LOADING N0PERM…
Diagnostic tool that lists all open files and active sockets associated with running processes in the Unix/Linux operating system.
A standard LINUX utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Debian / Ubuntu
sudo apt install lsofForensic process-socket correlation:
- List all listening network ports: sudo lsof -i -P -n | grep LISTEN
- Identify which process holds a file open: sudo lsof /var/log/auth.log
- Find all network activity of specific user: sudo lsof -u www-data -i
- Find open sockets on specific port: sudo lsof -i :8080