How to Use lsof to Trace Open Files and Network Sockets in Linux Terminal

In Unix-like operating systems, the foundational design philosophy states that “everything is a file.” This abstraction means that standard regular documents, directories, block storage devices, pipes, shared memory segments, character devices, and network communication sockets are all managed by the Linux kernel as file descriptors. When a partition refuses to unmount with a target is busy error, or an application daemon crashes because an unauthorized process has locked its TCP port, lsof (List Open Files) is the premier diagnostic utility to discover exactly which process holds open file descriptors.

Basic Syntax and Common Operational Flags

Running lsof without arguments scans all active processes in memory, generating a massive tabular stream of thousands of open descriptors. To pinpoint specific system bottlenecks, administrators combine specific targeting flags:

# List open files for a specific process ID (PID)
sudo lsof -p 1234

# List open files opened by a specific system user
sudo lsof -u www-data

# List open files belonging to a specific application binary name
sudo lsof -c nginx

• -p <PID>: Restricts results strictly to the designated process identifier.
• -u <user>: Filters descriptors opened by a specific username or UID.
• -c <command>: Matches processes whose executable command name begins with the specified string.
• +D <directory>: Recursively inspects a directory tree for open file handles.

Identifying and Releasing “Target is Busy” Mount Points

Attempting to unmount an external drive or network share via umount /mnt/data often fails when an active shell or background worker maintains an open descriptor within the mount tree:

1. Query lsof against the stubborn mount path:

   sudo lsof +f -- /mnt/data

   Or recursively scan the folder hierarchy:

   sudo lsof +D /mnt/data

2. Inspect the output columns:
   • COMMAND & PID: The program and process ID holding the lock.
   • FD (File Descriptor): Shows whether the process has the directory open as its current working directory (cwd) or holds an open file handle (e.g., 3r for read or 4w for write).
   • NAME: The exact relative path of the file holding the lock.
3. Gracefully terminate or kill the blocking process:

   sudo kill -15 <PID>
   sudo umount /mnt/data

Tracing Network Ports and Socket Listeners

While ss specializes in raw socket buffer statistics, lsof excels at linking active network connections to exact user processes:

# Display all active Internet network files (IPv4 and IPv6)
sudo lsof -i

# Filter for TCP connections on a specific port (e.g., port 80 or 443)
sudo lsof -i :443

# Filter for listening sockets on port 3306 (MySQL/MariaDB)
sudo lsof -i TCP:3306 -s TCP:LISTEN

# Find all established connections to a specific remote host
sudo lsof -i @192.168.1.100

Recovering Deleted Files Still Held Open by Processes

If an administrator accidentally runs rm on an active production log file or database journal, the directory entry is removed, but the disk blocks remain allocated until the holding process closes its file descriptor:

# Locate deleted files still held open in memory
sudo lsof | grep -i deleted

# Output reveals the file descriptor:
# mysqld  1420  mysql  5u  REG  8,1  104857600  /var/log/mysql.log (deleted)

# Recover the file directly from the Linux proc filesystem
sudo cp /proc/1420/fd/5 /tmp/recovered_mysql.log

This kernel mechanism provides a lifesaver for data recovery on critical production Linux servers.