lsof is a command used to find out which files are open by which process. But as the Unix way of life is that everything is a file, lsof can be use for a lot more then that:
List processes which opened a specific file
# lsof /var/log/syslog
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 13315 root 7w REG 0,36 246213 15074839 /var/log/syslog
List opened files under a directory
# lsof +D /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
php5-fpm 1968 root 2w REG 0,36 434 15074914 /var/log/php5-fpm.log
php5-fpm 1968 root 5w REG 0,36 434 15074914 /var/log/php5-fpm.log
apache2 7466 root 2w REG 0,36 279 15076913 /var/log/apache2/error.log
...
List all open files by a specific process
# lsof -p 1968
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
php5-fpm 1968 root cwd DIR 0,36 4096 15073281 /
php5-fpm 1968 root rtd DIR 0,36 4096 15073281 /
php5-fpm 1968 root txt REG 0,36 9110296 15081382 /usr/sbin/php5-fpm
php5-fpm 1968 root mem REG 253,0 15081382 /usr/sbin/php5-fpm (path dev=0,36)
...
List opened files based on process names
# lsof -c ssh
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 8463 root cwd DIR 0,36 4096 15073281 /
sshd 8463 root rtd DIR 0,36 4096 15073281 /
sshd 8463 root txt REG 0,36 787080 15076801 /usr/sbin/sshd
sshd 8463 root mem REG 253,0 15077206 /lib/x86_64-linux-gnu/libnss_files-2.19.so (path dev=0,36)
...
You can use the -c parameter, multiple time.
Show network connections
# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 636 daber 3u IPv4 1381573 0t0 TCP 10.10.32.54:54188->b1.vpn.ti.smile.fr:ssh (ESTABLISHED)
ssh 834 daber 3u IPv4 1385285 0t0 TCP 10.10.32.54:60902->b3.vpn.ti.smile.fr:ssh (ESTABLISHED)
ssh 892 daber 3u IPv4 1386338 0t0 TCP 10.10.32.54:39496->b2.vpn.ti.smile.fr:ssh (ESTABLISHED)
chromium 1476 daber 87u IPv4 1429223 0t0 TCP zapan.dhcp.mpl.intranet:49404->par10s09-in-f35.1e100.net:https (ESTABLISHED)
...
You can also add additional parameters to filter on the port number. For example to only show SSH connections: lsof -i TCP:22
You can also specify a range: lsof -i TCP:1-1024
Show all files opened by a specific user
# lsof -u daber
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 636 daber cwd DIR 0,35 28672 13238276 /home/daber
ssh 636 daber rtd DIR 8,1 4096 2 /
ssh 636 daber txt REG 8,1 666088 659561 /usr/bin/ssh
ssh 636 daber mem REG 8,1 22952 524315 /lib/x86_64-linux-gnu/libnss_dns-2.19.so
...
Note that you can use ^ to inverse the command (exclude only a particular user).
Kill all process of particular user
# kill `lsof -t -u daber`