The lsof standing for "list open files", yet its definition of a file is very broad: not only files and directories, but also block and character devices or streams and libraries, as well as sockets, both UNIX and network ones. Therefore, it can be use for some networking investigations. For example I use it to started qucikly find occupided ports.
On Linux I used to use netstat. Once I needed to do it on MacOS. GNU and BSD netstat differs, and it includes diffrent options and syntax [2,3]. Additionally, in Linux the net-tools package providing netstat is depricated, and it's replaced with ss. Side note ss works similar to the BSD flavour of netstat: directly communicating with kernel, rather than relaying on the /proc filesystem. Luckly, I remembered that lsof can do some network scanning, and should work identical on both systems.
When using lsof for a network investigation the key is the option -i, which allows intorigation of network addresses [4]. There are extra options to refine the filter. For example, to get a list of TCP ports run:
lsof -P -n -i TCP -s TCP:LISTEN
- -P -- (ports) shows port numbers (do not translate to port names)
- -n -- (numbers) shows IP addresses (do not translate to hostnames)
- -i -- (internet) shows internet file; can be further narrowed by extra terms
- TCP -- (protocol) narrows type of internet files to show to the given protocol
- -s -- (state) shows only files defined by a protocol:state pair which follows
- TCP:LISTEN (protocol:state) -- the pair narrowing output only to TCP connection in the LISTEN state
For more examples of lsof usage check [1]. Just note that some of the commands presented ther might lack -s for the state definition.
Links
