lsof

• If name is a mounted-point (for example /Volume/DATA) or
  the device of the file system lsof will list all the files open on the file system.

  +f forces name to be considered a file system identifier otherwise name is treated as a regular file - i.e., its listing is restricted to processes that have it open as a file or as a process-specific directory, such as the root or current working directory.
  To request that lsof look for open files inside a directory name, use +d s and +D D .
  -f forces name to be considered a file system identifier

If a name is a Linux UNIX domain socket name, in one case lsof is able to search for it by its device and inode number, allowing name to be a relative path. The case requires that the absolute path (i.e., one beginning with a slash) be used by the process that created the socket, for example, if the path is /dev/log and an lsof search is initiated when the working directory is /dev, then name could be ./log.

-b the only names are file systems for which mount table supplies alternate device numbers. See the AVOIDING KERNEL BLOCKS and ALTERNATE DEVICE NUMBERS sections

Multiple file names are joined in a single ORed set before participating in AND option selection.

Symbolic links are resolved before use.

^ prefix excludes commands
If cmdprx begins and ends with a slash (/), a regular expression.
Shell meta-characters in the regular expression must be quoted.
suffixs:
i ignore case
b regular expression is a basic one.
x the regular expression is an extended one (default).
See FAQ The simple command specification is tested first.
If that test fails, the command regular expression is applied.
This may result in no command found for regex: messages with -V

pwd
/Volumes/DATA/dgerman/Documents/computerstuff/software/internet/sites/rws
% lsof +D .
COMMAND   PID    USER   FD   TYPE DEVICE   SIZE/OFF   NODE NAME
zsh     63378 dgerman  cwd    DIR   1,19        512 341303 .
zsh     65620 dgerman  cwd    DIR   1,19        512 341303 .
lsof    67408 dgerman  cwd    DIR   1,19        512 341303 .
lsof    67409 dgerman  cwd    DIR   1,19        512 341303 .
zsh     83709 dgerman  cwd    DIR   1,19        512 341303 .
rsync   84908 dgerman  cwd    DIR   1,19        512 341303 .
bash    84909 dgerman  cwd    DIR   1,19        512 341303 .
ssh     84910 dgerman  cwd    DIR   1,19        512 341303 .
rsync   84930 dgerman  cwd    DIR   1,19        512 341303 .
rsync   84930 dgerman    3u   REG   1,19 3565944832 382409 ./.backup-2.8.2023_18-23-10_
                                                                    realger1.tar.gz.Xngdn9

Example: 1,3 or ^6,^2.

For a range use lowLimit-highLimit. For example: 3-5 or ^7-9.
File descriptors are ORed before participating in AND option selections.

Does not follow symbolic links unless the -x or -x l† is also specified.
Does not search for open files on file system mount points on unless the -x or -x f is also specified.
Permissions limit searching for files to those accessable via stat

Slow and requires a large amount of memory, as it descends the entire directory tree, beginning at dir

? - report paths, build , ignore , read or update the device cache file

may be followed by a path name.
Reports the read-only and write paths that can be used for the device cache file, environment variables and the format for the personal device cache file path. (Escape ? as shell requires.)

The b, r, and u functions may be followed by the device cache files path. The standard default is .lsof_hostname in the home directory of the real user ID that executes lsof, but this could have been changed when lsof was configured and compiled. (The output of the -h and -? options show the current default prefix - e.g., .lsof&.) The suffix, hostname, is the first component of the hosts name returned by gethostname(2).

b build a new device cache file at the default or specified path.
i ignore the default device cache file and obtain its information about devices via direct calls to the kernel.
r read the device cache at the default or specified path, but prevents it from creating a new device cache file when none exists or the existing one is improperly structured. The r function, when specified without a path name, prevents lsof from updating an incorrect or outdated device cache file, or creating a new one in its place. The r function is always available when it is specified without a path name argument; it may be restricted by the permissions of the lsof process.
u read the device cache file at the default or specified path, if possible, and to rebuild it, if necessary. This is the default device cache file function when no -D option has been specified.

