lsof

最新推荐文章于 2023-08-16 13:54:52 发布

hhhhhyyyyy8

最新推荐文章于 2023-08-16 13:54:52 发布

阅读量811

点赞数

分类专栏： Linux网络基础命令

原文链接：https://linux.cn/article-4099-1.html

版权

Linux网络基础命令专栏收录该内容

10 篇文章

订阅专栏

先mark一下

https://www.cnblogs.com/sparkbj/p/7161669.html

https://linux.cn/article-4099-1.html

https://www.jianshu.com/p/a3aa6b01b2e1

https://blog.51cto.com/zhangxinqi/2374118

lsof：list open file，它的作用是列出系统中打开的文件，可以查看用户和进程操作了哪些文件。

我的man lsof咋没有？

root@hy-virtual-machine:~# man lsof
man: 无法打开 /usr/share/man/./version: 没有那个文件或目录
没有 lsof 的手册页条目

https://linux.die.net/man/8/lsof

需要以管理员身份运行。

root@hy-virtual-machine:~# lsof | more
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
lsof: WARNING: can't stat() fuse file system /run/user/1000/doc
      Output information may be incomplete.
COMMAND     PID   TID TASKCMD               USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd       1                             root  cwd       DIR                8,5     4096          2 /
systemd       1                             root  rtd       DIR                8,5     4096          2 /
systemd       1                             root  txt       REG                8,5  1599584     138708 /usr/lib/systemd/systemd
systemd       1                             root  mem       REG                8,5  1369352     139739 /usr/lib/x86_64-linux-gnu/libm-2.31.so
systemd       1                             root  mem       REG                8,5   174272     140246 /usr/lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd       1                             root  mem       REG                8,5  1575112     140252 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd       1                             root  mem       REG                8,5   137584     139475 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd       1                             root  DEL       REG                8,5              132839 /usr/lib/x86_64-linux-gnu/libjson-c.so.4.0.0
systemd       1                             root  mem       REG                8,5    34872     139008 /usr/lib/x86_64-linux-gnu/libargon2.so.1
systemd       1                             root  mem       REG                8,5   431472     139233 /usr/lib/x86_64-linux-gnu/libdevmapper.so.1.02.1
systemd       1                             root  mem       REG                8,5    30936     140279 /usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
systemd       1                             root    0u      CHR                1,3      0t0          6 /dev/null
systemd       1                             root    1u      CHR                1,3      0t0          6 /dev/null
systemd       1                             root    2u      CHR                1,3      0t0          6 /dev/null
systemd       1                             root    3w      CHR               1,11      0t0         12 /dev/kmsg
systemd       1                             root    4u  a_inode               0,14        0      13551 [eventpoll]
systemd       1                             root    5u  a_inode               0,14        0      13551 [signalfd]
systemd       1                             root    6r  a_inode               0,14        0      13551 inotify
systemd       1                             root    7r      DIR               0,28        0          1 /sys/fs/cgroup/unified
systemd       1                             root    8u  a_inode               0,14        0      13551 [timerfd]
systemd       1                             root    9u  a_inode               0,14        0      13551 [eventpoll]
systemd       1                             root   10r      REG                0,5        0      29485 /proc/1/mountinfo
systemd       1                             root   11r  a_inode               0,14        0      13551 inotify
systemd       1                             root   13r  a_inode               0,14        0      13551 inotify
systemd       1                             root   14r      REG                0,5        0 4026532071 /proc/swaps

直接运行lsof，会列出系统中所有打开的文件，每个文件一行，其中每列信息的含有如下：

COMMAND:进程名称

PID：进程ID

USER：进程运行的用户名

FD：表示文件描述符，如：cwd当前工作目录，mem内存映射文件，mmap内存映射设备，txt应用文本（代码和数据），其次数值表示应用程序的文件描述符，这是打开文件时返回的一个整数，u表示该文件处于读取和写入模式，®为只读，（w）为只写模式，大写W为对整个文件的写锁权限，初始打开一个应用程序时有具有三个文件描述符，从0到2分别表示标准输入，输出和错误输出，所以大多数应用程序打开的文件的PD都是从3开始的

