This article is part of the article series "CommandLineFu One-Liners Explained."
<- previous article next article ->
CommandLineFu Explained

Here are the next ten top one-liners from the commandlinefu website. The first post about the topic became massively popular and received over 100,000 views in the first two days.

Before I dive into the next ten one-liners, I want to take the chance and promote the other three article series on one-liners that I have written:

Update: Russian translation now available.

Alright, so here are today's one-liners:

#11. Edit the command you typed in your favorite editor

$ command <CTRL-x CTRL-e>

This one-liner opens the so-far typed command in your favorite text editor for further editing. This is handy if you are typing a lengthier shell command. After you have done editing the command, quit from your editor successfully to execute it. To cancel execution, just erase it. If you quit unsuccessfully, the command you had typed before diving into the editor will be executed.

Actually, I have to educate you, it's not a feature of the shell per se but a feature of the readline library that most shells use for command line processing. This particular binding CTRL-x CTRL-e only works in readline emacs editing mode. The other mode is readline vi editing mode, in which the same can be accomplished by pressing ESC and then v.

The emacs editing mode is the default in all the shells that use the readline library. The usual command to change between the modes is set -o vi to change to vi editing mode and set -o emacs to change back to emacs editing mode.

To change the editor, export the $EDITOR shell variable to your preference. For example, to set the default editor to pico, type export EDITOR=pico.

Another way to edit commands in a text editor is to use fc shell builtin (at least bash has this builtin). The fc command opens the previous edited command in your favorite text editor. It's easy to remember the fc command because it stands for "fix command."

Remember the ^foo^bar^ command from the first top ten one-liners? You can emulate this behavior by typing fc -s foo=bar. It will replace foo with bar in the previous command and execute it.

#12. Empty a file or create a new file

$ > file.txt

This one-liner either wipes the file called file.txt empty or creates a new file called file.txt.

The shell first checks if the file file.txt exists. If it does, the shell opens it and wipes it clean. If it doesn't exist, the shell creates the file and opens it. Next the shell proceeds to redirecting standard output to the opened file descriptor. Since there is nothing on the standard output, the command succeeds, closes the file descriptor, leaving the file empty.

Creating a new empty file is also called touching and can be done by $ touch file.txt command. The touch command can also be used for changing timestamps of the commands. Touch, however, won't wipe the file clean, it will only change the access and modification timestamps to the current time.

#13. Create a tunnel from localhost:2001 to somemachine:80

$ ssh -N -L2001:localhost:80 somemachine

This one-liner creates a tunnel from your computer's port 2001 to somemachine's port 80. Each time you connect to port 2001 on your machine, your connection gets tunneled to somemachine:80.

The -L option can be summarized as -L port:host:hostport. Whenever a connection is made to localhost:port, the connection is forwarded over the secure channel, and a connection is made to host:hostport from the remote machine.

The -N option makes sure you don't run shell as you connect to somemachine.

To make things more concrete, here is another example:

$ ssh -f -N somemachine

This one-liner creates a tunnel from your computer's port 2001 to via somemachine. Each time you connect to localhost:2001, ssh tunnels your request via somemachine, where it tries to open a connection to

Notice the additional -f flag - it makes ssh daemonize (go into background) so it didn't consume a terminal.

#14. Reset terminal

$ reset

This command resets the terminal. You know, when you have accidentally output binary data to the console, it becomes messed up. The reset command usually cleans it up. It does that by sending a bunch of special byte sequences to the terminal. The terminal interprets them as special commands and executes them.

Here is what BusyBox's reset command does:


It sends a bunch of escape codes and a bunch of CSI commands. Here is what they mean:

  • \033c: "ESC c" - sends reset to the terminal.
  • \033(K: "ESC ( K" - reloads the screen output mapping table.
  • \033[J: "ESC [ J" - erases display.
  • \033[0m: "ESC [ 0 m" - resets all display attributes to their defaults.
  • \033[?25h: "ESC [ ? 25 h" - makes cursor visible.

#15. Tweet from the shell

$ curl -u user:pass -d status='Tweeting from the shell'

This one-liner tweets your message from the terminal. It uses the curl program to HTTP POST your tweet via Twitter's API.

