Linux Command Index

Use it for packaging backups, logs, or source trees.

It is the standard archive tool on Linux.

• -c = create
• -x = extract
• -z = gzip
• -f = archive file
• -t = list contents

Use it to shrink text logs, dumps, or archives.

It is simple and widely supported.

• -k = keep original on some systems
• -d = decompress

Use it when sharing files with systems or users that expect zip format.

Zip is widely compatible, especially across platforms.

• -r = recursive

Use it to unpack downloaded software or shared bundles.

Essential for handling zip packages.

• -d DIR = extract into directory
• -l = list contents

Use it for backups, deployments, mirrors, and incremental copies.

It only transfers changed data and preserves metadata well.

• -a = archive mode
• -v = verbose
• -z = compress transfer
• -u = skip newer destination files
• --delete = remove files not in source

Use it when you need a quick secure copy to or from another host.

It is simple for one-off remote transfers.

• -r = recursive
• -P PORT = SSH port

Use it when you want a session for browsing and transferring remote files securely.

Useful when you need multiple remote file operations in one session.

• put = upload
• get = download
• ls/cd = remote navigation

Use it for remote administration, commands, tunneling, and copying.

It is the core remote admin tool on Linux.

• -p PORT = SSH port
• -i KEY = identity file
• -L = local port forward

Use it when setting up passwordless login or deploy access.

SSH keys are more secure and more convenient than passwords.

• -t TYPE = key type
• -C COMMENT = label

Use it for long-running jobs over SSH that must survive disconnects.

Prevents work from dying when your connection drops.

• -S NAME = session name
• -ls = list sessions
• Ctrl+A D = detach

Use it to find which process is using a file, directory, or network port.

It is one of the best commands for 'what is holding this open?' problems.

• -i :PORT = open network port
• -u USER = files open by user

Use it when a command fails mysteriously, hangs, or gets permission/file errors.

It shows what the program is trying to do at the OS level.

• -o FILE = write trace to file
• -p PID = attach to process

Use it when checking detected hardware like NICs, GPUs, or storage controllers.

Good first step for hardware identification.

• -nn = show numeric vendor and device IDs

Use it when checking whether USB hardware is detected.

Useful for adapters, dev boards, radios, storage, and keyboards.

• -t = tree view on some systems

Use it when checking overheating or fan-related issues.

It helps explain throttling and unexpected shutdowns.

• no common flags needed for routine use

Use it when disks act strangely, throw errors, or you suspect failing hardware.

It gives direct health info from the drive.

• -a = all SMART info
• -H = health summary

Use it when a system feels slow and you suspect disk bottlenecks.

It helps separate CPU problems from storage problems.

• -x = extended stats
• -z = omit idle devices

Use it when you need to answer what happened earlier, not just right now.

It is valuable for retrospective performance analysis.

• -u = CPU
• -r = memory
• -n DEV = network stats

Use it when tuning build jobs or checking CPU core availability.

Handy for parallelism settings like make -j.

• --all = total installed processors

Use it to auto-answer simple prompts or generate endless output for testing.

Small but surprisingly handy in scripts and pipelines.

• string = repeated text

Use it anytime you need to see whether the radio exists, what capabilities it has, whether it is linked, or what peers and surveys look like.

For modern Linux wireless work, this is one of the main tools and is much more useful than legacy wireless tools.

• dev = work with interfaces like wlan0
• phy = work with the physical radio
• list = show capabilities
• scan = trigger or print scan results
• station dump = show connected peer details
• survey dump = show channel usage/noise data

Use it when the radio seems missing or will not transmit and you suspect a kill switch or soft block.

It quickly tells you whether Linux itself is blocking the wireless device.

• list = show current block state
• unblock wifi = clear a software block for wireless devices

Use it only when checking older scripts or legacy driver setups that still reference wireless extensions.

It still appears in a lot of older how-tos, so it is useful to recognize, but for modern work iw is usually the better tool.

• interface = show status for a specific wireless interface

Use it when association looks fine but peers still cannot actually exchange traffic.

It helps separate a layer-2 neighbor problem from a higher-level routing or application problem.

• show = display neighbor entries
• dev IFACE = limit to one interface

Use it when packets leave but do not arrive cleanly, or when you suspect a path or MTU problem.

It is a fast next step after ping when basic reachability exists but something still breaks.

• -n = numeric output

Use it when you need to confirm what module you have, where it lives, which version it is, or what firmware and parameters it expects.

This is one of the quickest ways to validate driver/module assumptions during bring-up.

• -p = show module parameters
• -F field = show one field such as filename or firmware

Use it when you need to see whether the expected wireless, SPI, or supporting modules actually loaded.

It is the fastest loaded-module sanity check before going deeper.