TYPE：表示文件的类型，如，REG普通文件，DIR目录，CHR字符文件，BLK设备文件，UNIX为Unix套接字，FIFO先进先出队列，IPv4网际协议IP套接字

DEVICE：文件所在的设备

SIZE：文件的大小

NODE：索引节点，文件在磁盘的标识符

NAME：打开文件的名称

基本用法：

-u：列出某个用户打开的文件

太多了，刷屏...

root@hy-virtual-machine:~# lsof -u hy | more
COMMAND     PID USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd    2277   hy  cwd       DIR                8,5     4096          2 /
systemd    2277   hy  rtd       DIR                8,5     4096          2 /
systemd    2277   hy  txt       REG                8,5  1599584     138708 /usr/lib/systemd/systemd
systemd    2277   hy  mem       REG                8,5  1369352     139739 /usr/lib/x86_64-linux-gnu/libm-2.31.so
systemd    2277   hy  mem       REG                8,5   174272     140246 /usr/lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd    2277   hy  mem       REG                8,5  1575112     140252 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd    2277   hy  mem       REG                8,5   137584     139475 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd    2277   hy  DEL       REG                8,5              132839 /usr/lib/x86_64-linux-gnu/libjson-c.so.4.0.0
systemd    2277   hy  mem       REG                8,5    34872     139008 /usr/lib/x86_64-linux-gnu/libargon2.so.1
systemd    2277   hy  mem       REG                8,5   431472     139233 /usr/lib/x86_64-linux-gnu/libdevmapper.so.1.02.1

列出不是某个用户打开的文件

root@hy-virtual-machine:~# lsof -u ^hy | more
COMMAND     PID   TID TASKCMD               USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd       1                             root  cwd       DIR                8,5     4096          2 /
systemd       1                             root  rtd       DIR                8,5     4096          2 /
systemd       1                             root  txt       REG                8,5  1599584     138708 /usr/lib/systemd/systemd
systemd       1                             root  mem       REG                8,5  1369352     139739 /usr/lib/x86_64-linux-gnu/libm-2.31.so
systemd       1                             root  mem       REG                8,5   174272     140246 /usr/lib/x86_64-linux-gnu/libudev.so.1.6.17
systemd       1                             root  mem       REG                8,5  1575112     140252 /usr/lib/x86_64-linux-gnu/libunistring.so.2.1.0
systemd       1                             root  mem       REG                8,5   137584     139475 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
systemd       1                             root  DEL       REG                8,5              132839 /usr/lib/x86_64-linux-gnu/libjson-c.so.4.0.0

-c：查看指定命令打开的文件

root@hy-virtual-machine:~# lsof -c ping
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
ping    50287 root  cwd    DIR    8,5     4096  393219 /root
ping    50287 root  rtd    DIR    8,5     4096       2 /
ping    50287 root  txt    REG    8,5    72776  131995 /usr/bin/ping
ping    50287 root  mem    REG    8,5    31176  139861 /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
ping    50287 root  mem    REG    8,5    18504  139869 /usr/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
ping    50287 root  mem    REG    8,5    51832  139863 /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
ping    50287 root  mem    REG    8,5 14537584  138421 /usr/lib/locale/locale-archive
ping    50287 root  mem    REG    8,5   137584  139475 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
ping    50287 root  mem    REG    8,5  2029224  139101 /usr/lib/x86_64-linux-gnu/libc-2.31.so
ping    50287 root  mem    REG    8,5   101320  140045 /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
ping    50287 root  mem    REG    8,5  1168056  139399 /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.2.5
ping    50287 root  mem    REG    8,5    31120  139122 /usr/lib/x86_64-linux-gnu/libcap.so.2.32
ping    50287 root  mem    REG    8,5   191472  138888 /usr/lib/x86_64-linux-gnu/ld-2.31.so
ping    50287 root    0u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    1u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    2u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    3u  sock    0,9      0t0 1443710 protocol: PING
ping    50287 root    4u  sock    0,9      0t0 1443711 protocol: PINGv6

