Elfatih Blog

How to: find open files by PID

find open files by PID in linux

netstat -tupln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:55000           0.0.0.0:*               LISTEN      52480/docker-proxy
tcp        0      0 0.0.0.0:1515            0.0.0.0:*               LISTEN      52518/docker-proxy
tcp        0      0 0.0.0.0:1514            0.0.0.0:*               LISTEN      52554/docker-proxy
tcp        0      0 0.0.0.0:9200            0.0.0.0:*               LISTEN      52451/docker-proxy
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      710/sshd: /usr/sbin
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      52785/docker-proxy
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      631/systemd-resolve
tcp6       0      0 :::55000                :::*                    LISTEN      52487/docker-proxy
tcp6       0      0 :::1515                 :::*                    LISTEN      52534/docker-proxy
tcp6       0      0 :::1514                 :::*                    LISTEN      52561/docker-proxy
tcp6       0      0 :::9200                 :::*                    LISTEN      52459/docker-proxy
tcp6       0      0 :::22                   :::*                    LISTEN      710/sshd: /usr/sbin
tcp6       0      0 :::443                  :::*                    LISTEN      52800/docker-proxy
udp        0      0 127.0.0.53:53           0.0.0.0:*                           631/systemd-resolve
udp        0      0 159.69.220.254:68       0.0.0.0:*                           629/systemd-network
udp        0      0 0.0.0.0:514             0.0.0.0:*                           52574/docker-proxy
udp6       0      0 :::514                  :::*                                52580/docker-proxy
lsof -p 52800
COMMAND     PID USER   FD      TYPE  DEVICE SIZE/OFF    NODE NAME
docker-pr 52800 root  cwd       DIR     8,1     4096       2 /
docker-pr 52800 root  rtd       DIR     8,1     4096       2 /
docker-pr 52800 root  txt       REG     8,1  2145411  154862 /usr/bin/docker-proxy
docker-pr 52800 root  mem       REG     8,1  2216304  137803 /usr/lib/x86_64-linux-gnu/libc.so.6
docker-pr 52800 root  mem       REG     8,1   240936  137764 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
docker-pr 52800 root    0r      CHR     1,3      0t0       5 /dev/null
docker-pr 52800 root    1w      CHR     1,3      0t0       5 /dev/null
docker-pr 52800 root    2w      CHR     1,3      0t0       5 /dev/null
docker-pr 52800 root    4u     IPv6 2762213      0t0     TCP *:https (LISTEN)
docker-pr 52800 root    6u  a_inode    0,14        0   12461 [eventpoll]
docker-pr 52800 root    7r     FIFO    0,13      0t0 2762214 pipe
docker-pr 52800 root    8w     FIFO    0,13      0t0 2762214 pipe
ss -tupln
Netid     State      Recv-Q     Send-Q               Local Address:Port          Peer Address:Port    Process
udp       UNCONN     0          0                    127.0.0.53%lo:53                 0.0.0.0:*        users:(("systemd-resolve",pid=631,fd=13))
udp       UNCONN     0          0              159.69.220.254%eth0:68                 0.0.0.0:*        users:(("systemd-network",pid=629,fd=15))
udp       UNCONN     0          0                          0.0.0.0:514                0.0.0.0:*        users:(("docker-proxy",pid=52574,fd=4))
udp       UNCONN     0          0                             [::]:514                   [::]:*        users:(("docker-proxy",pid=52580,fd=4))
tcp       LISTEN     0          4096                       0.0.0.0:9200               0.0.0.0:*        users:(("docker-proxy",pid=52451,fd=4))
tcp       LISTEN     0          4096                 127.0.0.53%lo:53                 0.0.0.0:*        users:(("systemd-resolve",pid=631,fd=14))
tcp       LISTEN     0          128                        0.0.0.0:22                 0.0.0.0:*        users:(("sshd",pid=710,fd=3))
tcp       LISTEN     0          4096                       0.0.0.0:55000              0.0.0.0:*        users:(("docker-proxy",pid=52480,fd=4))
tcp       LISTEN     0          4096                       0.0.0.0:443                0.0.0.0:*        users:(("docker-proxy",pid=52785,fd=4))
tcp       LISTEN     0          4096                       0.0.0.0:1514               0.0.0.0:*        users:(("docker-proxy",pid=52554,fd=4))
tcp       LISTEN     0          4096                       0.0.0.0:1515               0.0.0.0:*        users:(("docker-proxy",pid=52518,fd=4))
tcp       LISTEN     0          4096                          [::]:9200                  [::]:*        users:(("docker-proxy",pid=52459,fd=4))