CAUTION: this option can easily be mis-applied to other than the file system of interest, because it uses path name rather than the more reliable device and inode numbers. (Device and inode numbers are acquired via the potentially blocking stat(2) kernel call and are thus not available, but see the ±m m option as a possible alternative way to supply device numbers.) Use this option with great care and fully specify the path name of the file system to be exempted.

When open files on exempted file systems are reported, it may not be possible to obtain all their information. Therefore, some information columns will be blank, the characters UNKN& preface the values in the TYPE column, and the applicable exemption option is added in parentheses to the end of the NAME column. (Some device number information might be made avail- able via the ±m m option.)

Normally a path name argument is taken to be a file system name if it matches a mounted-on directory name reported by mount(8), or if it represents a block device, named in the mount output and associated with a mounted directory name. When +f is specified, all path name arguments will be taken to be file system names, and lsof will complain if any are not. This can be useful, for example, when the file system name (mounted-on device) isnt a block device. This happens for some CD-ROM file systems.

When -f is specified by itself, all path name arguments will be taken to be simple files. Thus, for example, the -f -- /& arguments direct lsof to search for open files with a / path name, not all open files in the / (root) file system.

Be careful to make sure +f and -f are properly terminated and arent followed by a character (e.g., of the file or file sys- tem name) that might be taken as a parameter. For example, use --& after +f and -f as in these examples. $ lsof +f -- /file/system/name $ lsof -f -- /file/name

The listing of information from kernel file structures, requested with the +f [cfgGn] option form, is normally inhibited, and is not available in whole or part for some dialects - e.g., /proc-based Linux kernels below 2.6.22. When the prefix to f is a plus sign (+), these characters request file structure information: c file structure use count (not Linux) f file structure address (not Linux) g file flag abbreviations (Linux 2.6.22 and up) G file flags in hexadecimal (Linux 2.6.22 and up) n file structure node address (not Linux) When the prefix is minus (-) the same characters disable the listing of the indicated values. File structure addresses, use counts, flags, and node addresses may be used to detect more readily identical files inherited by child processes and identical files in use by different processes. Lsof column output can be sorted by output columns holding the values and listed to identify identical file use, or lsof field output can be parsed by an AWK or Perl post-fil- ter script, or by a C program.

With no fields all fields are selected (except the raw deviceField, security context and zone field ) and NL terminator is used.
For -F 0 NULL teminatxior.

Other combinations of fields and their associated field terminator character must be set with explicit entries in field, as described in the Output for Other Programs .

When a field selection character identifies an item - e.g., PPID, selected with -R - specification of the field character - e.g., -FR& - also selects the listing of the item. When the field selection character list contains the single character ?, lsof will display a help list of the field identi- fication characters. (Escape the ? character as your shell requires.)

If -i4 or -i6 is specified with no following address, only files of the indicated IP version, IPv4 or IPv6, are displayed. (An IPv6 specification may be used only if the dialects supports IPv6, as indicated by [46]& and IPv[46]& in lsofs -h or -? output.) Sequentially specifying -i4, followed by -i6 is the same as specifying -i, and vice-versa. Specifying -i4, or -i6 after -i is the same as specifying -i4 or -i6 by itself.

Multiple addresses (up to a limit of 100) may be specified with multiple -i options. (A port number or service name range is counted as one address.) They are joined in a single ORed set before participating in AND option selection.

An Internet address is specified in the form (Items in square brackets are optional.):

[46][protocol][@hostname|hostaddr][:service|port]

where: 46 specifies the IP version, IPv4 or IPv6 that applies to the following address. 6 may be be specified only if the UNIX dialect supports IPv6. If neither 4 nor 6 is specified, the following address applies to all IP versions. protocol is a protocol name - TCP, UDP hostname is an Internet host name. Unless a specific IP version is specified, open network files associated with host names of all versions will be selected. hostaddr is a numeric Internet IPv4 address in dot form; or an IPv6 numeric address in colon form, enclosed in brackets, if the UNIX dialect supports IPv6. When an IP version is selected, only its numeric addresses may be specified. service is an /etc/services name - e.g., smtp - or a list of them. port is a port number, or a list of them.