The -u user:pass argument sets the login and password to use for authentication. If you don't wish your password to be saved in the shell history, omit the :pass part and curl will prompt you for the password as it tries to authenticate. Oh, and while we are at shell history, another way to omit password from being saved in the history is to start the command with a space! For example, <space>curl ... won't save the curl command to the shell history.

The -d status='...' instructs curl to use the HTTP POST method for the request and send status=... as POST data.

Finally, is the API URL to POST the data to.

Talking about Twitter, I'd love if you followed me on Twitter! :)

#16. Execute a command at midnight

$ echo cmd | at midnight

This one-liner sends the shell command cmd to the at-daemon (atd) for execution at midnight.

The at command is light on the execution-time argument, you may write things like 4pm tomorrow to execute it at 4pm tomorrow, 9pm next year to run it on the same date at 9pm the next year, 6pm + 10 days to run it at 6pm after 10 days, or now +1minute to run it after a minute.

Use atq command to list all the jobs that are scheduled for execution and atrm to remove a job from the queue.

Compared to the universally known cron, at is suitable for one-time jobs. For example, you'd use cron to execute a job every day at midnight but you would use at to execute a job only today at midnight.

Also be aware that if the load is greater than some number (for one processor systems the default is 0.8), then atd will not execute the command! That can be fixed by specifying a greater max load to atd via -l argument.

#17. Output your microphone to other computer's speaker

$ dd if=/dev/dsp | ssh username@host dd of=/dev/dsp

The default sound device on Linux is /dev/dsp. It can be both written to and read from. If it's read from then the audio subsystem will read the data from the microphone. If it's written to, it will send audio to your speaker.

This one-liner reads audio from your microphone via the dd if=/dev/dsp command (if stands for input file) and pipes it as standard input to ssh. Ssh, in turn, opens a connection to a computer at host and runs the dd of=/dev/dsp (of stands for output file) on it. Dd of=/dev/dsp receives the standard input that ssh received from dd if=/dev/dsp. The result is that your microphone gets output on host computer's speaker.

Want to scare your colleague? Dump /dev/urandom to his speaker by dd if=/dev/urandom.

#18. Create and mount a temporary RAM partition

# mount -t tmpfs -o size=1024m tmpfs /mnt 

This command creates a temporary RAM filesystem of 1GB (1024m) and mounts it at /mnt. The -t flag to mount specifies the filesystem type and the -o size=1024m passes the size sets the filesystem size.

If it doesn't work, make sure your kernel was compiled to support the tmpfs. If tmpfs was compiled as a module, make sure to load it via modprobe tmpfs. If it still doesn't work, you'll have to recompile your kernel.

To unmount the ram disk, use the umount /mnt command (as root). But remember that mounting at /mnt is not the best practice. Better mount your drive to /mnt/tmpfs or a similar path.

If you wish your filesystem to grow dynamically, use ramfs filesystem type instead of tmpfs. Another note: tmpfs may use swap, while ramfs won't.

#19. Compare a remote file with a local file

$ ssh user@host cat /path/to/remotefile | diff /path/to/localfile -

This one-liner diffs the file /path/to/localfile on local machine with a file /path/to/remotefile on host machine.

It first opens a connection via ssh to host and executes the cat /path/to/remotefile command there. The shell then takes the output and pipes it to diff /path/to/localfile - command. The second argument - to diff tells it to diff the file /path/to/localfile against standard input. That's it.

#20. Find out which programs listen on which TCP ports

# netstat -tlnp

This is an easy one. Netstat is the standard utility for listing information about Linux networking subsystem. In this particular one-liner it's called with -tlnp arguments:

  • -t causes netstat to only list information about TCP sockets.
  • -l causes netstat to only list information about listening sockets.
  • -n causes netstat not to do reverse lookups on the IPs.
  • -p causes netstat to print the PID and name of the program to which the socket belongs (requires root).

To find more detailed info about open sockets on your computer, use the lsof utility. See my article "A Unix Utility You Should Know About: lsof" for more information.

That's it for today.

Tune in the next time for "Another Ten One-Liners from CommandLineFu Explained". There are many more nifty commands to write about. But for now, have fun and see ya!

PS. Follow me on twitter for updates!