• Use with grep to narrow to a module family

Use it for boot-time driver logs, supplicant failures, network service issues, and reproducing problems while watching live output.

For systemd-based systems it is one of the fastest routes to the real error.

• -b = current boot
• -k = kernel messages only
• -u UNIT = one service
• -f = follow live

Use it when a guide tells you to mount debugfs before inspecting ieee80211 or other kernel debug paths.

Some low-level debug views do not exist until the right pseudo-filesystem is mounted.

• -t TYPE = filesystem type such as debugfs

Use it when a wireless failure is too subtle for normal logs and you need kernel event tracing while reproducing the issue.

It gives much deeper visibility into wireless stack behavior than normal user-space logs.

• record = capture events into a trace file
• -e EVENT = select event groups
• report = print a recorded trace

Use it when the link appears up but traffic is failing and you need to see whether packets are actually present on the wire.

It quickly separates RF/link problems from IP, routing, and application problems.

• -i IFACE = capture on an interface
• -nn = do not resolve names
• -s0 = full packet capture
• -w FILE = write a pcap file

Use it when you need to confirm that the expected SPI or HaLow overlay is actually referenced in Pi boot config.

A missing or wrong overlay line can make the hardware look completely absent higher up the stack.

• -n = show matching line numbers
• 2>/dev/null = hide missing-file noise when only one path exists

Use it when verifying that Pi SPI bring-up succeeded far enough to expose spidev devices.

It is an immediate sanity check before blaming higher-level driver code.

• -l = show ownership and permissions

Use it when you are not sure where you are in the filesystem before editing, deleting, or copying files.

Prevents mistakes caused by running commands in the wrong directory.

• -P = show the physical path without symlinks
• -L = show the logical path (default in many shells)

Use it to inspect what exists in a directory before opening, moving, or deleting anything.

It is the fastest way to see names, permissions, sizes, and timestamps.

• -l = long listing
• -a = include hidden files
• -h = human-readable sizes
• -t = sort by time
• -R = recursive

Use it anytime you need to move to a different folder to run commands there.

Many Linux commands operate relative to the current directory.

• .. = parent directory
• ~ = home directory
• - = previous directory

Use it to quickly understand project layouts, log folders, or config directories.

It is much easier to visualize nested folders than with repeated ls calls.

• -L N = limit depth
• -a = include hidden files
• -d = show directories only

Use it when you know part of a name, need files changed recently, or need to bulk-process matches.

It is one of the most powerful ways to locate files on Linux.

• -name = match by name
• -type f|d = file or directory
• -mtime = modified days ago
• -size = size match
• -exec ... {} \; = run command on matches

Use it when you want a very fast filename search and do not need real-time freshness.

It is much faster than find for broad filename lookups.

• -i = case-insensitive
• -n N = limit results

Use it to inspect exact timestamps, permissions, inode numbers, or file size during troubleshooting.

It gives more precise details than ls.

• -c FORMAT = custom output format
• -f = show filesystem status

Use it when an extension is misleading or you are unsure what a file really is.

It helps confirm whether something is text, binary, image, archive, script, or executable.

• -i = show MIME type

Use it to duplicate files, stage backups, or clone directory trees.

It is the standard safe way to copy data before making changes.

• -r = recursive
• -a = archive mode (preserve metadata)
• -v = verbose
• -i = prompt before overwrite

Use it when reorganizing files or changing names without copying.

It is usually faster than copy+delete and is the standard rename tool.

• -i = prompt before overwrite
• -n = never overwrite
• -v = verbose

Use it for almost all modern networking checks instead of older ifconfig/route tools.

It is the current standard network management command.

• a|addr = addresses
• r|route = routes
• link = interfaces

Use it to see what is bound to a port or which connections are open.

It is faster and more modern than netstat.

• -t = TCP
• -u = UDP
• -l = listening
• -p = process
• -n = numeric

Use it as a first check for network path and basic DNS resolution.

It quickly tells you whether a host responds at all.

• -c N = send N packets
• -4|-6 = IPv4 or IPv6

Use it when a remote host is reachable poorly or traffic seems to die somewhere in between.

It helps isolate where along the route the problem appears.

• -n = numeric output
• -I = ICMP mode on some systems

Use it when traceroute is unavailable or you want a quick path check.

Useful lightweight alternative.

• no common flags needed for routine use

Use it for API calls, downloads, header checks, testing web services, and debugging redirects.

It is one of the most important network troubleshooting tools.

• -I = fetch headers only
• -L = follow redirects
• -o FILE = save to file
• -H = custom header
• -v = verbose

Use it for simple file grabs, recursive downloads, or resuming transfers.

It is straightforward and script-friendly.

