REG 14,2 1580212 823126 /usr/lib/libobjc.A.dylib 6. Dock 155 daniel txt REG 14,2 2934184 823498 /usr/lib/libstdc++.6.0.4.dylib 7. Dock 155 daniel txt REG 14,2 132008 823505 /usr/lib/libgcc_s.1.dylib 8. Dock 155 daniel txt REG 14,2 212160 823214 /usr/lib/libauto.dylib 9. -- snipped --
Use - u user to display what all users except the specified user have done
1. # lsof -u ^daniel 3. -- snipped -- 4. Dock 155 jim txt REG 14,2 2798436 823208 /usr/lib/libicucore.A.dylib 5. Dock 155 jim txt REG 14,2 1580212 823126 /usr/lib/libobjc.A.dylib 6. Dock 155 jim txt REG 14,2 2934184 823498 /usr/lib/libstdc++.6.0.4.dylib 7. Dock 155 jim txt REG 14,2 132008 823505 /usr/lib/libgcc_s.1.dylib 8. Dock 155 jim txt REG 14,2 212160 823214 /usr/lib/libauto.dylib 9. -- snipped --
Kill everything the specified user does
It's nice to destroy everything running by a specified user.
1. # kill -9 `lsof -t -u daniel`
Commands and processes
It is often useful to see what the specified program or process is started by, and you can use lsof to filter by name or process ID. Some options are listed below:
Use - c to view the files and network connections being used by the specified command
1. # lsof -c syslog-ng 3. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME 4. syslog-ng 7547 root cwd DIR 3,3 4096 2 / 5. syslog-ng 7547 root rtd DIR 3,3 4096 2 / 6. syslog-ng 7547 root txt REG 3,3 113524 1064970 /usr/sbin/syslog-ng 7. -- snipped --
Use - p to view the opened content of the specified process ID
1. # lsof -p 10075 3. -- snipped -- 4. sshd 10068 root mem REG 3,3 34808 850407 /lib/libnss_files-2.4.so 5. sshd 10068 root mem REG 3,3 34924 850409 /lib/libnss_nis-2.4.so 6. sshd 10068 root mem REG 3,3 26596 850405 /lib/libnss_compat-2.4.so 7. sshd 10068 root mem REG 3,3 200152 509940 /usr/lib/libssl.so.0.9.7 8. sshd 10068 root mem REG 3,3 46216 510014 /usr/lib/liblber-2.3 9. sshd 10068 root mem REG 3,3 59868 850413 /lib/libresolv-2.4.so 10. sshd 10068 root mem REG 3,3 1197180 850396 /lib/libc-2.4.so 11. sshd 10068 root mem REG 3,3 22168 850398 /lib/libcrypt-2.4.so 12. sshd 10068 root mem REG 3,3 72784 850404 /lib/libnsl-2.4.so 13. sshd 10068 root mem REG 3,3 70632 850417 /lib/libz.so.1.2.3 14. sshd 10068 root mem REG 3,3 9992 850416 /lib/libutil-2.4.so 15. -- snipped --
-The t option returns only PID
1. # lsof -t -c Mail 3. 350
Files and directories
By viewing the specified file or directory, you can see all the resources on the system interacting with it - including users, processes, etc.
Displays everything that interacts with the specified directory
1. # lsof /var/log/messages/ 3. COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME 4. syslog-ng 7547 root 4w REG 3,3 217309 834024 /var/log/messages
Displays everything that interacts with the specified file
1. # lsof /home/daniel/firewall_whitelist.txt
Advanced Usage
And tcpdump Similarly, when you start combining queries, it shows its powerful function.
Show everything daniel did when connected to 1.1.1.1
1. # lsof -u daniel -i @1.1.1.1 3. bkdr 1893 daniel 3u IPv6 3456 TCP 10.10.1.10:1234->1.1.1.1:31337 (ESTABLISHED)
Use both the - t and - c options to send a HUP signal to the process
1. # kill -HUP `lsof -t -c sshd`
lsof +L1 displays all files with less than 1 open links
This usually (when not always) indicates that an attacker is trying to hide the contents of a file by deleting the file entry.
1. # lsof +L1 3. (hopefully nothing)
Displays open connections for a port range
1. # lsof -i @fw.google.com:2150=2180
ending
This introductory tutorial is just a glimpse of the lsof function. To view the complete reference, run the man lsof command or view Online version . I hope this article is helpful to you and can be used at any time Your comments and corrections are welcome.
resources
- lsof man page: Manpage of LSOF
This article was written by Daniel Miessler and was first written by him Blog Paste on
The lsof command can only be executed by the general root user, and the / usr/sbin/lsof command can be seen by the general user,
However, "permission denied" will be displayed for ordinary users
Let me summarize the usage of lsof instruction:
lsof abc.txt shows the process of opening the file abc.txt
Lsof - I: 22 knows what program is running on port 22
lsof -c abc displays the files that the abc process is now opening
lsof -g gid displays the progress of the home gid
lsof +d /usr/local / displays the files opened by the process in the directory
lsof +D /usr/local / is the same as above, but it will search the directory under the directory for a long time
lsof -d 4 shows processes using fd 4 www.2cto.com
lsof -i is used to display the qualified processes
Syntax: lsof -i[46] [protocol][@hostname|hostaddr][:service|port]
46 --> IPv4 or IPv6
protocol --> TCP or UDP
hostname --> Internet host name
Hostaddr -- > IPv4 location
service name in service -- > / etc / service (can be more than one)
Port -- > port number (can be more than one)
Example: TCP:25 - TCP and port 25
@1.2.3.4 - Internet IPv4 host address 1.2.3.4
tcp@ohaha.ks.edu.tw:ftp - TCP protocol hosthaha.ks.edu.tw service name:ftp
lsof -n does not convert IP to hostname. By default, the - n parameter is not added
Example: lsof -i tcp@ohaha.ks.edu.tw:ftp -n
lsof -p 12 see which files are opened by the process with process number 12
lsof +|-r [t] controls the repeated execution of lsof. The default is 15s refresh
-r. lsof will always be executed until an interrupt signal is received
+r. lsof will run until no files are displayed
Example: constantly check the current ftp connection: lsof -i tcp@ohaha.ks.edu.tw:ftp -r
lsof -s lists the size of the open file. If there is no size, leave blank
lsof -u username lists open files in UID www.2cto.com
Attention:
Process debugging commands: truss, strace, and ltrace
The process cannot be started, the running speed of the software suddenly slows down, and the "segment fault" of the program are headache problems for every Unix system user. These problems can quickly diagnose the "difficult and miscellaneous problems" of the software by using the three common debugging tools truss, strace and ltrace.
Author: xihuazi
Link: https://www.jianshu.com/p/a3aa6b01b2e1
Source: Jianshu
The copyright belongs to the author. For commercial reprint, please contact the author for authorization, and for non-commercial reprint, please indicate the source.