-p：查看指定id进程打开的文件

root@hy-virtual-machine:~# ps -aux | grep ping 
hy          2764  0.0  0.1 323064  8380 ?        Ssl  6月01   0:04 /usr/libexec/gsd-housekeeping
root       50287  0.0  0.0  18464  2840 pts/1    S+   20:22   0:00 ping www.baidu.com
root       50297  0.0  0.0  17680   736 pts/2    S+   20:24   0:00 grep --color=auto ping
root@hy-virtual-machine:~# lsof -p 50287
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
ping    50287 root  cwd    DIR    8,5     4096  393219 /root
ping    50287 root  rtd    DIR    8,5     4096       2 /
ping    50287 root  txt    REG    8,5    72776  131995 /usr/bin/ping
ping    50287 root  mem    REG    8,5    31176  139861 /usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so
ping    50287 root  mem    REG    8,5    18504  139869 /usr/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
ping    50287 root  mem    REG    8,5    51832  139863 /usr/lib/x86_64-linux-gnu/libnss_files-2.31.so
ping    50287 root  mem    REG    8,5 14537584  138421 /usr/lib/locale/locale-archive
ping    50287 root  mem    REG    8,5   137584  139475 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.28.0
ping    50287 root  mem    REG    8,5  2029224  139101 /usr/lib/x86_64-linux-gnu/libc-2.31.so
ping    50287 root  mem    REG    8,5   101320  140045 /usr/lib/x86_64-linux-gnu/libresolv-2.31.so
ping    50287 root  mem    REG    8,5  1168056  139399 /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.2.5
ping    50287 root  mem    REG    8,5    31120  139122 /usr/lib/x86_64-linux-gnu/libcap.so.2.32
ping    50287 root  mem    REG    8,5   191472  138888 /usr/lib/x86_64-linux-gnu/ld-2.31.so
ping    50287 root    0u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    1u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    2u   CHR  136,1      0t0       4 /dev/pts/1
ping    50287 root    3u  sock    0,9      0t0 1443710 protocol: PING
ping    50287 root    4u  sock    0,9      0t0 1443711 protocol: PINGv6

查看某个文件被哪些进程在使用：

root@hy-virtual-machine:~# lsof /usr/bin/ping
COMMAND   PID USER  FD   TYPE DEVICE SIZE/OFF   NODE NAME
ping    50287 root txt    REG    8,5    72776 131995 /usr/bin/ping

+d：列出访问某个目录的所有进程

root@hy-virtual-machine:~# lsof +d /usr/bin
COMMAND     PID       USER  FD   TYPE DEVICE SIZE/OFF   NODE NAME
dbus-daem   807 messagebus txt    REG    8,5   249032 131282 /usr/bin/dbus-daemon
networkd-   818       root txt    REG    8,5  5457536 137255 /usr/bin/python3.8
unattende  1029       root txt    REG    8,5  5457536 137255 /usr/bin/python3.8
whoopsie   1439   whoopsie txt    REG    8,5    68504 132386 /usr/bin/whoopsie
pulseaudi  2287         hy txt    REG    8,5   100832 131932 /usr/bin/pulseaudio
dbus-daem  2293         hy txt    REG    8,5   249032 131282 /usr/bin/dbus-daemon
gnome-key  2295         hy txt    REG    8,5  1164352 131488 /usr/bin/gnome-keyring-daemon
ssh-agent  2460         hy txt    REG    8,5   350504 132212 /usr/bin/ssh-agent
ibus-daem  2477         hy txt    REG    8,5   199088 131639 /usr/bin/ibus-daemon
dbus-daem  2576         hy txt    REG    8,5   249032 131282 /usr/bin/dbus-daemon
gnome-she  2670         hy txt    REG    8,5    23168 131499 /usr/bin/gnome-shell
gjs        2730         hy txt    REG    8,5    23128 131474 /usr/bin/gjs-console
update-no  5280         hy txt    REG    8,5    80872 132349 /usr/bin/update-notifier
x-termina 26141         hy txt    REG    8,5  5457536 137255 /usr/bin/python3.8
bash      26150         hy txt    REG    8,5  1183448 131166 /usr/bin/bash
bash      46619         hy txt    REG    8,5  1183448 131166 /usr/bin/bash
su        47966       root txt    REG    8,5    67816 132225 /usr/bin/su
bash      47967       root txt    REG    8,5  1183448 131166 /usr/bin/bash
bash      48069         hy txt    REG    8,5  1183448 131166 /usr/bin/bash
su        50172       root txt    REG    8,5    67816 132225 /usr/bin/su
bash      50173       root txt    REG    8,5  1183448 131166 /usr/bin/bash
ping      50287       root txt    REG    8,5    72776 131995 /usr/bin/ping
lsof      50349       root txt    REG    8,5   175744 131766 /usr/bin/lsof
lsof      50350       root txt    REG    8,5   175744 131766 /usr/bin/lsof

