Linux · text processing

diff

what changed between two files

diff reports the differences between two files. If they are identical it prints nothing; otherwise it shows which lines to remove and which to add to turn the first into the second.

Lines starting - are only in the old file; lines starting + are only in the new.

Compares

Two files

or two directories with -r

Identical

No output

exit status 0

Readable form

-u

unified, with context

Result

A patch

that patch can apply

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashdiffutils

$ diff -u sshd_config.bak sshd_config

1--- sshd_config.bak 2026-09-29 17:03:11.000000000 +0530

+++ sshd_config 2026-09-30 10:41:03.000000000 +0530

2@@ -12,7 +12,7 @@

Include /etc/ssh/sshd_config.d/*.conf

3-#Port 22

+Port 2222

#AddressFamily any

4$ diff -q a.conf b.conf

Files a.conf and b.conf differ

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The two files

--- is the old file and +++ the new, each with its modification time.

Where the change is

The hunk header: seven lines starting at line 12 in each file.

The change itself

The line with - was removed and the line with + was added. Lines starting with a space are unchanged context.

-q only says whether they differ

No detail — useful in a script, or when comparing many files.

Switches

A switch changes how the command behaves. These are the ones used day to day; man diff lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-u: Unified format, with lines of context. The readable one.
-r: Recursive: compare directories and everything in them.
-q: Brief: report only whether the files differ.
-y: Side by side, in two columns.
-i: Ignore differences in case.
-w: Ignore all differences in spacing.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

diff -r dir1 dir2

Compares two directory trees, file by file.

diff -y a.txt b.txt

Shows the two files side by side.

diff <(ssh host1 cat /etc/hosts) <(ssh host2 cat /etc/hosts)

Compares a file on two machines.

diff -u old new > change.patch

Saves the differences as a patch file.

In cybersecurity

Knowing exactly what changed is the core of both review and investigation.

Review before applying

After editing a configuration file, diff it against the backup. An unexpected changed line is caught before the service is restarted.

Spotting tampering

Comparing a file with a known-good copy from a backup or the package shows precisely what an intruder altered.

Comparing lists over time

Save the list of users, listening ports or cron jobs each day and diff today's against yesterday's: additions stand out.

Filed under

Text processing

Read alongside

catPrints the contents of a file to the terminal, or joins several files into one stream.sortSorts lines of text — alphabetically, numerically, or by a chosen column.