lsof
Shares rank 38 of 86 privilege escalation tools by recommenders
Recommended for finding which process holds a port or file open without restarting anything. Critics find its flags and defaults awkward, and warn against killing its results.
Recommended for finding which process holds a port or file open without restarting anything. Critics find its flags and defaults awkward, and warn against killing its results.
14 people gave an opinion
- recommend it
- 9
- criticize it
- 5
- approval share
- 64%
Recommended in 7 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 1.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Finds processes using ports or files
“I just needed a simple alias local-tcp-listeners='lsof -iTCP -sTCP:LISTEN' in my ~/.bash_aliases”
Comment from 20 Mar 2026 in “Show HN: Sonar – A tiny CLI to see and kill whatever's running on localhost” “that's your clue to run lsof and look for "deleted" files that are open.”
Comment from 7 Apr 2026 in “Running Out of Disk Space in Production” “the quickest way to find the culprit without restarting anything”
Comment from 7 Apr 2026 in “Running Out of Disk Space in Production” - Comment from 16 Jan 2026 in “psc: The ps utility, with an eBPF twist and container context”
- Comment from 12 Aug 2026 in “`whoport` – which agent is using localhost:3000?”
Useful for troubleshooting
“some of the most often misunderstood or unknown tools that I find useful for troubleshooting”
Comment from 1 Oct 2026 on Hacker News “Tools such as strace, eBPF, lsof, ss, etc. have tremendous value.”
Comment from 11 Oct 2026 in “Unikernels were hard. key word: were”
What people warn about
Each mark is one comment
Awkward flags and defaults
“I kept running variations of lsof -i | grep LISTEN and then forgetting the flags the next time”
Comment from 10 Feb 2026 in “Show HN: Portview – a diagnostic-first port TUI (Rust, cross-platform)” “it's weird that both lsof and ss defaults are so awful”
Comment from 23 Dec 2025 in “Snitch – A friendlier ss/netstat”
Other privilege escalation tools people recommend
The four most recommended other privilege escalation tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 86 privilege escalation tools, rankedWhat people said
13 of the 14 comments that mention it, newest first. Each links to the original comment.
“Tools such as strace, eBPF, lsof, ss, etc. have tremendous value.”
“some of the most often misunderstood or unknown tools that I find useful for troubleshooting”
“the benchmark results are incredibly good”
“netstat and/or lsof will normally take care of that”
“killing the results of `lsof` is _not_ safe”
“the quickest way to find the culprit without restarting anything”
“that's your clue to run lsof and look for "deleted" files that are open.”
“it's certainly far more efficient than 'lsof'”
“I just needed a simple alias local-tcp-listeners='lsof -iTCP -sTCP:LISTEN' in my ~/.bash_aliases”
“it doesn’t really include all the information that I like”
“I kept running variations of lsof -i | grep LISTEN and then forgetting the flags the next time”
“is much more succinct with: lsof -i :443 -s TCP:ESTABLISHED”
“it's weird that both lsof and ss defaults are so awful”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.