+D：递归列出访问某个目录下的所有进程：

root@hy-virtual-machine:~# lsof +d /home
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
tracker-m  2289   hy  cwd    DIR    8,5     4096 282792 /home/hy
dbus-daem  2293   hy  cwd    DIR    8,5     4096 282792 /home/hy
gvfsd      2304   hy  cwd    DIR    8,5     4096 282792 /home/hy
gvfsd-fus  2309   hy  cwd    DIR    8,5     4096 282792 /home/hy

root@hy-virtual-machine:~# lsof +D /home
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
pulseaudi  2287   hy  mem    REG    8,5    12288 525528 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-stream-volumes.tdb
pulseaudi  2287   hy  mem    REG    8,5     8192 525527 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-device-volumes.tdb
pulseaudi  2287   hy  mem    REG    8,5      696 525529 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-card-database.tdb
pulseaudi  2287   hy   10u   REG    8,5     8192 525527 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-device-volumes.tdb
pulseaudi  2287   hy   11u   REG    8,5    12288 525528 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-stream-volumes.tdb
pulseaudi  2287   hy   12u   REG    8,5      696 525529 /home/hy/.config/pulse/c965dae48151452094174d23729f859d-card-database.tdb
tracker-m  2289   hy  cwd    DIR    8,5     4096 282792 /home/hy
tracker-m  2289   hy  mem    REG    8,5   363086 525545 /home/hy/.cache/tracker/ontologies.gvdb
tracker-m  2289   hy  mem-r  REG    8,5    32768 536425 /home/hy/.cache/tracker/meta.db-shm
tracker-m  2289   hy  mem    REG    8,5     6356 524360 /home/hy/.config/dconf/user
tracker-m  2289   hy   10rr  REG    8,5  3850240 525537 /home/hy/.cache/tracker/meta.db

lsof查看网络信息

lsof -i [46][protocol][@hostname|hostaddr][:service|port]

lsof -i 查看所有的网络连接信息

root@hy-virtual-machine:~# lsof -i
COMMAND     PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
systemd-r   776 systemd-resolve   12u  IPv4    2582      0t0  UDP localhost:domain 
systemd-r   776 systemd-resolve   13u  IPv4    2583      0t0  TCP localhost:domain (LISTEN)
avahi-dae   800           avahi   12u  IPv4   31518      0t0  UDP *:mdns 
avahi-dae   800           avahi   13u  IPv6   31519      0t0  UDP *:mdns 
avahi-dae   800           avahi   14u  IPv4   31520      0t0  UDP *:56266 
avahi-dae   800           avahi   15u  IPv6   31521      0t0  UDP *:54242 
sshd        922            root    3u  IPv4   36055      0t0  TCP *:ssh (LISTEN)
sshd        922            root    4u  IPv6   36057      0t0  TCP *:ssh (LISTEN)
nmbd       1437            root   14u  IPv4   39559      0t0  UDP *:netbios-ns 
nmbd       1437            root   15u  IPv4   39560      0t0  UDP *:netbios-dgm 
nmbd       1437            root   16u  IPv4   39569      0t0  UDP hy-virtual-machine:netbios-ns 
nmbd       1437            root   17u  IPv4   39570      0t0  UDP 192.168.1.255:netbios-ns 
nmbd       1437            root   18u  IPv4   39571      0t0  UDP hy-virtual-machine:netbios-dgm 
nmbd       1437            root   19u  IPv4   39572      0t0  UDP 192.168.1.255:netbios-dgm 
smbd      29140            root   31u  IPv6  773832      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   32u  IPv6  773833      0t0  TCP *:netbios-ssn (LISTEN)
smbd      29140            root   33u  IPv4  773834      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   34u  IPv4  773835      0t0  TCP *:netbios-ssn (LISTEN)
cupsd     46169            root    6u  IPv6 1363310      0t0  TCP ip6-localhost:ipp (LISTEN)
cupsd     46169            root    7u  IPv4 1363311      0t0  TCP localhost:ipp (LISTEN)
cups-brow 46171            root    7u  IPv4 1358328      0t0  UDP *:631 
sshd      46525            root    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
sshd      46618              hy    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
sshd      47978            root    4u  IPv4 1414583      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:53228 (ESTABLISHED)
sshd      48068              hy    4u  IPv4 1414583      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:53228 (ESTABLISHED)

