Code:
NODE is the node number of a local file;
or the inode number of an NFS file in the server host;
or the Internet protocol type - e. g, ``TCP'';
or ``STR'' for a stream;
or ``CCITT'' for an HP-UX x.25 socket;
or the IRQ or inode number of a Linux AX.25 socket device.
NAME is the name of the mount point and file system on which the
file resides;
or the name of a file specified in the names option (after
any symbolic links have been resolved);
or the name of a character special or block special device;
or the local and remote Internet addresses of a network
file; the local host name or IP number is followed by a
colon (':'), the port, ``->'', and the two-part remote
address; IP addresses may be reported as numbers or names,
depending on the +|-M, -n, and -P options; colon-separated
IPv6 numbers are enclosed in square brackets; IPv4
INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and
zero port numbers are represented by an asterisk ('*'); a
UDP destination address may be followed by the amount of
time elapsed since the last packet was sent to the destina-
tion; TCP, UDP and UDPLITE remote addresses may be followed
by TCP/TPI information in parentheses - state (e.g.,
``(ESTABLISHED)'', ``(Unbound)''), queue sizes, and window
sizes (not all dialects) - in a fashion similar to what net-
stat(1) reports; see the -T option description or the
description of the TCP/TPI field in OUTPUT FOR OTHER PRO-
GRAMS for more information on state, queue size, and window
size;
or the address or name of a UNIX domain socket, possibly
including a stream clone device name, a file system object's
path name, local and foreign kernel addresses, socket pair
information, and a bound vnode address;
or the local and remote mount point names of an NFS file;
or ``STR'', followed by the stream name;
or a stream character device name, followed by ``->'' and
the stream name or a list of stream module names, separated
by ``->'';
or ``STR:'' followed by the SCO OpenServer stream device and
module names, separated by ``->'';
or system directory name, `` -- '', and as many components
of the path name as lsof can find in the kernel's name cache
for selected dialects (See the KERNEL NAME CACHE section for
more information.);
or ``PIPE->'', followed by a Solaris kernel pipe destination
address;
or ``COMMON:'', followed by the vnode device information
structure's device name, for a Solaris common vnode;
or the address family, followed by a slash (`/'), followed
by fourteen comma-separated bytes of a non-Internet raw
socket address;
or the HP-UX x.25 local address, followed by the virtual
connection number (if any), followed by the remote address
(if any);
or ``(dead)'' for disassociated Tru64 UNIX files - typically
terminal files that have been flagged with the TIOCNOTTY
ioctl and closed by daemons;
or ``rd=<offset>'' and ``wr=<offset>'' for the values of the
read and write offsets of a FIFO;
or ``clone n:/dev/event'' for SCO OpenServer file clones of
the /dev/event device, where n is the minor device number of
the file;
or ``(socketpair: n)'' for a Solaris 2.6, 8, 9 or 10 UNIX
domain socket, created by the socketpair(3N) network func-
tion;
or ``no PCB'' for socket files that do not have a protocol
block associated with them, optionally followed by ``,
CANTSENDMORE'' if sending on the socket has been disabled,
or ``, CANTRCVMORE'' if receiving on the socket has been
disabled (e.g., by the shutdown(2) function);
or the local and remote addresses of a Linux IPX socket file
in the form <net>:[<node>:]<port>, followed in parentheses
by the transmit and receive queue sizes, and the connection
state;
or ``dgram'' or ``stream'' for the type UnixWare 7.1.1 and
above in-kernel UNIX domain sockets, followed by a colon
(':') and the local path name when available, followed by
``->'' and the remote path name or kernel socket address in
hexadecimal when available
12-07-2010
