Learn / Linux Fundamentals / Shell Basics
Pipes and Redirection
First Bit is still up for grabs: be the first to finish this room.
The command line's real power isn't any single command. It comes from combining small commands, each doing one job well, into a pipeline that answers a question no single tool can.
You'll learn to send output into files (redirection) and into other commands (pipes), then use them on a real web server's access log to find out who's hammering the site.
CYB//RANGE Live lab
Log in to launch this room's lab.
Task 1 Sending output to files
Normally a command's output goes to your screen. Redirection sends it somewhere else.
| Operator | Does | Example |
|---|---|---|
> |
write output to a file, replacing its contents | ls > files.txt |
>> |
append output to the end of a file | date >> log.txt |
< |
feed a file in as input | wc -l < access.log |
2> |
write only the error messages to a file | find / -name x 2> errors.txt |
Programs actually have two output streams: normal output ("standard output") and error messages ("standard error"). > only captures the first, which is why errors still appear on screen. 2> captures the second, and 2>/dev/null throws errors away entirely (/dev/null discards anything written to it).
Be careful with >: sort notes.txt > notes.txt empties the file before sort even reads it. Write to a new file instead.
Which operator adds a command's output to the end of a file, keeping what's already there?
Log in or sign up to answer. 10 pts
**
Task 2 Chaining commands with pipes
A pipe, |, sends one command's output straight into the next command as its input:
$ ls /etc | wc -l
ls lists the files, and wc -l counts the lines it receives. No temporary file needed.
Some small tools that shine in pipelines:
| Command | Does |
|---|---|
sort |
sorts lines; -n numerically, -r reversed, -u removes duplicates |
uniq |
merges repeated adjacent lines; -c puts a count in front of each |
cut -d' ' -f1 |
splits each line on spaces (-d) and keeps field 1 (-f) |
head -n 5 |
keeps the first 5 lines |
uniq only merges duplicates that are next to each other, so you almost always sort first. That gives the classic "top 10" pipeline, read left to right:
$ cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | head
In words: take the first field of every line (the IP address), sort the IPs so repeats sit together, count each one, sort by that count with the biggest first, and keep the top ten.
Which character sends one command's output into the next command?
Log in or sign up to answer. 5 pts
*
uniq only merges repeated lines that sit next to each other. Which command do you run before it?
Log in or sign up to answer. 10 pts
****
Task 3 Try it on a real machine
Dana runs the company's web server. Here is one day of its access log. Each line is one request:
203.0.113.77 - - [22/Sep/2026:06:00:04 -0500] "GET /login HTTP/1.1" 200 5123
Split on spaces, field 1 is the visitor's IP address, field 7 the path they asked for, and field 9 the status code (200 is OK, 404 is Not Found, 403 is Forbidden).
- Press Launch in CybRange at the top of this page, then Open terminal next to
boxonce it's ready. You're logged in asdana. - Build the answers below from pipelines. Start small (
head ~/access.log, thencut -d' ' -f1 ~/access.log | head) and add one step at a time. ~/reportshas a report for each IP. Once you know the busiest IP, read its report.