lsof -i:端口号：查看对应端口的网络连接信息

hy@hy-virtual-machine:~$ lsof -i:22
hy@hy-virtual-machine:~$ sudo lsof -i:22
[sudo] hy 的密码： 
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd      922 root    3u  IPv4   36055      0t0  TCP *:ssh (LISTEN)
sshd      922 root    4u  IPv6   36057      0t0  TCP *:ssh (LISTEN)
sshd    46525 root    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
sshd    46618   hy    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
hy@hy-virtual-machine:~$ sudo lsof -i:445
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
smbd    29140 root   31u  IPv6 773832      0t0  TCP *:microsoft-ds (LISTEN)
smbd    29140 root   33u  IPv4 773834      0t0  TCP *:microsoft-ds (LISTEN)

lsof -i tcp：查看tcp网络连接信息

root@hy-virtual-machine:~# lsof -i tcp
COMMAND     PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
systemd-r   776 systemd-resolve   13u  IPv4    2583      0t0  TCP localhost:domain (LISTEN)
sshd        922            root    3u  IPv4   36055      0t0  TCP *:ssh (LISTEN)
sshd        922            root    4u  IPv6   36057      0t0  TCP *:ssh (LISTEN)
smbd      29140            root   31u  IPv6  773832      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   32u  IPv6  773833      0t0  TCP *:netbios-ssn (LISTEN)
smbd      29140            root   33u  IPv4  773834      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   34u  IPv4  773835      0t0  TCP *:netbios-ssn (LISTEN)
cupsd     46169            root    6u  IPv6 1363310      0t0  TCP ip6-localhost:ipp (LISTEN)
cupsd     46169            root    7u  IPv4 1363311      0t0  TCP localhost:ipp (LISTEN)
sshd      46525            root    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
sshd      46618              hy    4u  IPv4 1368069      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:49250 (ESTABLISHED)
sshd      47978            root    4u  IPv4 1414583      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:53228 (ESTABLISHED)
sshd      48068              hy    4u  IPv4 1414583      0t0  TCP hy-virtual-machine:ssh->DESKTOP-K0F0EJ9.bbrouter:53228 (ESTABLISHED)

lsof -i udp：查看udp网络连接信息

root@hy-virtual-machine:~# lsof -i udp
COMMAND     PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
systemd-r   776 systemd-resolve   12u  IPv4    2582      0t0  UDP localhost:domain 
avahi-dae   800           avahi   12u  IPv4   31518      0t0  UDP *:mdns 
avahi-dae   800           avahi   13u  IPv6   31519      0t0  UDP *:mdns 
avahi-dae   800           avahi   14u  IPv4   31520      0t0  UDP *:56266 
avahi-dae   800           avahi   15u  IPv6   31521      0t0  UDP *:54242 
nmbd       1437            root   14u  IPv4   39559      0t0  UDP *:netbios-ns 
nmbd       1437            root   15u  IPv4   39560      0t0  UDP *:netbios-dgm 
nmbd       1437            root   16u  IPv4   39569      0t0  UDP hy-virtual-machine:netbios-ns 
nmbd       1437            root   17u  IPv4   39570      0t0  UDP 192.168.1.255:netbios-ns 
nmbd       1437            root   18u  IPv4   39571      0t0  UDP hy-virtual-machine:netbios-dgm 
nmbd       1437            root   19u  IPv4   39572      0t0  UDP 192.168.1.255:netbios-dgm 
cups-brow 46171            root    7u  IPv4 1358328      0t0  UDP *:631

