Examining and Manipulating with Processes and their Actions

Question 1

Which command provides detailed information about files that are opened by processes?

Answer 1

lsof

Question 2

How does lsof help with a security analysis of a workstation?

Answer 2

helps to identify unauthorized or unexpected file accesses, which might indicate a security breach

Question 3

How does lsof help to track network connections?

Answer 3

by listing all network sockets in use, including TCP and UDP ports

Question 4

Which lsof flag lists all network connections and is useful in identifying open network sockets and the processes using them?

Answer 4

-i
~~~
ubuntu@ubuntu-cloud:~$ sudo lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 704 root 3u IPv4 22607 0t0 TCP *:ssh (LISTEN)
sshd 704 root 4u IPv6 22609 0t0 TCP *:ssh (LISTEN)
apache2 734 root 3u IPv6 22696 0t0 TCP *:http (LISTEN)
apache2 736 www-data 3u IPv6 22696 0t0 TCP *:http (LISTEN)
apache2 737 www-data 3u IPv6 22696 0t0 TCP *:http (LISTEN)

~~~

Question 5

Which lsof flag lists all TCP connections?

Answer 5

sudo lsof -iTCP

Question 6

Which lsof flag lists all UDP connections?

Answer 6

sudo lsof -iUDP

Question 7

Which lsof flag shows open files belonging to a specific user?

Answer 7

lsof -u {username}

Question 8

Which lsof flag shows files opened by a specific process ID (PID)?

Answer 8

lsof -p {pid}

Question 9

Which lsof flag avoids converting network numbers to host names?

Answer 9

sudo lsof -i -n
~~~
ubuntu@ubuntu-cloud:~$ sudo lsof -i -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
apache2 736 www-data 3u IPv6 22696 0t0 TCP *:http (LISTEN)
apache2 737 www-data 3u IPv6 22696 0t0 TCP *:http (LISTEN)
snapd 1226 root 17u IPv4 28570 0t0 TCP 10.0.80.80:55236->185.125.190.26:https (ESTABLISHED)
~~~

Question 10

How to do montiroring of a specific directory every 2 seconds for real-time observation with lsof?

Answer 10

lsof +D /path/to/directory -r 2

Question 11

How to use lsof to list files using a specific network port?

Answer 11

sudo lsof -i:{port}