This article is part of the article series "CommandLineFu One-Liners Explained."
<- previous article next article ->


March 24, 2010, 16:07

#17. Output your microphone to other computer’s speaker

That alone was worth reading the whole post :D I'm going to have sooooo much fun! That aside, great post series, really nice to follow and get ideas from. Thanks!

Esteban Permalink
March 24, 2010, 17:24

#18 should be

umount /mnt
Drew Permalink
March 24, 2010, 18:38

I can suggest using aplay and arecord to use your alsa devices for playing and recording sound. Unless you have a hardware mixer on your sound card, only one application can have it open at a time, which is usually ALSA or the pulseaudio server.

Nishant Permalink
March 24, 2010, 20:08

I have to agree with Peter, too bad I can't find anyone to try this on :-)

March 24, 2010, 22:12

#15. Wow. Totally just tweeted from the command line!

Helloooo libcurl!

March 24, 2010, 22:55

Awsome tips, I want more ;)

Simon Permalink
March 25, 2010, 07:01

#15: if you don't want a command to show up in the shell history, just add one or more spaces in front of it.

Guess where I found that one... yeah, on CommandLineFu :D

argv Permalink
March 25, 2010, 07:58
# grep for interesting one-liners
jot -w "links -source" - 0 3000 25 | sh -v >> commandlinefu && tput cl
grep  commandlinefu | less

i realise curl and a few other downloading utilities have support for sequential downloading; this might shorten the one-liner.

March 25, 2010, 14:15

Personally, for #19 I prefer:

vimdiff scp://user@host//path/to/remotefile /path/to/localfile

Really enjoying this series. :-)

_pingu Permalink
March 26, 2010, 05:29

I like your posts. Did you ever read "Unix Power Tools"? You would enjoy it.

mcai8sh4 Permalink
March 26, 2010, 14:58

Nice informative post (like the previous)!

It's good that you not only teach the command, but also explain 'why' it works. Top work.

One thing I have noticed, when using ctrl-x ctrl-e to open the current command in your fav editor (for me vim) after you save, quit and execute that command, my aliases don't work until the second attempt (not sure if that makes sense)

Keep up the good work


March 26, 2010, 17:49

I'm probably be considered a newbie in Linux. These posts help me a lot. One thing that really bothers me is that most man pages do not have samples/examples of usage. That just drives me nuts. For example - the man pages for find.

I still can't figure out how to use find properly. How about a dummies blog post find?

_pingu Permalink
March 27, 2010, 19:22

mcai8sh4 wrote:
"after you save, quit and execute that command, my aliases don’t work until the second attempt (not sure if that makes sense)"

I can comfirm that for Kubuntu 9.10

renormalization_group Permalink
March 28, 2010, 15:00

Excellent posts !! go on that path.. we love u.

April 03, 2010, 22:19

Hi peter. I really need your help. Can u put up some command line script to download rm files from in LINUX. Its such a daunting task any help would be appreciated...pls

April 05, 2010, 10:38

#19. Compare a remote file with a local file

which reminds me of a powerful command output redirection, also from many commands in parallel

cmd <(subcmd) <(subcmd) ...

e.g. to compare two files, sorting them first:

diff <(sort file1) <(sort file2)
Steve Permalink
August 09, 2010, 12:10

...and use brace expansion:

$ diff <(sort file{1,2})
April 19, 2010, 19:58

Top 10 nothing, most of these are as basic as man bash examples. Check my commandlinefu commands to see what a real oneliner looks like. Not up to your usually amazing standards bud.. everyone has access to man pages and infodir.

April 21, 2010, 04:47

"sudo netstat -tlnp" appears to have issues (e.g. missing some process names) on my machine, where as "sudo lsof -n -i -P" works fine.

April 30, 2010, 09:29

I have some addition to #13: ssh can also be used as socks proxy, for example, try this command at host1:
ssh -D 1080
After that open browser configuration dialog and specify socks proxy port 1080. When browser on host1 will try to open some remote website, this request will be forwarded via secure channel to, and then connection to remote website will be initiated from host2, thus showing in webserver's logs the ip-address of in spite of the fact, that browser is runnning at host1.
This can be useful if you don't want to show for website's admins your real ip-address.

Leave a new comment

(why do I need your e-mail?)

(Your twitter handle, if you have one.)

Type the word "server_208": (just to make sure you're a human)

Please preview the comment before submitting to make sure it's OK.