tcp       LISTEN     0          128                           [::]:22                    [::]:*        users:(("sshd",pid=710,fd=4))
tcp       LISTEN     0          4096                          [::]:55000                 [::]:*        users:(("docker-proxy",pid=52487,fd=4))
tcp       LISTEN     0          4096                          [::]:443                   [::]:*        users:(("docker-proxy",pid=52800,fd=4))
tcp       LISTEN     0          4096                          [::]:1514                  [::]:*        users:(("docker-proxy",pid=52561,fd=4))
tcp       LISTEN     0          4096                          [::]:1515                  [::]:*        users:(("docker-proxy",pid=52534,fd=4))
ss -tupl
Netid    State      Recv-Q     Send-Q               Local Address:Port           Peer Address:Port    Process
udp      UNCONN     0          0                    127.0.0.53%lo:domain              0.0.0.0:*        users:(("systemd-resolve",pid=631,fd=13))
udp      UNCONN     0          0              159.69.220.254%eth0:bootpc              0.0.0.0:*        users:(("systemd-network",pid=629,fd=15))
udp      UNCONN     0          0                          0.0.0.0:syslog              0.0.0.0:*        users:(("docker-proxy",pid=52574,fd=4))
udp      UNCONN     0          0                             [::]:syslog                 [::]:*        users:(("docker-proxy",pid=52580,fd=4))
tcp      LISTEN     0          4096                       0.0.0.0:9200                0.0.0.0:*        users:(("docker-proxy",pid=52451,fd=4))
tcp      LISTEN     0          4096                 127.0.0.53%lo:domain              0.0.0.0:*        users:(("systemd-resolve",pid=631,fd=14))
tcp      LISTEN     0          128                        0.0.0.0:ssh                 0.0.0.0:*        users:(("sshd",pid=710,fd=3))
tcp      LISTEN     0          4096                       0.0.0.0:55000               0.0.0.0:*        users:(("docker-proxy",pid=52480,fd=4))
tcp      LISTEN     0          4096                       0.0.0.0:https               0.0.0.0:*        users:(("docker-proxy",pid=52785,fd=4))
tcp      LISTEN     0          4096                       0.0.0.0:1514                0.0.0.0:*        users:(("docker-proxy",pid=52554,fd=4))
tcp      LISTEN     0          4096                       0.0.0.0:1515                0.0.0.0:*        users:(("docker-proxy",pid=52518,fd=4))
tcp      LISTEN     0          4096                          [::]:9200                   [::]:*        users:(("docker-proxy",pid=52459,fd=4))
tcp      LISTEN     0          128                           [::]:ssh                    [::]:*        users:(("sshd",pid=710,fd=4))
tcp      LISTEN     0          4096                          [::]:55000                  [::]:*        users:(("docker-proxy",pid=52487,fd=4))
netstat -tupln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:55000           0.0.0.0:*               LISTEN      52480/docker-proxy
tcp        0      0 0.0.0.0:1515            0.0.0.0:*               LISTEN      52518/docker-proxy
tcp        0      0 0.0.0.0:1514            0.0.0.0:*               LISTEN      52554/docker-proxy
tcp        0      0 0.0.0.0:9200            0.0.0.0:*               LISTEN      52451/docker-proxy
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      710/sshd: /usr/sbin
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      52785/docker-proxy
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      631/systemd-resolve
tcp6       0      0 :::55000                :::*                    LISTEN      52487/docker-proxy
tcp6       0      0 :::1515                 :::*                    LISTEN      52534/docker-proxy
tcp6       0      0 :::1514                 :::*                    LISTEN      52561/docker-proxy
tcp6       0      0 :::9200                 :::*                    LISTEN      52459/docker-proxy
tcp6       0      0 :::22                   :::*                    LISTEN      710/sshd: /usr/sbin
tcp6       0      0 :::443                  :::*                    LISTEN      52800/docker-proxy
udp        0      0 127.0.0.53:53           0.0.0.0:*                           631/systemd-resolve
udp        0      0 159.69.220.254:68       0.0.0.0:*                           629/systemd-network
udp        0      0 0.0.0.0:514             0.0.0.0:*                           52574/docker-proxy
udp6       0      0 :::514                  :::*                                52580/docker-proxy

line

Follow me

ELFATIH KHALID (Eng., MSc.) | Cyber Security Advisor