Use the “lsof” command. lsof stands for List Open Files. lsof can save you a lot of time and hassle if you are just checking on the status of your machine, but more importantly can give you valuable information and point you in the right direction when troubleshooting what exactly your machine is up to. (especially when your machine had been hacked)
lsof is the Linux/Unix super-tool. I use it most for getting network connection related information from a system, but that’s just the beginning for this amazing and little-known application. lsof takes it a notch further. Linux treats most everything as a file. Sockets, devices, directories, etc, can all be viewed as files. When a process or application interacts with these files it has to “open” them if you will.
What is lsof command?
lsof is nothing but LiSt Open Files, which will show all the open files by
1. a process in system.
2. a user.
3. a command.
4. a network service.
5. a regular file.
6. a directory
7. a block special file
8. a character special file
9. an executing text reference
10. a library
11. a stream or
12. a network file (Internet socket, NFS file or UNIX domain socket.).
Usage
Typing the lsof command by itself lists all open files belonging to all active processes on the system:
$ lsof
To see which file opened for a device
$ lsof /dev/sdc
Show all connections with -i
$ lsof -i
To monitor network, what people are doing with what network services
$ watch lsof -i
To see all open internet files
$ lsof -i -U
Shows you all open files that have a link count less than 1, often indicative of a hacker hiding something
$ lsof +L1
More command by clicking here.


Lsof is one of very cool and muss have commands!
See also how to monitow your netwokrs connections with it.