Linux commands, read one line at a time.
The shell first, then the network. Moving around, managing files and text, disks, processes, users and software — and then the commands that show each protocol at work on a real host. Every one comes with a session, the lines worth reading numbered, a note on what each of them means, and the switches worth knowing.
New to Linux? What it is, and how its tree is laid out →The shell
Moving around, and managing files, text, disks, processes, users and software.File management
Making, copying, moving and removing files and directories.
making room
Creates directories — one at a time, or a whole nested path in a single step with -p.
Read the session →a second copy
Copies files and directories, optionally preserving their permissions, ownership and timestamps.
Read the session →move, which is also rename
Moves a file or directory to another place, or gives it a new name — in Linux the two are the same operation.
Read the session →gone means gone
Removes files, and with -r whole directory trees. There is no recycle bin: what it removes is gone.
Read the session →make a file, or mark it as new
Creates an empty file, or sets the timestamps of one that already exists to now.
Read the session →many files into one
Packs a directory tree into a single archive file, and unpacks it again — optionally compressed.
Read the session →remove an empty directory
Removes a directory, but only if it is empty.
Read the session →one file, another name
Creates a link: a second name for a file, or a pointer to another path.
Read the session →an archive everyone can open
Packs files into a compressed .zip archive that Windows and macOS open natively.
Read the session →open a zip archive
Lists, tests and extracts the contents of a .zip archive.
Read the session →copy only the differences
Copies files between directories or machines, transferring only what has changed.
Read the session →Reading files
Printing a file, paging through it, searching it, and editing it.
print a file
Prints the contents of a file to the terminal, or joins several files into one stream.
Read the session →find the lines that match
Searches files for lines that match a pattern, and prints the lines it finds.
Read the session →the end of a file, live
Prints the last lines of a file, and with -f keeps printing new lines as they are written.
Read the session →the start of a file
Prints the first lines of a file — ten unless told otherwise.
Read the session →read a long file
Opens a file for reading one screen at a time, with scrolling and search.
Read the session →edit a file in the terminal
A simple text editor that runs in the terminal, with its commands listed on screen.
Read the session →print text
Prints its arguments — text, or the value of a variable — followed by a new line.
Read the session →Text processing
Counting, sorting, cutting and rewriting text as it passes through a pipe.
count lines and words
Counts the lines, words and bytes in a file or in the output of another command.
Read the session →put lines in order
Sorts lines of text — alphabetically, numerically, or by a chosen column.
Read the session →remove or count repeats
Collapses repeated neighbouring lines into one, optionally counting how many there were.
Read the session →pick out columns
Extracts chosen columns from each line, by separator or by character position.
Read the session →find and replace, without an editor
Edits text as it streams past: replaces, deletes or prints lines that match a pattern.
Read the session →work with columns
Processes text column by column: prints, filters and totals fields from each line.
Read the session →what changed between two files
Compares two files line by line and prints the lines that differ.
Read the session →save and show at once
Copies its input both to a file and to the screen, so output can be saved and watched at once.
Read the session →turn a list into arguments
Takes a list from standard input and runs a command with those items as its arguments.
Read the session →Disks & space
How full the disks are, what is filling them, and how they are attached.
how full are the disks
Shows how much space each mounted filesystem has: its size, how much is used, and how much is free.
Read the session →what is taking the space
Adds up how much disk space a directory and everything inside it is using.
Read the session →what disks are attached
Lists the disks and partitions attached to the machine, as a tree, with where each is mounted.
Read the session →attach a disk to the tree
Attaches a filesystem — a partition, USB stick or network share — to a directory in the tree.
Read the session →detach a disk safely
Detaches a mounted filesystem, after writing out any data still waiting in memory.
Read the session →read and edit the partition table
Shows a disk’s partition table, and edits it: creating, deleting and resizing partitions.
Read the session →System information
The kernel, the clock, the memory — and where to look things up.
which kernel is this
Prints the kernel name, its version, and the type of processor the system runs on.
Read the session →what is this machine called
Prints the name of the machine, and with -I the IP addresses it has.
Read the session →how long, and how busy
Shows how long the system has been running, how many users are logged in, and the load average.
Read the session →how much memory is left
Shows how much memory and swap the system has, how much is used, and how much is available.
Read the session →the time, in any format
Prints the current date and time, in any format, and converts between time zones and timestamps.
Read the session →the manual, built in
Opens the manual page for a command: what it does, every option, and often examples.
Read the session →what did I type
Lists the commands you have typed, numbered, so they can be searched and run again.
Read the session →a shortcut for a command
Defines a short name for a longer command, and lists the ones already defined.
Read the session →Process & service management
What is running, how to stop it, and what starts at boot.
what is running
Takes a snapshot of the running processes — who owns each, its process ID, and how much CPU and memory it is using.
Read the session →asking a process to stop
Sends a signal to a process — by default a polite request to finish, and with -9 an order the process cannot refuse.
Read the session →running the services
Controls systemd services — start, stop, restart, enable at boot — and reports the state of each one.
Read the session →what is the machine doing right now
Shows the running processes live, busiest first, with the load, CPU and memory of the whole machine above them.
Read the session →stop a process by name
Sends a signal to every process whose name matches a pattern — kill, without looking up the id first.
Read the session →background and foreground
Lists the commands this shell has running in the background or stopped, so they can be resumed.
Read the session →keep running after logout
Runs a command so that it keeps going after you log out or the terminal closes.
