16. lsof and fuser

To build statically-linked binaries you'll need the source:


freshmeat.net or perdue.edu lsof


sourceforge.net fuser, killall, pstree, pidof

16.1. fuser

fuser identifies processes using a given file. On Linux, use fuser -m.

To determine which processes are accessing the current working directory

 
    fuser .        # Solaris
    fuser -m .     # Linux

    724c  1463c  1532c  1675c  5129cm...
To determine which process is responsible for this
    tcp        0      0 localhost.localdom:6012 localhost.localdo:40404 ESTABLISHED
TCP connection on port 6011
    prompt>fuser -n tcp 6011      # Linux, not Solaris
    6011/tcp:      9060

    prompt>ps auxw | grep 9060
    umits     9060  0.0  0.3   9412  1592 ?        S    Jun02   4:38 sshd: umits@pts/36

16.2. lsof

lsof lists open files — that is "regular" files, network connections, directories... Output shows processes and their open files. Example output:

  COMMAND   PID     USER   FD    TYPE   DEVICE     SIZE      NODE NAME
  init        1     root  cwd     DIR      3,2     1024         2 /
  init        1     root  rtd     DIR      3,2     1024         2 /
  init        1     root  txt     REG      3,2    31432    105874 /sbin/  init
  init        1     root  mem     REG      3,2    90248     85518 /lib/ld-2.3.2.so
  init        1     root  mem     REG      3,2  1244688     85606 /lib/libc-2.3.2.so
  init        1     root   10u   FIFO      3,2              73308 /dev/initctl
  keventd     2     root  cwd     DIR      3,2     1024         2 /
  .
  .
  ssh       724   simonh  cwd     DIR      3,8     4096     32129 /home/simonh
  ssh       724   simonh  rtd     DIR      3,2     1024         2 /
  ssh       724   simonh  txt     REG      3,5   226168    244449 /usr/bin/ssh
  ssh       724   simonh  mem     REG      3,2    90248     85518 /lib/ld-2.3.2.so
  ssh       724   simonh  mem     REG      3,2    64924     85644 /lib/libresolv-2.3.2.so
  ssh       724   simonh  mem     REG      3,5  1042728    358474 \
                                                    /usr/lib/i686/cmov/libcrypto.so.0.9.7
  .
  .
  ssh       724   simonh    1u    CHR    136,9                 11 /dev/pts/9
  ssh       724   simonh    2u    CHR    136,9                 11 /dev/pts/9
  ssh       724   simonh    3u   IPv4  2027003                TCP \
                       mctalby.mc.man.ac.uk:55914->darkstar.umist.ac.uk:ssh (ESTABLISHED)
  .
  .
  bash     1463   simonh  cwd     DIR      3,8     4096     32129 /home/simonh
  bash     1463   simonh  rtd     DIR      3,2     1024         2 /
  bash     1463   simonh  txt     REG      3,2   667180     69229 /bin/bash
  bash     1463   simonh  DEL     REG      3,2              85599 /lib/ld-2.3.2.so.dpkg-new
  .
  .

Output can be restricted to only network connections:

  lsof -i

  COMMAND     PID        USER   FD   TYPE  DEVICE SIZE NODE NAME
  ssh         724      simonh    3u  IPv4 2027003       TCP \
                         mctalby.mc.man.ac.uk:55914->darkstar.umist.ac.uk:ssh (ESTABLISHED)
  ssh        1532      simonh    3u  IPv4 1054576       TCP \
                             mctalby.mc.man.ac.uk:60035->bohrg3.man.ac.uk:484 (ESTABLISHED)
  ssh        1690      simonh    3u  IPv4 1055280       TCP \
                             mctalby.mc.man.ac.uk:60069->bohrg3.man.ac.uk:484 (ESTABLISHED)
  .
  .
  firefox-b  2125         si2    3u  IPv4 2000944       TCP \
                      localhost.localdomain:54229->localhost.localdomain:6013 (ESTABLISHED)
  firefox-b  2125         si2   27u  IPv4 2029291       TCP \
                      localhost.localdomain:56045->localhost.localdomain:6013 (ESTABLISHED)
  sshd       2947        root    3u  IPv4 2628966       TCP *:ssh (LISTEN)
  emacs      3201       umits    4u  IPv4 2480726       TCP \
                      localhost.localdomain:52828->localhost.localdomain:6011 (ESTABLISHED)
  XFree86    3448        root    1u  IPv4   10336       TCP *:x11 (LISTEN)
  httpproxy  4801        root    0u  IPv4 2635892       TCP \
                         mctalby.mc.man.ac.uk:httpproxy->61.175.228.137:44104 (ESTABLISHED)
  httpproxy  4801        root    1u  IPv4 2635892       TCP \
                         mctalby.mc.man.ac.uk:httpproxy->61.175.228.137:44104 (ESTABLISHED)
  .  
  .  

To determine which process is responsible for this

    tcp        0      0 localhost.localdom:6012 localhost.localdo:40404 ESTABLISHED
try
  lsof -i -n | grep 6012

  firefox-b 10930  mc   3u  IPv4 2230197  TCP 127.0.0.1:40404->127.0.0.1:6012 (ESTABLISHED)
  sshd      15330  mc  10u  IPv4   68837  TCP 127.0.0.1:6012 (LISTEN)
  sshd      15330  mc  12u  IPv4 2230199  TCP 127.0.0.1:6012->127.0.0.1:40404 (ESTABLISHED)
  sshd      15330  mc  13u  IPv4  863595  TCP 127.0.0.1:6012->127.0.0.1:49477 (ESTABLISHED)
  emacs     18021  mc   4u  IPv4  863593  TCP 127.0.0.1:49477->127.0.0.1:6012 (ESTABLISHED)
  firefox-b 19079  mc   3u  IPv4 2230197  TCP 127.0.0.1:40404->127.0.0.1:6012 (ESTABLISHED)
  firefox-b 19090  mc   3u  IPv4 2230197  TCP 127.0.0.1:40404->127.0.0.1:6012 (ESTABLISHED)
  firefox-b 19091  mc   3u  IPv4 2230197  TCP 127.0.0.1:40404->127.0.0.1:6012 (ESTABLISHED)
  firefox-b 19093  mc   3u  IPv4 2230197  TCP 127.0.0.1:40404->127.0.0.1:6012 (ESTABLISHED)

...previousup (conts)next...



About this document:

Produced from the SGML: /home/umits/public_html/_unix_security/_reml_grp/diagnostic_forensic_tools.reml
On: 23/10/2005 at 13:29:12
Options: reml2 -i noindex -l long -o html -p multiple