Discovering Network Connections

249

r means that the file is opened for read-only access.

w means that the file is opened for write-only access.

u means that the file is opened for read and write access.

You may see other letters following the file descriptor number — see the man lsof page for full details.

If you don’t see a number in the FD column, lsof is showing you the usage type for that file:

cwd: This file (actually a directory) is the current working directory for the process.

rtd: This directory is the root directory for the process. (It’s almost always /, except when the process is running in a chroot jail.)

mem: This is a memory-mapped file (usually a shared object library).

txt: This is the full pathname of the program.

Again, you may see other usage types, and man lsof will give you a complete list.

Reading file types

The file type column (fifth from the left, labeled TYPE) tells you what kind of file you’re looking at. Linux is known for treating just about anything as if it were a file, so you’ll see a variety of file types. A typical lsof report shows the following file types:

REG: A plain old disk file

DIR: A directory

FIFO: A named pipe (a connection between two or more processes)

CHR: A character-type device (such as a serial port or terminal)

BLK: A block-type device (such as a raw disk drive or CD)

unix: A UNIX-domain socket (an interprocess communication link)

IPv4: An IPv4 network connection

IPv6: An IPv6 network connection

Discovering Network

Connections

When you’re viewing network information with lsof, the last two file types in the preceding list — IPv4 and IPv6 — are the ones that you’re interested in. IPv4 and IPv6 files are active network connections or network service providers (v4 and v6 refer to the network address type).

When lsof finds a network connection, rather than show you a filename, it displays the IP address of the network interface on your computer, the local port number, the IP address of the remote side of the connection, and the connection state.

Here’s an example:

bastille:38517->louvre (ESTABLISHED)

bastille is the name of the local network interface, 38517 is the TCP port assigned to this session, louvre is the name of the computer at the other end of the connection, and (ESTABLISHED) tells you that the network link is up and running.

The local interface name is useful when you have more than one network card in your computer.

Connections listed as (ESTABLISHED) show you active network connections (such as an ssh session or a Web browser connection). If you see a connection listed as (LISTEN), you’re looking at a network server. For example, if you see

*.ssh (LISTEN)

250 Technique 36: Streamlining Your Network Surveillance

you’re viewing the sshd server. (In this case, the leftmost column should tell you that the sshd program is servicing this network port.)

In addition to simply looking for network connections, you can do some other handy things to check out those connections:

List all listening servers: You can combine the lsof command with grep to discover the network servers running on your system. The command

# lsof | grep LISTEN

generates a list of services that are listening on your system — Web servers, ssh daemons, VNC servers, and so on (see Figure 36-2).

• Figure 36-2: The list of open services.

If you find that lsof is running very slowly, add -n to the command line. The -n flag tells lsof to turn off host name resolution. You’ll see IP addresses rather than host names, but you’ll see them much more quickly.

Add components next to port names: If you see a server that displays a port number rather than a service name, you can save yourself time by adding a new entry to the /etc/services file:

1.Track down the program that’s serving up the anonymous port.

2.Open /etc/services with kate (or your favorite editor):

# kate /etc/services

3.Add a line at the end of the file with the service name, port number/protocol, and a comment out to the right, as shown in Figure 36-3.

•Figure 36-3: Adding a friendlier server description.

4.Save the file and then exit.

The next time you check for open services, you’ll see the more recognizable name rather than the port number.

List all servers and active connections: If you want to see a list of all the servers and active connections on your computer, enter the following command:

# lsof -i

This command shows you not only the ports that are open and waiting for a connection, but also the ports that are in use.

Other Timesaving lsof Tricks

lsof is a good tool for looking at the network connections on your computer, but it has a few more tricks up its sleeve.

First off, you can limit the files displayed by lsof in a number of ways: