Explain lsof code

What this lsof sample shows

COMMAND, PID, USER and FD

Each row is one open file or network socket of one process. The Node.js server showed up as node-Main with PID 1643167, and USER is the account running it, shown here as devuser. FD is the file's number inside that process: 23u is file 23, open for reading and writing.

LISTEN and ESTABLISHED

TCP *:hbci (LISTEN) is the server waiting for connections on every address. The 2 ESTABLISHED rows are 1 connection seen from both ends: the server's side, localhost:hbci->localhost:49166, and the python3 client's side, localhost:49166->localhost:hbci.

-n and -P

hbci is port 3000: lsof swapped the number for the name /etc/services gives it. -P keeps port numbers and -n keeps addresses as numbers, so lsof -nP showed *:3000 and 127.0.0.1:3000 instead.

-t and -sTCP:LISTEN

-t prints only PIDs, for use with kill. -sTCP:LISTEN keeps only listening sockets, so with both it printed the server's PID alone. After kill 1643167, a new server started on port 3000 and printed listening on 3000.

Good to know

• Run with lsof 4.99.7, Node.js 25.7.0 and Python 3.14.7 on Linux. The server is a 3-line Node.js HTTP server, and the client is a Python script that keeps 1 connection open, like a browser tab. The account name is replaced with devuser, which has the same length, so the columns stay aligned.
• After the server was stopped, the client's row stayed, now in state CLOSE_WAIT: the server's end had closed and the client hadn't closed its own yet.
• What -n, -P, -t and u mean is from the lsof manual. lsof also ships with macOS, where Apple publishes its source (github.com/apple-oss-distributions/lsof); this page didn't run it on a Mac.

Watch out: kill $(lsof -t -i :3000) can stop more than the server. lsof -t -i :3000 printed 2 PIDs, the server's and the client's, because the client had a connection to port 3000. If that client is your browser, kill sends it the signal too. Add -sTCP:LISTEN to get only the server.