Examining and Manipulating with Processes and their Actions

Question 1

Which command provides detailed information about files that are opened by processes?

Answer 1

lsof

Question 2

How does lsof help with a security analysis of a workstation?

Answer 2

helps to identify unauthorized or unexpected file accesses, which might indicate a security breach

Question 3

How does lsof help to track network connections?

Answer 3

by listing all network sockets in use, including TCP and UDP ports

Question 4

Which lsof flag lists all network connections and is useful in identifying open network sockets and the processes using them?

Answer 4

-i

ubuntu@ubuntu-cloud:~$ sudo lsof -i
COMMAND   PID             USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd      704             root    3u  IPv4  22607      0t0  TCP *:ssh (LISTEN)
sshd      704             root    4u  IPv6  22609      0t0  TCP *:ssh (LISTEN)
apache2   734             root    3u  IPv6  22696      0t0  TCP *:http (LISTEN)
apache2   736         www-data    3u  IPv6  22696      0t0  TCP *:http (LISTEN)
apache2   737         www-data    3u  IPv6  22696      0t0  TCP *:http (LISTEN)

Question 5

Which lsof flag lists all TCP connections?

Answer 5

sudo lsof -iTCP

Question 6

Which lsof flag lists all UDP connections?

Answer 6

sudo lsof -iUDP

Question 7

Which lsof flag shows open files belonging to a specific user?

Answer 7

lsof -u {username}

Question 8

Which lsof flag shows files opened by a specific process ID (PID)?

Answer 8

lsof -p {pid}

Question 9

Which lsof flag avoids converting network numbers to host names?

Answer 9

sudo lsof -i -n

ubuntu@ubuntu-cloud:~$ sudo lsof -i -n
COMMAND    PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
apache2    736        www-data    3u  IPv6  22696      0t0  TCP *:http (LISTEN)
apache2    737        www-data    3u  IPv6  22696      0t0  TCP *:http (LISTEN)
snapd     1226            root   17u  IPv4  28570      0t0  TCP 10.0.80.80:55236->185.125.190.26:https (ESTABLISHED)

Question 10

How to do montiroring of a specific directory every 2 seconds for real-time observation with lsof?

Answer 10

lsof +D /path/to/directory -r 2

Question 11

How to use lsof to list files using a specific network port?

Answer 11

sudo lsof -i:{port}