At least one address component - 4, 6, protocol, hostname, hostaddr, or service - must be supplied.
The @ prefix the host specification, is always required; as is the :, leading the port specification.
Specify either hostname or hostaddr.
Specify either service name list or port number list.
If a service name list is specified, the protocol may also need to be specified if the TCP, UDP and UDPLITE port numbers for the service name are different.

Service names and port numbers may be combined in a comma seperated list or numeric range by minus signs.
There may be no embedded spaces, service names may contain embedded minus signs, the starting entry of a range cannott be a service name;
it can be a port number,

Sample addresses:

       -i6 - IPv6 only
       TCP:25 - TCP and port 25
       @1.2.3.4 - Internet IPv4 host address 1.2.3.4
       @[3ffe:1ebc::1]:1234 - Internet IPv6 host address
       3ffe:1ebc::1, port 1234
       UDP:who - UDP who service port
       TCP@lsof.itap:513 - TCP, port 513 and host name lsof.itap
       tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
            service name smtp, port 99, host name foo
       tcp@bar:1-smtp - TCP, ports 1 through smtp, host bar
       :time - either TCP, UDP or UDPLITE time service port 

When -K and -a are both specified and the tasks of a main process are selected by other options, the main process will also be listed as though it were a task, but without a task ID. (See the description of the TID column in the OUTPUT section.)

Where the FreeBSD version supports threads, all threads will be listed with their IDs.

+Llc only files having a link count less than lc will be listed.
+L1& open files that have been unlinked.
+aL1 file_system & unlinked open files on the specified file system.

For other link count comparisons, use field output (-F) and a post-processing script or program.

-o -o 10

If only TCP and UDP files are to be listed, -i must be specified.
If only a single protocol files are to be listed, add its name as an argument to the -i

Examples:
List only network files with TCP state LISTEN, : lsof -s -iTCP -sTCP:LISTEN

List network files with all UDP states except Idle : -iUDP -sUDP:Idle

TCP state names include: CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV, ESTABLISHED, CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK, FIN_WAIT_2, and TIME_WAIT.
UDP states nclude: Unbound and Idle.

See the FAQ

For some types of files - sockets, FIFOs, pipes, etc. - sizes refers to their kernel buffers.

- terminates with sigINT or sigQUIT .
+ ends the first time no files are listed.
Exit code
0 if any files were ever listed;
1 none were ever listed.

Each cycle is marked with ========.
If field output is in progress (-F ), the marker is m and NL.

fmt for the marker line as to strftime(3).
When field output is requested with -F , fmt cannot contain the NL format, %n.
If fmt contains meta characters for the shell, it must be quoted.

Useful with field output and a supervising script.

       TCP or TPI state name
       QR=read queue length
       QS=send queue length
       SO=socket options and values
       SS=socket states
       TF=TCP flags and values
       WR=window read length
       WW=window write length

When the field output mode is in effect (See OUTPUT FOR OTHER PROGRAMS.) each item appears as a field with a T leading character.

Example: for queue lengths and state , use -Tqs.

Socket options, states, some values, TCP flags and one TCP value may be requested after SO_, so_, SS_, TCP_ and TF_ in the dialect's header files - most often <sys/socket.h>, <sys/socketvar.h> and <netinet/tcp_var.h>. See them for the meaning . SO= precedes socket options and values; SS=, socket states; and TF=, TCP flags and values. Value are preceeded by = and the name -- Example SO=LINGER=5, SO=QLIM=5, TF=MSS=512.

socket options and values, states, and TCP flags and values are be displayed in FAQ Why doesn't lsof report socket options, socket states, and TCP flags and values and Why doesn't lsof report the partial listen queue connection count?

