ServerWatch content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
When discussing lsof and
open files a few weeks ago, I also mentioned that lsof -i
will show you information about which IP sockets are open.
Tip of the Trade: lsof is a handy way to check for security problems or keep an eye on how your machines are interacting with the wider internet.
This can be useful in checking for security problems or just to keep an
eye on how much your machines are interacting with the wider internet. Here’s
a little sample output:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
dhclient 2242 root 6u IPv4 6110 UDP *:bootpc
cupsd 2928 root 1u IPv4 260191390 TCP
localhost:ipp (LISTEN)
mysqld 5763 mysql 4u IPv4 187454609 TCP
thisserver.example.com:38530->thatserver.example.com:ldaps (CLOSE_WAIT)
sshd 17005 root 3u IPv6 264275196 TCP
thisserver.example.com:ssh->thatserver.example.com:53043 (ESTABLISHED)
You’ll quite often see two reports from a single command, one for TCP and one
for UDP. The PID and user is shown for each IP socket, so if you see
something suspicious, you can investigate further (e.g., with ps -l
5763 to get more information on the mysql process here, or
by looking at /proc/5763/).
For a real-time look at what’s being opened where, try watch lsof
-i (hit Ctrl-C to exit). To check out who’s connecting to your
web server, specify the port with lsof -i :80: You’ll get a list that
shows which IP addresses or hosts are looking at your web server right now.
You can also check connections to a particular host with lsof
-i@hostname.example.com (or give the IP address instead).
You can get similar information on which Unix sockets are open on your
machine, with lsof -U. Unix sockets handle inter-process
communication, a bit like IP sockets but within a single machine rather than
across a network. This information can be useful when using
strace to track down bugs.
