lsof(8) -Pnl +M -i4
list open files
-P       This option inhibits the conversion of port numbers to port names for network files.  Inhibiting
         the  conversion  may  make lsof run a little faster.  It is also useful when port name lookup is
         not working properly.
-n       This option inhibits the conversion  of  network  numbers  to  host  names  for  network  files.
         Inhibiting  conversion may make lsof run faster.  It is also useful when host name lookup is not
         working properly.
-l       This  option  inhibits the conversion of user ID numbers to login names.  It is also useful when
         login name lookup is working improperly or slowly.
+|-M     Enables (+) or disables (-) the reporting of portmapper registrations for  local  TCP,  UDP  and
         UDPLITE  ports.   The  default reporting mode is set by the lsof builder with the HASPMAPENABLED
         #define in the dialect's machine.h header file; lsof  is  distributed  with  the  HASPMAPENABLED
         #define  deactivated,  so portmapper reporting is disabled by default and must be requested with
         +M.  Specifying lsof's -h or -?  option will report  the  default  mode.   Disabling  portmapper
         registration when it is already disabled or enabling it when already enabled is acceptable.

         When portmapper registration reporting is enabled, lsof displays the portmapper registration (if
         any) for local TCP, UDP or UDPLITE ports in  square  brackets  immediately  following  the  port
         numbers  or  service  names  -  e.g.,  ``:1234[name]''  or  ``:name[100083]''.  The registration
         information may be a name or number, depending on what the registering program supplied  to  the
         portmapper when it registered the port.

         When  portmapper  registration  reporting  is enabled, lsof may run a little more slowly or even
         become blocked when access  to  the  portmapper  becomes  congested  or  stopped.   Reverse  the
         reporting mode to determine if portmapper registration reporting is slowing or blocking lsof.

         For  purposes  of  portmapper  registration  reporting lsof considers a TCP, UDP or UDPLITE port
         local if: it is found in the local part of its containing kernel structure; or if it is  located
         in  the  foreign  part  of  its  containing  kernel structure and the local and foreign Internet
         addresses are the same; or if it is located  in  the  foreign  part  of  its  containing  kernel
         structure  and  the foreign Internet address is INADDR_LOOPBACK (127.0.0.1).  This rule may make
         lsof ignore some foreign ports on machines with multiple interfaces when  the  foreign  Internet
         address is on a different interface from the local one.

         See  the  lsof  FAQ  (The FAQ section gives its location.)  for further discussion of portmapper
         registration reporting issues.
-i [i]   This  option  selects  the  listing  of  files any of whose Internet address matches the address
         specified in i.  If no address is specified, this option selects the listing of all Internet and
         x.25 (HP-UX) network files.

                If  -i4  or  -i6 is specified with no following address, only files of the indicated IP version,
                IPv4 or IPv6, are displayed.  (An IPv6 specification may be used only if the  dialects  supports
                IPv6,  as  indicated  by  ``[46]''  and  ``IPv[46]''  in lsof's -h or -?  output.)  Sequentially
                specifying -i4, followed by -i6 is the same as specifying -i, and vice-versa.   Specifying  -i4,
                or -i6 after -i is the same as specifying -i4 or -i6 by itself.

                Multiple  addresses  (up  to a limit of 100) may be specified with multiple -i options.  (A port
                number or service name range is counted as one address.)  They are joined in a single  ORed  set
                before participating in AND option selection.

                An Internet address is specified in the form (Items in square brackets are optional.):

                [46][protocol][@hostname|hostaddr][:service|port]

                where:
                     46 specifies the IP version, IPv4 or IPv6
                          that applies to the following address.
                          '6' may be be specified only if the UNIX
                          dialect supports IPv6.  If neither '4' nor
                          '6' is specified, the following address
                          applies to all IP versions.
                     protocol is a protocol name - TCP, UDP
                     hostname is an Internet host name.  Unless a
                          specific IP version is specified, open
                          network files associated with host names
                          of all versions will be selected.
                     hostaddr is a numeric Internet IPv4 address in
                          dot form; or an IPv6 numeric address in
                          colon form, enclosed in brackets, if the
                          UNIX dialect supports IPv6.  When an IP
                          version is selected, only its numeric
                          addresses may be specified.
                     service is an /etc/services name - e.g., smtp -
                          or a list of them.
                     port is a port number, or a list of them.

                IPv6 options may be used only if the UNIX dialect supports IPv6.  To see if the dialect supports
                IPv6, run lsof and specify the -h or -?  (help) option.  If the displayed description of the  -i
                option contains ``[46]'' and ``IPv[46]'', IPv6 is supported.

                IPv4  host names and addresses may not be specified if network file selection is limited to IPv6
                with -i 6.  IPv6 host names and addresses may not be specified  if  network  file  selection  is
                limited  to  IPv4  with  -i  4.   When  an open IPv4 network file's address is mapped in an IPv6
                address, the open file's type will be IPv6, not IPv4, and its display will be selected  by  '6',
                not '4'.

                At  least  one address component - 4, 6, protocol, ,IR hostname , hostaddr, or service - must be
                supplied.  The `@' character, leading the host specification, is always required; as is the `:',
                leading  the  port  specification.  Specify either hostname or hostaddr.  Specify either service
                name list or port number list.  If a service name list is specified, the protocol may also  need
                to  be  specified  if  the TCP, UDP and UDPLITE port numbers for the service name are different.
                Use any case - lower or upper - for protocol.

                Service names and port numbers may be combined in a list whose entries are separated  by  commas
                and  whose numeric range entries are separated by minus signs.  There may be no embedded spaces,
                and all service names must belong to the specified protocol.  Since service  names  may  contain
                embedded  minus  signs,  the starting entry of a range can't be a service name; it can be a port
                number, however.

                Here are some sample addresses:

-i6 - IPv6 only
TCP:25 - TCP and port 25
@1.2.3.4 - Internet IPv4 host address 1.2.3.4
@[3ffe:1ebc::1]:1234 - Internet IPv6 host address
     3ffe:1ebc::1, port 1234
UDP:who - UDP who service port
TCP@lsof.itap:513 - TCP, port 513 and host name lsof.itap
tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
     service name smtp, port 99, host name foo
tcp@bar:1-smtp - TCP, ports 1 through smtp, host bar
:time - either TCP, UDP or UDPLITE time service port
source manpages: lsof