Difference between "kill | pgrep dnsspoof" and "kill `pgrep dnsspoof`"

Question

I believe that | is used to provide the output of a program as an input to another. So I tried kill | pgrep dnsspoof but it didn't work. So I tried

kill `pgrep dnsspoof`

and it worked. Can someone tell me how do these commands work internally?

Answer 1

You are correct that | feeds the output of one program to another. The data flows left to right. So you might think that

pgrep dnsspoof | kill

should work, as pgrep will find the process number of dnsspoof and feed that to kill, which would then kill it. It turns out that this doesn't work, as kill only looks at the command line to get the things to kill.

So we have to get the output of pgrep onto the command line. This is what `pgrep dnsspoof` or the more modern $(pgrep dnsspoof) does, it runs the command inside the backticks or brackets and puts the output in place of the command. So if pgrep dnsspoof outputs 5432, then the command that is then run is kill 5432, which is the correct way to invoke the kill program.

Using $( ) has several advantages, easier nesting, less things need to be escaped, so if your shell supports them then you should use them in prefference to ` `.

Answer 2

You are right about | but you are running the command in opposite way, you should run pgrep dnsspoof then send its output to be input to kill but it doesn't accept their commands on standard in, they expect it to be spelled out in the arguments to the command, so you have to use xargs which reads the STDIN stream data and converts each line into space separated arguments to the command:

pgrep dnsspoof | xargs kill

but in your way you are sending the output of kill command to be as input to pgrep dnsspoof and that make no sense