lsof

lsof stands for list open files. It lists opened files and the processes using them.

Directory

lsof /home/thomas

COMMAND    PID   USER  FD   TYPE DEVICE SIZE/OFF    NODE NAME
pipewire  1025 thomas cwd    DIR  253,0     4096 7340035 /home/thomas
wireplumb 1026 thomas cwd    DIR  253,0     4096 7340035 /home/thomas

Pass in a pid

lsof -p 1175

COMMAND    PID   USER  FD      TYPE             DEVICE SIZE/OFF    NODE NAME
at-spi-bu 1175 thomas cwd       DIR              253,0     4096 7340035 /home/thomas
at-spi-bu 1175 thomas rtd       DIR              259,2     4096       2 /
at-spi-bu 1175 thomas txt       REG              259,2    26760 1225154 /usr/lib/at-spi-bus-launcher

Networking

List programs using or listening to ports

lsof -i

COMMAND    PID   USER  FD   TYPE DEVICE SIZE/OFF NODE NAME
signal-de 3250 thomas  39u  IPv4 149863      0t0  TCP archlinux:44304->ac88393aca5853df7.awsglobalaccelerator.com:https (ESTABLISHED)
slack     3602 thomas  18u  IPv4 138442      0t0  TCP archlinux:57950->ec2-18-169-55-40.eu-west-2.compute.amazonaws.com:https (ESTABLISHED)
firefox   6177 thomas 147u  IPv4 138842      0t0  TCP archlinux:cresco-control->93.243.107.34.bc.googleusercontent.com:https (ESTABLISHED)

Filter by specific port

lsof -i:22
lsof -i4:22 # limit to IPv4 addresses

COMMAND    PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
sshd     45448   root    3u  IPv4  640237      0t0  TCP *:ssh (LISTEN)
sshd     45448   root    4u  IPv6  640239      0t0  TCP *:ssh (LISTEN)
sshd    185660   root    4u  IPv4 2554538      0t0  TCP static.18.113.203.116.clients.your-server.de:ssh->0542cb12.skybroadband.com:57744 (ESTABLISHED)