lsof
Processes and system
Usage
lsof -i :<port>Lists every open file and socket, which is how you answer "what is holding port 3000"; without sudo you only see your own processes, so an empty result does not mean the port is free.
Common flags
| Flag | Meaning |
|---|---|
| -i :3000 | Which process holds port 3000, in either direction. |
| -i TCP -sTCP:LISTEN | Listening TCP sockets only. |
| -t | Print bare PIDs, made for piping into kill. |
| -p <pid> | Everything one process has open. |
| -u <user> | One user's open files. |
| +D <dir> | Every open file underneath a directory, recursively. |
| -n -P | Skip host and port name lookups, which makes it much faster. |
Examples
lsof -i :3000The classic answer to "something is already using port 3000".
kill -9 $(lsof -ti :3000)Kill whatever holds that port.
sudo lsof +D /var/logFind the process keeping a deleted log file open.
What is running and what is eating the machine. Identifying it comes before killing it.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does lsof do?
Lists every open file and socket, which is how you answer "what is holding port 3000"; without sudo you only see your own processes, so an empty result does not mean the port is free.
Q. How do I type it?
lsof -i :<port> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
7 are listed here; the full set is in man lsof. This command sits under Processes and system.
Related commands
man page: man lsof