• -O FILE = save as name
• -c = continue/resume
• -q = quiet

Use it when troubleshooting domain resolution, MX records, nameservers, or propagation.

It shows authoritative DNS answers clearly.

• A/AAAA/MX/TXT/NS = record types
• @SERVER = query a specific DNS server
• +short = compact output

Use it for quick hostname-to-IP checks or when dig is not installed.

It is widely available and easy to remember.

• server = specify DNS server

Use it to test whether a port is reachable or to create simple listeners.

Excellent for quick low-level network checks.

• -v = verbose
• -z = scan without sending data
• -l = listen

Use it for long jobs, multiple shells, or remote work that must survive disconnects.

It is extremely useful for serious terminal workflows.

• new -s NAME = new named session
• ls = list sessions
• attach -t NAME = reattach

Use it to install, remove, search, and update software packages.

It is the standard way to manage software on Debian systems.

• update = refresh package indexes
• install = install package
• remove = uninstall package
• search = search packages

Use it to inspect installed .deb packages or install a local .deb file.

Helpful when apt is not enough or when checking package contents.

• -l = list packages
• -i = install .deb
• -L = list files from installed package

Use it when scheduling recurring scripts or maintenance tasks.

Cron is one of the core Linux automation tools.

• -e = edit cron jobs
• -l = list cron jobs
• -r = remove cron jobs

Use it when you need a delayed one-off action instead of a recurring cron job.

It is simpler than creating temporary cron entries.

• TIME = natural-ish time expression depending on system

Use it to monitor disk, memory, process, or service state every few seconds.

It turns static commands into lightweight dashboards.

• -n SEC = refresh interval

Use it when starting a background job that should survive terminal logout.

Useful for one-off detached jobs when you do not need tmux/screen.

• & = background the process

Use it when managing jobs started from your current shell.

Helps you see what is suspended or running in the background.

• -l = include PIDs

Use it after pressing Ctrl+Z on a command you want to keep running.

Lets you recover a stopped task without starting over.

• %1 = specific job number

Use it when you need to interact with a job again.

It returns control of a shell job to the terminal.

• %1 = specific job number

Use it when access is denied or you need to adjust read/write/execute bits.

Permissions are a common cause of Linux issues.

• 755/644 = numeric modes
• u+x = symbolic mode
• -R = recursive

Use it when files belong to the wrong user or service account.

Wrong ownership often breaks websites, logs, and uploads.

• -R = recursive

Use it when newly created files keep getting the wrong default permissions.

It explains why new files are more or less open than expected.

• 022 = common default for readable files

Use it when storage is low or writes start failing.

It quickly tells you whether a filesystem is full.

• -h = human-readable
• -i = inode usage

Use it after df shows a full disk and you need to find what is consuming space.

It helps locate the big directories quickly.

• -s = summary only
• -h = human-readable
• -x = stay on one filesystem

Use it when working with extra disks, USB drives, ISO files, or troubleshooting mounts.

Many storage issues come down to what is or is not mounted.

• -o OPTIONS = mount options
• -t TYPE = filesystem type

Use it before removing media or remounting with new options.

Prevents corruption and releases the filesystem cleanly.

• -l = lazy unmount in stuck cases

Use it to understand disks and partitions before mounting or formatting.

It gives a clean storage map.

• -f = include filesystem info

Use it when building fstab entries or identifying drives reliably.

UUIDs are more stable than device names like /dev/sdb1.

• no common flags needed for routine use

Use it when examining or creating partitions on disks.

It is a core low-level storage tool.

• -l = list partition tables

Use it to see what is running, who owns it, and how much CPU or memory it uses.

It is the standard process inspection command.

• aux = BSD full format
• -ef = full format

Use it when a server feels slow or you need live CPU/memory insight.

It shows the biggest resource users in real time.

• Shift+M = sort by memory
• Shift+P = sort by CPU
• k = kill a process from top

Use it when you want a friendlier version of top with easier sorting and killing.

It is more readable and convenient than top for many admins.

• F3 = search
• F6 = sort
• F9 = kill

Use it to stop hung programs, reload daemons, or terminate jobs.

It gives direct control over process signals.

• -15 = TERM, graceful stop
• -9 = KILL, force stop
• -HUP = hangup/reload for many daemons

Use it when you know the process name but not the PID.

It is faster than finding each PID manually.

• -9 = force kill
• -u USER = kill only that user's processes

Use it when you need a PID for kill, renice, or inspection.

It avoids fragile grep pipelines.

• -a = show full command line
• -u USER = match a user

Use it when you want to stop matching processes directly without manually extracting PIDs.

It combines pgrep and kill into one step.

• -f = match full command line
• -u USER = match a user

Use it during performance checks or after a reboot.

It gives a quick health snapshot in one line.