lsof -i @192.168.1.7 -n：查看连接到的某个主机的信息

root@hy-virtual-machine:~# lsof -i @192.168.1.7 -n
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd    46525 root    4u  IPv4 1368069      0t0  TCP 192.168.1.6:ssh->192.168.1.7:49250 (ESTABLISHED)
sshd    46618   hy    4u  IPv4 1368069      0t0  TCP 192.168.1.6:ssh->192.168.1.7:49250 (ESTABLISHED)
sshd    47978 root    4u  IPv4 1414583      0t0  TCP 192.168.1.6:ssh->192.168.1.7:53228 (ESTABLISHED)
sshd    48068   hy    4u  IPv4 1414583      0t0  TCP 192.168.1.6:ssh->192.168.1.7:53228 (ESTABLISHED)

root@hy-virtual-machine:~# lsof -i @www.cnblogs.com
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
firefox 50522   hy   69u  IPv4 1512346      0t0  TCP hy-virtual-machine:41616->118.31.180.41:https (ESTABLISHED)

root@hy-virtual-machine:~# ping www.cnblogs.com
PING www.cnblogs.com (118.31.180.41) 56(84) bytes of data.
64 bytes from 118.31.180.41 (118.31.180.41): icmp_seq=1 ttl=90 time=23.8 ms
64 bytes from 118.31.180.41 (118.31.180.41): icmp_seq=2 ttl=90 time=25.6 ms
64 bytes from 118.31.180.41 (118.31.180.41): icmp_seq=3 ttl=90 time=23.5 ms
3 packets transmitted, 3 received, 0% packet loss, time 2081ms
rtt min/avg/max/mdev = 23.455/24.275/25.577/0.930 ms

root@hy-virtual-machine:~# lsof -i @118.31.180.41
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
firefox 50522   hy   69u  IPv4 1512346      0t0  TCP hy-virtual-machine:41616->118.31.180.41:https (ESTABLISHED)

列出当前主机监听的端口

lsof -i -s TCP:LISTEN

root@hy-virtual-machine:~# lsof -i -s TCP:LISTEN
COMMAND     PID            USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
systemd-r   776 systemd-resolve   13u  IPv4    2583      0t0  TCP localhost:domain (LISTEN)
sshd        922            root    3u  IPv4   36055      0t0  TCP *:ssh (LISTEN)
sshd        922            root    4u  IPv6   36057      0t0  TCP *:ssh (LISTEN)
smbd      29140            root   31u  IPv6  773832      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   32u  IPv6  773833      0t0  TCP *:netbios-ssn (LISTEN)
smbd      29140            root   33u  IPv4  773834      0t0  TCP *:microsoft-ds (LISTEN)
smbd      29140            root   34u  IPv4  773835      0t0  TCP *:netbios-ssn (LISTEN)
cupsd     46169            root    6u  IPv6 1363310      0t0  TCP ip6-localhost:ipp (LISTEN)
cupsd     46169            root    7u  IPv4 1363311      0t0  TCP localhost:ipp (LISTEN)

-s P:S参数跟着两个字段，协议和状态，中间用冒号隔开，如上表示TCP协议的监听状态，也可以查看处于连接的TCP网络状态：

lsof -i -s TCP:ESTABLISHED

root@hy-virtual-machine:~# lsof -i -s TCP:ESTABLISHED -n
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd    46525 root    4u  IPv4 1368069      0t0  TCP 192.168.1.6:ssh->192.168.1.7:49250 (ESTABLISHED)
sshd    46618   hy    4u  IPv4 1368069      0t0  TCP 192.168.1.6:ssh->192.168.1.7:49250 (ESTABLISHED)
sshd    47978 root    4u  IPv4 1414583      0t0  TCP 192.168.1.6:ssh->192.168.1.7:53228 (ESTABLISHED)
sshd    48068   hy    4u  IPv4 1414583      0t0  TCP 192.168.1.6:ssh->192.168.1.7:53228 (ESTABLISHED)