parsed.org

Tips by tag: lsof

Find Out Which Package Contains a File by cygnus on Sep 19, 2005 08:18 AM

The apt-file program allows you to search the contents of all debian packages (installed and not installed) for files that you may need. For example, if you're compiling a program and need a header file but don't know which package provides the file, you can use apt-file to find out which package you should install to fix the problem:

# apt-get install apt-file
# apt-file update
# apt-file search foo.h

Be sure to run apt-file update periodically to update the file listing cache just as you also run apt-get update. The last command above will list any packages whose files match the specified search string, as well as the files that matched:

$ apt-file search bin/lsof
lsof: usr/bin/lsof
lsof: usr/sbin/lsof
aptapt-fileapt-getcommandsdebianlsofneatutilities
Listing Open Files in Solaris 10 by xinu on Aug 15, 2007 11:43 AM

Since lsof is tragically broken in Solaris 10, you have to try other methods of finding out which ports a given PID has opened:

# pfiles 2602 &> output

That will redirect stdout and stderr to a file (output) that will outline any files (and ports; remember, everything is a file) that the process has open.

commandslsofpfilesshellsolaris
Network Forensics by cygnus on Jan 21, 2005 08:31 AM

You can use the lsof (LiSt Open Files) utility to view information about which processes own file handles on a system. Since sockets map to file descriptors, lsof will show you which processes own socket connections. If you see that your machine is connected to another on TCP port 6234 (source or dest) and you want to find out which process(es) are responsible for the connection, run:

# lsof -ni tcp:6234

Note that when run as an unprivileged user, lsof will only show you file descriptors that you have permission to see. You must run lsof as root to see everything in the kernel.

commandsconnectionsdebuggingdescriptorsfilesystemlsofmonitoringnetworkpermissionsprocesssocketsutilities
RSS