lsof File Descriptor Cheatsheet

Q: What is the difference between lsof and fuser?

lsof lists all open files/network connections by process, ideal for diagnosing 'who is using this file'. fuser focuses on 'which process uses a specific file or port' and can directly send signals (e.g., fuser -k). They complement each other — lsof is more comprehensive, fuser is more action-oriented.

Q: How do I find which process is using a specific port?

Use 'lsof -i :port' to see connections and listeners on a specific port, e.g., lsof -i :8080. To see only listening TCP connections, use 'lsof -iTCP -sTCP:LISTEN'.

Q: Why is lsof slow and how can I speed it up?

lsof resolves DNS and port names by default. Add -n (no DNS) and -P (no port name resolution) to significantly speed it up. Combined: 'lsof -n -P -i'.

Q: How do I see the file descriptors of a running process?

Use 'lsof -p PID' or directly inspect /proc/PID/fd/: 'ls -la /proc/PID/fd/'. The latter is faster and works even without lsof installed.

Q: What does 'lsof | grep DEL' show?

DEL (deleted) indicates a file has been deleted but is still held open by a process, causing unreleased disk space. 'lsof | grep DEL' finds these ghost files and their owning processes. Restart or kill the process to free the space.

lsof (List Open Files) is an essential diagnostic tool on Linux/Unix systems for listing open files, pipes, network connections, and other resources. This cheatsheet covers basic usage, network troubleshooting, user/process analysis, and advanced techniques, including fuser and /proc filesystem utilities.

Updated: 2026-07-17·27 commands

Overview

lsof (List Open Files) is a command-line utility that lists information about files opened by processes. In Unix/Linux, everything is a file, making lsof an invaluable troubleshooting tool.

Quick Start

``bash lsof -i :80 # Find what's listening on port 80 lsof -u username # List files opened by a user lsof -p PID # List files opened by a process``

Refer to the command table below for detailed usage.

Basic(8)

Command	Level	Example
`lsof` List all open files on the system	Basic	`lsof`
`lsof +D /path` Recursively list open files under a directory	Intermediate	`lsof +D /var/log`
`lsof /path/to/file` Check which processes are using a file	Basic	`lsof /var/log/syslog`
`lsof -n -P` Skip DNS and port name resolution (faster output)	Intermediate	`lsof -n -P -i`
`ls -la /proc/PID/fd/` View process file descriptors via /proc	Intermediate	`ls -la /proc/1234/fd/`
`ls -la /proc/PID/cwd` View process current working directory	Intermediate	`ls -la /proc/1234/cwd`
`ls -la /proc/PID/exe` View process executable path	Intermediate	`ls -la /proc/1234/exe`
`readlink /proc/PID/fd/N` Check what a specific FD points to	Intermediate	`readlink /proc/1234/fd/3`

Network(8)

Command	Level	Example
`lsof -i` List all network connections (IPv4/IPv6)	Basic	`lsof -i`
`lsof -i :port` Check connections on a specific port	Basic	`lsof -i :8080`
`lsof -i :port1-port2` Check a port range	Intermediate	`lsof -i :8000-8100`
`lsof -iTCP -sTCP:LISTEN` List all TCP listening sockets	Intermediate	`lsof -iTCP -sTCP:LISTEN`
`lsof -iUDP` List all UDP connections	Intermediate	`lsof -iUDP`
`lsof -i @host` Filter by host/IP address	Intermediate	`lsof -i @192.168.1.1`
`lsof -i -sTCP:LISTEN -n -P` Listen sockets without DNS/port resolution (common combo)	Intermediate	`lsof -i -sTCP:LISTEN -n -P`
`lsof -iTCP -sTCP:ESTABLISHED -n -P` View established TCP connections	Intermediate	`lsof -iTCP -sTCP:ESTABLISHED -n -P`

User & Process(5)

Command	Level	Example
`lsof -u user` List open files for a specific user	Basic	`lsof -u admin`
`lsof -u ^user` Exclude files of a specific user	Intermediate	`lsof -u ^root`
`lsof -c process` Find files by process name prefix	Basic	`lsof -c nginx`
`lsof -p PID` View open files for a specific PID	Basic	`lsof -p 1234`
`lsof -p PID1,PID2` View open files for multiple PIDs	Intermediate	`lsof -p 1234,5678`

Advanced(6)

Command	Level	Example
`lsof -F` Parseable output format (for scripting)	Expert	`lsof -F pcfn`
`lsof \| grep DEL` Find deleted files still consuming disk space	Expert	`lsof \| grep DEL`
`lsof -a -u user -i` AND condition combination (user and network)	Expert	`lsof -a -u admin -i :3000`
`fuser /path/to/file` Show PIDs using a specific file or socket	Intermediate	`fuser /var/run/docker.sock`
`fuser -k /path` Kill processes using a specific file/port	Expert	`fuser -k 8080/tcp`
`fuser -v /path` Verbose mode showing process details	Intermediate	`fuser -v /var/log/nginx/access.log`

FAQ

What is the difference between lsof and fuser?

How do I find which process is using a specific port?

Why is lsof slow and how can I speed it up?

How do I see the file descriptors of a running process?

What does 'lsof | grep DEL' show?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-17.