Such programs will be using Netlink sockets to talk to the network hardware's driver directly.
lsof version 4.85 added support for Netlink sockets, but in my testing on CentOS 5.8, the feature doesn't appear to work very well. Perhaps it depends on features added in newer kernels.
However, it is possible to make a pretty good guess about when you've run into a Netlink socket. If you
cat /proc/net/netlink you get a list of open Netlink sockets, including the PID of processes that have them opened. Then if you
lsof -p $THEPID those PIDs, you'll find entries with
sock in the
TYPE column and
can't identify protocol in the
NAME column. It's not guaranteed that these are Netlink sockets, but it's a pretty good bet.
You might also infer that a given process is talking directly to an interface if it has files under
Now, all that having been said, I think your question is wrong-headed.
Let's say there is a command I haven't discovered. Call it
lsif -i wlan0, and say it returns a list of PIDs accessing the named interface. What would you be able to do with it which would allow you to "not disturb" processes using that interface, as you've requested? Were you planning on killing off all the processes using that interface first? That's pretty disturbing. :) Maybe you were instead thinking that dropping the interface out from underneath a process using it would somehow be harmful?
What, in the end, is so bad about
ifconfig wlan0 down?
Network interfaces are not storage devices. You don't have to flush data to disk and unmount them gracefully. Not breaking open sockets might be worthwhile, but as you already know, you can figure that out with
wpa_supplicant isn't going to sulk if you bounce its interface unceremoniously. (If it does, it's a bug and needs to be fixed; it wouldn't indicate some fault of yours.)
Well-written network programs cope with such things as a matter of course. Networks are unreliable. If a program can't cope with an interface being bounced, it also won't be able to cope with unplugged Ethernet cables, balky DSL modems, or backhoes.