Read the session →read the system logs
Reads the systemd journal: the logs of the kernel and every service, filterable by unit, time and priority.
Read the session →run a command on a schedule
Edits and lists your scheduled jobs: commands that run by themselves at set times.
Read the session →power off or restart
Powers off or restarts the machine, now or at a set time, warning logged-in users first.
Read the session →Users & permissions
Who owns a file, who may touch it, and how to act as root.
who may do what
Changes the permission bits on a file or directory — who may read it, write to it, and execute it.
Read the session →whose file is it
Changes which user and which group own a file or directory.
Read the session →which group is it shared with
Changes the group that owns a file or directory, leaving its owner as it is.
Read the session →one command as root
Runs a single command as root, or as another user, after checking the caller is permitted to — and logs that it happened.
Read the session →which user am I
Prints the user name you are currently acting as.
Read the session →ids and group membership
Prints a user’s numeric id, primary group, and every group they belong to.
Read the session →become another user
Switches to another user account in the current terminal, after asking for that user’s password.
Read the session →change a password
Changes a password — your own, or as root anyone’s — and locks or unlocks accounts.
Read the session →create a user
Creates a new user account: an entry in /etc/passwd, a group, and optionally a home directory.
Read the session →change a user
Changes an existing account: its groups, shell, home directory, name, or whether it is locked.
Read the session →remove a user
Deletes a user account, and with -r its home directory and mail as well.
Read the session →create a group
Creates a new group, so that a set of users can be given the same access to files.
Read the session →Packages & software
Installing, updating and removing programs.
install software on Debian and Ubuntu
Installs, updates and removes software on Debian, Ubuntu and their relatives.
Read the session →the tool beneath apt
Installs a single .deb file, and answers questions about what is installed and which package owns a file.
Read the session →install software on Fedora and RHEL
Installs, updates and removes software on Fedora, RHEL, Rocky and AlmaLinux.
Read the session →The network
The commands that show a protocol at work.Interfaces & addressing
What the host has plugged in, and what it calls itself.
what this host calls itself
Lists every interface with the IPv4 and IPv6 addresses assigned to it, and adds or removes them.
Read the session →the link under the address
Shows and changes the layer-2 state of each interface — up or down, MTU, MAC address and carrier.
Read the session →the classic interface tool
The older command for showing and setting interface addresses — replaced by ip, but still met everywhere.
Read the session →network settings that persist
Controls NetworkManager from the terminal: lists connections, joins Wi-Fi, and sets addresses that survive a reboot.
Read the session →Routing & neighbours
Where a packet goes next, and whose MAC that is.
where a packet goes next
Prints the kernel routing table and answers which interface and next hop a given destination will use.
Read the session →whose MAC is that
Shows the neighbour table — the IP-to-MAC mappings learned by ARP for IPv4 and neighbour discovery for IPv6.
Read the session →Names
Asking the DNS, and finding out who the host asks.
asking the DNS directly
Sends a DNS query to a resolver of your choosing and prints the whole response, section by section.
Read the session →who this host really asks
Reports which DNS servers and search domains each interface is using under systemd-resolved, and resolves names the way the host does.
Read the session →a quick DNS lookup
Looks up a name in the DNS and prints the address — the simplest DNS query tool, found on Windows too.
Read the session →DNS answers in plain words
Resolves a name to its addresses, or an address to its name, printing one plain sentence per record.
Read the session →Sockets & transfer
What is listening, and what a request really sends.
what is listening here
Lists the sockets on a host — what is listening on which port, which connections are open, and which process owns each.
Read the session →one request, fully visible
Makes one request over HTTP, HTTPS or a dozen other protocols and shows every stage — the connection, the TLS handshake, the headers.
Read the session →download a file
Downloads files from the web to disk, resuming interrupted transfers and following links if asked.
Read the session →a shell on another machine
Opens an encrypted shell on another machine, and runs commands there as if you were sitting at it.
Read the session →copy files over SSH
Copies files between machines over SSH, with the same syntax as cp plus a host name.
Read the session →a raw network connection
Opens raw TCP or UDP connections: tests whether a port is open, and sends or listens for data.
Read the session →the classic socket listing
The older command for listing open ports, connections and the routing table — replaced by ss and ip.
Read the session →make an SSH key
Creates an SSH key pair: a private key that stays with you, and a public key that servers use to recognise you.
Read the session →Reachability
Whether the other end answers, and by which path.
is the other end there
Sends ICMP echo requests to a host and times the replies — the first test of whether the other end is reachable at all.
Read the session →which way the packet went
Reveals each router between this host and a destination by sending packets whose TTL expires one hop further each time.
Read the session →traceroute, continuously
Combines ping and traceroute: shows every hop on the path, with live loss and latency for each.
Read the session →what is open on that host
Scans hosts to find which ports are open and what services and versions are running on them.
Read the session →Capture & filtering
Reading packets off the wire, and deciding which may pass.
reading the wire itself
Captures packets from an interface and prints one line per packet, filtered by an expression you supply.
Read the session →which packets may pass
Reads and edits the kernel packet filter — the tables, chains and rules that decide which packets a host accepts, forwards or drops.
Read the session →the classic firewall
The long-standing Linux firewall command: lists and edits the rules that accept or drop packets.
Read the session →the firewall, made simple
A simple front end to the firewall: allow or deny a port in one short command, with safe defaults.
Read the session →