Linux: skip the reporting of information on all open TCP, UDP and UDPLITE IPv4 and IPv6 files. Useful when the system has an extremely large number of open TCP, UDP and UDPLITE files

         cwd  current working directory;
         Lnn  library references (AIX);
         err  FD information error (see NAME column);
         jld  jail directory (FreeBSD);
         ltx  shared library text (code and data);
         Mxx  hex memory-mapped type number xx.
         m86  DOS Merge mapped file;
         mem  memory-mapped file;
         mmap memory-mapped device;
         pd   parent directory;
         rtd  root directory;
         tr   kernel trace file (OpenBSD);
         txt  program text (code and data);
         v86  VP/ix mapped file; 

         r for read 
         w for write
         u for read and write 
         - if mode unknown and lock character follows.
         space mode unknown and no lock character follows;

    lock characters 
         N fSolaris NFS lock of unknown type;
         r read lock on part of the file;
         R read lock on the entire file;
         w write lock on part of the file;
         W write lock on the entire file;
         u read and write lock of any length;
         U unknown 
         x SCO OpenServer Xenix lock on part of the file;
         X SCO OpenServer Xenix lock on the entire file;
         space no lock.

or

REG regular file
SMT shared memory transport file
STSO stream socket
IPv4 IPv4 socket
IPv6 open IPv6 network file
ax25 Linux AX.25 socket
inet Internet domain socket
lla HP-UX link level access
rte AF_ROUTE socket
sock socket of unknown domain
unix UNIX domain socket
x.25 HP-UX x.25 socket

LINK symbolic link
MPB multiplexed block
MPC multiplexed character
PIPE for pipes
PORT SYSV named pipe

Two lists may be displayed with entries separated by commas, the lists separated by a semicolon (;);

The first list may contain short-hand names for f_flag:

AIO     asynchronous I/O 
  (e.g., FAIO)
AP      append
ASYN    asynchronous I/O 
  (e.g., FASYNC)
BAS     block, test, and 
   set in use
BKIU    block if in use
BL      use block offsets
BSK     block seek
CA      copy avoid
CIO     concurrent I/O
CLON    clone
CLRD    CL read
CR      create
DF      defer
DFI     defer IND
DFLU    data flush
DIR     direct
DLY     delay
DOCL    do clone
DSYN    data-only integrity
DTY     must be a directory
EVO     event only
EX      open for exec
EXCL    exclusive open
FSYN    synchronous writes

GTTY      accessed via /dev/tty
HUP     HUP in progress
KERN    kernel
KIOC    kernel-issued ioctl
LCK     has lock
LG      large file
MBLK    stream message block
MK      mark
MNT     mount
MSYN    multiplex synchronization
NATM    dont update atime
NB      non-blocking I/O
NBDR    no BDRM check
NBIO    SYSV non-blocking I/O
NBF     n-buffering in effect
NC      no cache
ND      no delay
NDSY    no data synchronization
NET     network
NFLK    dont follow links
NMFS    NM file system
NOTO    disable background stop
NSH     no share
NTTY    no controlling TTY
OLRM    OLR mirror
PAIO    POSIX asynchronous I/O
PP      POSIX pipe

R       read
RC      file and 
  record locking cache
REV     revoked
RSH     shared read
RSYN    read synchronization
RW      read and write access
SL      shared lock
SNAP    cooked snapshot
SOCK    socket
SQSH    Sequent shared set on open
SQSV    Sequent SVM set on open
SQR     Sequent set repair on open
SQS1    Sequent full shared open
SQS2    Sequent partial shared open
STPI    stop I/O
SWR     synchronous read
SYN     file integrity while writing
TCPM    avoid TCP collision
TR      truncate
W       write
WKUP    parallel I/O synchronization
WTG     parallel I/O synchronization
VH      vhangup pending
VTXT    virtual text
XL      exclusive lock

From F* in files fcntl.h, linux /fs.h, sys/fcntl.c, sys/fcntlcom.h, and sys/file.h; see the lsof.h header file

The second list (after the semicolon) may contain short-hand names for kernel per-process open file flags :

ALLC    allocated
BR      the file has been read
BHUP    activity stopped by SIGHUP
BW      the file has been written
CLSG    closing
CX      close-on-exec (see fcntl(F_SETFD))
LCK     lock was applied
MP      memory-mapped
OPIP    open pending - in progress
RSVW    reserved wait
SHMT    UF_FSHMAT set (AIX)
USE     in use (multi-threaded)

