LSFD(1) LSFD(1) lsfd - lsfd [] lsfd lsof(8) Linux. lsof, lsfd Linux; Linux , , . lsfd lsof; . . , , . --output - , . lsfd Libsmartcols . . --output --filter . lsfd --list-columns, . -l, --threads . -J, --json B JSON. -n, --noheadings . -o, --output , . . << *, . , + (, lsfd -o +DELETED) -r, --raw . --notruncate . -p, --pid pid- . pid- . , . pidof(1). . . -Q , PID, -Q (PID == 1), -p, -p 1, , -p , -p -Q. -i[4|6], --inet[=4|=6] List only IPv4 sockets and/or IPv6 sockets. -Q, --filter , , . . scols-filter(5) . -C, --counter :_ , --summary. lsfd . lsfd , -, . lsfd , --filter ; , , . See scols-filter(5) about filter_expr. label should not include { nor :. You can define multiple counters by specifying this option multiple times. . . --summary[=] ' only, append never. , only. . . --counter . , lsfd ( ) . ! --summary --json . --summary=only --json. --debug-filter . lsfd. --dump-counters , --summary. --hyperlink[=] Print paths as terminal hyperlinks. The mode can be set to "always", "never", or "auto". The optional argument when can be set to "auto", "never", or "always". If the when argument is omitted, it will default to "auto". The "auto" setting means that hyperlinks will only be used if the output is on a terminal. -H, --list-columns List available columns that you can specify at --output option. -h, --help . -V, --version . . < >. ! . . AINODECLASS <> inode. ASSOC <> ' . BLKDRV <> , /proc/devices. BPF-MAP.ID <> ' bpf. BPF-MAP.TYPE <> ' bpf. BPF-MAP.TYPE.RAW <> ' bpf ( ). BPF.NAME <> ' bpf. BPF-PROG.ID <> bpf. BPF-PROG.TAG <> Bpf. BPF-PROG.TYPE <> bpf. BPF-PROG.TYPE.RAW <> bpf ( ). CHRDRV <> , /proc/devices. COMMAND <> , . DELETED <-> . DEV <> , . DEVTYPE <> (blk, char nodev). ENDPOINTS IPC, . lsfd collects endpoints within the processes that lsfd scans; lsfd may miss some endpoints if you limits the processes with -p option. The format of the column depends on the object associated with the fd: FIFO, mqueue, ptmx pts PID,COMMAND,ASSOC[-r][-w] The last characters ([-r][-w]) represent the read and/or write mode of the endpoint. eventfd PID,COMMAND,ASSOC UNIX-STREAM PID,COMMAND,ASSOC[-r?][-w?] About the last characters ([-r?][-w?]), see the description of SOCK.SHUTDOWN. EVENTFD.ID <> eventfd. EVENTPOLL.TFDS <> , eventpoll. FD <> . FLAGS <> , . FUID <> - . INET.LADDR <> IP-. INET.RADDR <> IP-. INET6.LADDR <> IP6-. INET6.RADDR <> IP6-. INODE <> inode. INOTIFY.INODES <> Cooked version of INOTIFY.INODES.RAW. The format of the element is inode-number,source-of-inode. INOTIFY.INODES.RAW <> List of monitoring inodes. The format of the element is inode-number,device-major:device-minor. KNAME <> Raw file name extracted from from /proc/pid/fd/fd or /proc/pid/map_files/region. KTHREAD <-> , . MAJ:MIN <> , . MAPLEN <> ' ( ). MISCDEV <> , /proc/misc. MNTID <> . MODE <> (rwx). NAME <> Cooked version of KNAME. It is mostly same as KNAME. Some files have special formats and information sources: AF_VSOCK state=SOCK.STATE type=SOCK.TYPE laddr=VSOCK.LADDR[ raddr=VSOCK.RADDR] raddr is not shown for listening sockets. bpf-map id=BPF-MAP.ID type=BPF-MAP.TYPE[ name=BPF.NAME] bpf-prog id=BPF-PROG.ID type=BPF-PROG.TYPE tag= BPF-PROG.TAG [ name=BPF.NAME] eventpoll tfds=EVENTPOLL.TFDS eventfd id=EVENTFD.ID inotify inodes=INOTIFY.INODES misc:tun iface=TUN.IFACE NETLINK protocol=NETLINK.PROTOCOL[ lport=NETLINK.LPORT[ group=NETLINK.GROUPS]] PACKET type=SOCK.TYPE[ protocol=PACKET.PROTOCOL][ iface=PACKET.IFACE] pidfd pid=TARGET-PID comm=TARGET-COMMAND nspid=TARGET-NSPIDS lsfd extracts TARGET-PID and TARGET-NSPIDS from /proc/pid/fdinfo/fd. PING state=SOCK.STATE[ id=PING.ID][ laddr=INET.LADDR [ raddr=INET.RADDR]] PINGv6 state=SOCK.STATE[ id=PING.ID][ laddr=INET6.LADDR [ raddr=INET6.RADDR]] ptmx tty-index=PTMX.TTY-INDEX lsfd extracts PTMX.TTY-INDEX from /proc/pid/fdinfo/fd. RAW state=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET.LADDR [ raddr=INET.RADDR]]] RAWv6 state=SOCK.STATE[ protocol=RAW.PROTOCOL [ laddr=INET6.LADDR [ raddr=INET6.RADDR]]] signalfd mask=SIGNALFD.MASK TCP, TCPv6 state=SOCK.STATE[ laddr=TCP.LADDR [ raddr=TCP.RADDR]] timerfd clockid=TIMERFD.CLOCKID[ remaining=TIMERFD.REMAINING [ interval=TIMERFD.INTERVAL]] UDP, UDPv6 state=SOCK.STATE[ laddr=UDP.LADDR [ raddr=UDP.RADDR]] lsfd hides raddr= if UDP.RADDR is 0.0.0.0 and UDP.RPORT is 0. UDP-LITE, UDPLITEv6 state=SOCK.STATE[ laddr=UDPLITE.LADDR [ raddr=UDPLITE.RADDR]] UNIX-STREAM state=SOCK.STATE[ path=UNIX.PATH] UNIX state=SOCK.STATE[ path=UNIX.PATH] type=SOCK.TYPE Note that (deleted) markers are removed from this column. Refer to KNAME, DELETED, or XMODE to know the readability of the file from the file system. NETLINK.GROUPS <> netlink. NETLINK.LPORT <> netlink. NETLINK.PROTOCOL <> netlink. NLINK <> . NS.NAME <> Name (NS.TYPE:[INODE]) of the namespace specified with the file. NS.TYPE <> Type of the namespace specified with the file. The type is mnt, cgroup, uts, ipc, user, pid, net, time, or unknown. OWNER <> . PACKET.IFACE <> Interface name associated with the packet socket. PACKET.PROTOCOL <> L3, ' . PARTITION <> , /proc/partition. PID <> PID , . PIDFD.COMM <> , pidfd. PIDFD.NSPID <> Value of NSpid field in /proc/pid/fdinfo/fd of the pidfd. Quoted from kernel/fork.c of Linux source tree: If pid namespaces are supported then this function will also print the pid of a given pidfd refers to for all descendant pid namespaces starting from the current pid namespace of the instance, i.e. the Pid field and the first entry in the NSpid field will be identical. Note that this differs from the Pid and NSpid fields in /proc//status where Pid and NSpid are always shown relative to the pid namespace of the procfs instance. PIDFD.PID <> , pidfd. PING.ID <``> ICMP echo request id used on the PING socket. POS <> . RAW.PROTOCOL <> . RDEV <> ( ). SIGNALFD.MASK <> . SIZE <> . SOCK.LISTENING <-> . SOCK.NETS <> inode, , . SOCK.PROTONAME <> . SOCK.SHUTDOWN <> . [-r?] If the first character is r, the receptions are allowed. If it is -, the receptions are disallowed. If it is ?, the state is unknown. [-w?] If the second character is w, the transmissions are allowed. If it is -, the transmissions are disallowed. If it is ?, the state is unknown. SOCK.STATE <> . SOCK.TYPE <> Type of socket. Here type means the second parameter of socket system call: o stream o dgram o raw o rdm o seqpacket o dccp o packet SOURCE <> File system, partition, or device containing the file. For the association having ERROR as the value for TYPE column, lsfd fills this column with syscall:_errno_. STTYPE <> Raw file types returned from stat(2): BLK, CHR, DIR, FIFO, LINK, REG, SOCK, or UNKN. TCP.LADDR <> L3 (INET.LADDR INET6.LADDR) TCP. TCP.LPORT <> TCP. TCP.RADDR <> L3 (INET.RADDR INET6.RADDR) TCP. TCP.RPORT <> TCP. TID <> , . TIMERFD.CLOCKID <> . TIMERFD.INTERVAL <> . TIMERFD.REMAINING <> , . PTMX.TTY-INDEX <> tty . TUN.IFACE <> . TYPE <> Cooked version of STTYPE. It is same as STTYPE with exceptions. For SOCK, print the value for SOCK.PROTONAME. For UNKN, print the value for AINODECLASS if SOURCE is anon_inodefs. If lsfd gets an error when calling a syscall to know about a target file descriptor, lsfd fills this column for it with ERROR. UDP.LADDR <> IP- UDP. UDP.LPORT <> UDP. UDP.RADDR <> IP- UDP. UDP.RPORT <> UDP. UDPLITE.LADDR <> IP- UDPLite. UDPLITE.LPORT <> UDP. UDPLITE.RADDR <> IP- UDPLite. UDPLITE.RPORT <> UDP. UID <> . UNIX.PATH <> UNIX. USER <> . VSOCK.LADDR <>, VSOCK.RADDR <> Local VSOCK address. The format of the element is VSOCK.LCID:VSOCK.LPORT. Well-known CIDs will be decoded: "*", "hypervisor", "local", or "host". Well-known ports will be decoded: "*". VSOCK.LCID <>, VSOCK.RCID <> VSOCK. VSOCK.LPORT <>, VSOCK.RPORT <> VSOCK. XMODE <> Extended version of MODE. This column may grow; new letters may be appended to XMODE when lsfd supports a new state of file descriptors and/or memory mappings. [-r] opened of mapped for reading. This is also in MODE. [-w] opened of mapped for writing. This is also in MODE. [-x] mapped for executing the code. This is also in MODE. [-D] . . DELETED. [-Ll] locked or leased. l represents a read, a shared lock or a read lease. L represents a write or an exclusive lock or a write lease. If both read/shared and write/exclusive locks or leases are taken by a file descriptor, L is used as the flag. [-m] Multiplexed. If the file descriptor is targeted by a eventpoll file or classical system calls for multiplexing (select, pselect, poll, and ppoll), this bit flag is set. Note that if an invocation of the classical system calls is interrupted, lsfd may fail to mark m on the file descriptors monitored by the invocation. See restart_syscall(2). lsfd . -Q ( --filter). -o (*--output*) . , ' PID 1 PID 2: # lsfd -Q '(PID == 1) or (PID == 2)' # lsfd -Q '(PID == 1) || (PID == 2)' , # lsfd --pid 1,2 # lsfd --pid '1 2' pidof(1) , ' "firefox": # lsfd --pid "$(pidof firefox)" , PID 1: # lsfd -Q '(PID == 1) and (FD == 1)' # lsfd -Q '(PID == 1) && (FD == 1)' # lsfd -Q 'ASSOC == "exe"' # lsfd -Q 'ASSOC eq "exe"' , # lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u , ' # lsfd -Q 'DELETED' # lsfd -Q 'TYPE != "REG"' # lsfd -Q 'DEVTYPE == "blk"' , TYPE: # lsfd -Q 'TYPE == "BLK"' , <>: # lsfd -Q 'NAME =~ ".\*/dconf/.*"' , QEMU: # lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)' List timerfd files expired within 0.5 seconds: # lsfd -Q '(TIMERFD.remaining < 0.5) and (TIMERFD.remaining > 0.0)' , unix: # lsfd -Q 'TYPE == "UNIX-STREAM" && UNIX.PATH =~ ".+"' -oUNIX.PATH,PID,COMMAND,FD,SOCK.STATE,ENDPOINTS , unix: # lsfd -Q 'TYPE == "UNIX-STREAM" && UNIX.PATH == "@/tmp/.X11-unix/X0"' -oUNIX.PATH,PID,COMMAND,FD,SOCK.STATE,ENDPOINTS netlink unix: # lsfd --summary=only \ -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ -C 'unix sockets':'(NAME =~ "UNIX:.*")' VALUE COUNTER 57 netlink sockets 1552 unix sockets , JSON: # lsfd --summary=only --json \ -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \ -C 'unix sockets':'(NAME =~ "UNIX:.*")' { "lsfd-summary": [ { "value": 15, "counter": "netlink sockets" },{ "value": 798, "counter": "unix sockets" } ] } lsfd util-linux, 2.38. Masatake YAMATO , Karel Zak bpftool(8), bps(8), lslocks(8), lsof(8), pidof(1), proc(5), scols-filter(5), socket(2), ss(8), stat(2), vsock(7) lsfd util-linux, Linux . util-linux 2.41 2025-03-29 LSFD(1)