• no common flags needed for routine use

Use it when you suspect RAM pressure or swap use.

It quickly answers whether memory is a bottleneck.

• -h = human-readable
• -m = show in MB

Use it when diagnosing general slowness, swap, or IO wait.

It gives a broader performance picture than free alone.

• 1 5 = sample every second 5 times
• -s = summary stats

Use it in scripts, quick tests, and pipelines.

It is a basic shell building block.

• -n = no trailing newline
• -e = enable escapes on many shells

Use it in scripts when you need predictable formatting.

More reliable than echo for structured output.

• format specifiers like %s %d

Use it to feed lists of files or values into another command.

It is great for turning pipeline output into arguments.

• -n N = max arguments per command
• -0 = use null delimiters

Use it when you want to see output live and save it at the same time.

Very useful for logging command output without losing terminal visibility.

• -a = append instead of overwrite

Use it when multiple versions may exist or you are unsure where a command comes from.

Helps debug PATH issues.

• -a = show all matches on PATH

Use it to tell whether something is an alias, builtin, function, or executable.

It is often more informative than which.

• -a = all resolutions

Use it to shorten frequent commands or make safer defaults.

Speeds up repetitive terminal work.

• no key flags; shell feature

Use it when configuring PATH, API keys, or runtime options in the current shell.

Many tools read behavior from environment variables.

• VAR=value = assign and export

Use it to inspect variables or launch a command with temporary overrides.

Useful for debugging shell and app environment issues.

• NAME=value = temporary variable override

Use it after changing shell config files or environment setup scripts.

It applies changes without opening a new shell.

• . file = shorthand syntax in POSIX shells

Use it when checking OS architecture, kernel version, or environment compatibility.

It helps confirm what system you are actually on.

• -a = all info
• -r = kernel release
• -m = machine architecture

Use it when confirming host identity or changing the hostname.

It gives cleaner host details than older methods.

• set-hostname NAME = change hostname

Use it to start, stop, restart, enable, disable, or inspect services.

It is one of the most important commands on modern Linux systems.

• status = inspect current state
• start|stop|restart = control service
• enable|disable = boot-time behavior

Use it on systems or guides that still reference it.

Useful for quick service actions, though systemctl is usually preferred.

• start|stop|restart|status

Use it to inspect service failures, boot logs, and recent system events.

It is often the first place to look when a service will not start.

• -u UNIT = logs for one service
• -n N = last N lines
• -xe = recent errors with context
• -b = current boot

Use it for hardware, driver, boot, USB, disk, and kernel error troubleshooting.

Kernel-level problems often show up here first.

• -T = human-readable timestamps
• -w = follow live

Use it when you are unsure which account or sudo context you are in.

Prevents running commands as the wrong user.

• no common flags needed

Use it when checking group membership or permissions issues.

It clearly shows UID, GID, and supplementary groups.

• user = inspect another user if permitted

Use it on shared systems to see who is active.

Useful for multi-user server awareness.

• -a = more detail on some systems

Use it when auditing access or checking reboot history.

It helps answer who logged in and when.

• reboot = show reboot events
• -n N = limit results

Use it for quick reads of short config or text files.

It is the fastest basic file viewer.

• -n = show line numbers
• -A = show non-printing characters

Use it for logs, configs, and long command output.

It is far easier than cat for large files.

• /pattern = search forward inside less
• N = next match
• G = end of file

Use it to inspect headers, config starts, or CSV columns.

It avoids opening an entire large file.

• -n N = number of lines

Use it for log troubleshooting, watching cron output, or seeing the newest lines.

It is one of the most useful commands for diagnostics.

• -n N = last N lines
• -f = follow appended lines

Use it to find errors, config values, IPs, usernames, or keywords in output and files.

It narrows huge amounts of text down to what matters.

• -i = case-insensitive
• -n = show line numbers
• -R = recursive
• -v = invert match
• -E = extended regex

Use it for quick in-place edits, substitutions, or extracting lines in scripts.

It is faster than opening a file manually for simple text changes.

• -n = suppress automatic printing
• -i = edit in place
• s/old/new/g = substitute globally

Use it for column-based logs, CSV-like data, or report summaries.

It is excellent for parsing structured text on the command line.

• -F = field separator
• NR = record number
• $1 $2 ... = fields

Use it to order output before review, diffing, or counting.

Sorted data is easier to compare and summarize.

• -n = numeric sort
• -r = reverse
• -u = unique

Use it after sort to count repeated values such as IPs, paths, or users.

It helps summarize repeated data quickly.

• -c = count occurrences
• -d = show duplicates only
• -u = show unique only

Use it when you only need a small slice of structured text.

It is lightweight and simple for delimiter-based extraction.

• -d = delimiter
• -f = fields
• -c = character positions