How to Use the ‘lsof’ Command to Identify Open Files and Network Ports

Everything is a File

One of the defining architectural philosophies of Linux (and UNIX) is that “everything is a file.” A text document is a file. A keyboard is a file. A running application is a file. Even an active network connection listening on port 80 is treated by the kernel as a file.

Because everything is a file, administrators frequently encounter situations where a system action is blocked because a file is “in use.” You might try to unmount a USB drive and receive a “Device is busy” error. You might try to start a web server and receive a “Port 443 is already in use” error.

To solve these problems instantly, you must use the lsof (List Open Files) command. It allows you to peer directly into the kernel and see exactly which application is holding which file hostage.

1. Finding What is Blocking a USB Drive

If you try to eject a USB drive (mounted at /mnt/usb) using the umount command and the system refuses, it means some background process is currently reading or writing to that drive.

To identify the culprit, point lsof directly at the directory:

sudo lsof /mnt/usb

The output will list the exact Command (e.g., bash or vlc), the Process ID (PID), and the User who launched the process. Once you have the PID (e.g., 4092), you can forcefully terminate the process using the kill 4092 command, freeing the drive.

2. Finding Which Process is Listening on a Port

This is arguably the most common use case for lsof in web administration.

If you try to start Nginx or Apache, and it crashes because “Port 80 is already bound,” you need to find out what rogue application is currently listening to web traffic.

You can use the -i (Internet) flag followed by a colon and the port number.

sudo lsof -i :80

This will instantly reveal the exact application (perhaps a forgotten instance of Node.js or Python) that is currently hoarding the port.

You can also check for specific protocols. To see every single process currently making a secure SSH connection (Port 22) on your server:

sudo lsof -i tcp:22

3. Seeing Everything a User is Doing

If you suspect a specific user account on a shared server is causing disk latency by running heavy background scripts, you can filter lsof to only show files opened by that specific user using the -u flag.

sudo lsof -u jsmith

This command will dump a massive list of every library, configuration file, and network connection currently tied to “jsmith.”

4. Finding What File an Application is Hiding In

Conversely, if you know the name of a rogue application (e.g., malware_miner), but you don’t know where it is physically located on your hard drive, you can use the -c (Command) flag.

sudo lsof -c malware_miner

This will trace the active process backward, revealing the exact absolute path to the physical executable file on the disk, allowing you to delete it permanently.

Conclusion

Because the Linux kernel manages all system resources as files, the lsof command acts as an x-ray machine for the entire operating system. By mastering its directory, port, and user flags, administrators can instantly resolve conflicts, hunt down rogue processes, and regain absolute control over system hardware.