• the device numbers, separated by commas, for a character special, block special, regular, directory or NFS file;
• memory& for a memory file system node under Tru64 UNIX;
• address of the private data area of a Solaris socket stream;
• a kernel reference address that identifies the file (The kernel reference address may be used for FIFOs, for example.);
• the base address or device name of a Linux AX.25 socket device. Usually only the lower thirty two bits of Tru64 UNIX kernel addresses are displayed.

the leading 0t& and 0x& identify an offset when the column may contain both a size and an offset (i.e., its title is SIZE/OFF). If the -o option is specified, lsof always displays the file offset (or nothing if no offset is available) and labels the column OFFSET. The offset always begins with 0t& or 0x& as described above.

The lsof user can control the switch from 0t& to 0x& with the -o o option. Consult its description for more information.

If the -s option is specified, lsof always displays the file size (or nothing if no size is available) and labels the col- umn SIZE. The -o and -s options are mutually exclusive; they cant both be specified.

For files that dont have a fixed size - e.g., dont reside on a disk device - lsof will display appropriate information about the current size or position of the file if it is available in the kernel structures that define the file.

• or the name of a file specified in the names option (after any symbolic links have been resolved);
• or the name of a character special or block special device;
• or the local and remote Internet addresses of a network file; the local host name or IP number is followed by a :, the port, ->&, and the two-part remote address; IP addresses may be reported as numbers or names, depending on the ±M, -n, and -P options; colon-separated IPv6 numbers are enclosed in square brackets; IPv4 INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and zero port numbers are represented by an asterisk (*); a UDP destination address may be followed by the amount of time elapsed since the last packet was sent to the destination; TCP, UDP and UDPLITE remote addresses may be followed by TCP/TPI information in parentheses - state (e.g., (ESTABLISHED)&, (Unbound)&), queue sizes, and window sizes (not all dialects) - in a fashion similar to what netstat(1) reports; see the -T option description or the description of the TCP/TPI field in OUTPUT FOR OTHER PROGRAMS for more information on state, queue size, and window size;
• or the address or name of a UNIX domain socket, possibly including a stream clone device name, a file system objects path name, local and foreign kernel addresses, socket pair information, and a bound vnode address;
• or the local and remote mount point names of an NFS file;
• or STR&, followed by the stream name;
• or a stream character device name, followed by ->& and the stream name or a list of stream module names, separated by ->&;
• or STR:& followed by the SCO OpenServer stream device and module names, separated by ->&;
• or system directory name, -- &, and as many components of the path name as lsof can find in the kernels name cache for selected dialects (See the KERNEL NAME CACHE section for more information.);
• or PIPE->&, followed by a Solaris kernel pipe destination address;
• or COMMON:&, followed by the vnode device information structures device name, for a Solaris common vnode;
• or the address family, followed by a slash (/), followed by fourteen comma-separated bytes of a non-Internet raw socket address;
• or the HP-UX x.25 local address, followed by the virtual connection number (if any), followed by the remote address (if any);
• or (dead)& for disassociated Tru64 UNIX files - typically terminal files that have been flagged with the TIOCNOTTY ioctl and closed by daemons;
• or rd=& and wr=& for the values of the read and write offsets of a FIFO;
• or clone n:/dev/event& for SCO OpenServer file clones of the /dev/event device, where n is the minor device number of the file;
• or (socketpair: n)& for a Solaris 2.6, 8, 9 or 10 UNIX domain socket, created by the socketpair(3N) network function;
• or no PCB& for socket files that do not have a protocol block associated with them, optionally followed by , CANTSEND- MORE& if sending on the socket has been disabled, or , CANTRCVMORE& if receiving on the socket has been disabled (e.g., by the shutdown(2) function);
• or the local and remote addresses of a Linux IPX socket file in the form :[:], followed in parentheses by the transmit and receive queue sizes, and the connection state;
• or dgram& or stream& for the type UnixWare 7.1.1 and above in-kernel UNIX domain sockets, followed by a : and the local path name when available, followed by ->& and the remote path name or kernel socket address in hexadecimal when available;
• or the association value, association index, endpoint value, local address, local port, remote address and remote port for Linux SCTP sockets.