What does this shell command do in Linux

:(){ :|: & };:

How can it be used in Denial of Service attacks?


1 Answer 1


It's a fork bomb. I actually have that written on my whiteboard (as a joke) as I speak. Don't run it.

:()         # define a function named :, () defines a function in bash
    : | :;  # the pipe needs two instances of this function, which forks two shells
;           # end function definition
:           # run it

So, the first run makes 2 subshells, which then each runs 2 more subshells...

: is a built in command in bash. It's kind of a "null" no-op command. It used to be the comment character, before there was a comment character. Now, it's got a small use as a no-op, but really used here because it's more cryptic, you look at :() and think WTH is that?

  • : isn't an operator, it's a built-in command that does nothing. This definition defines a function called :, which hides the built-in command. Here's a clearer and equivalent version DON'T RUN THIS EITHER bomb() { bomb | bomb & ) ; bomb Jul 29, 2013 at 19:12
  • Why is everyone saying to not run this? Either Mac OS X is too clever or too broken to let this cause any damage. Just a bunch of -bash: fork: Resource temporarily unavailable, then the prompt is back within a second or so.
    – Daniel Beck
    Jul 29, 2013 at 19:18
  • @DanielBeck I (knowingly) ran this on Solaris many years ago, needed to force a logout, though I actually just rebooted (my desktop Sparc). Jul 29, 2013 at 19:26
  • Forking exponential user created memory leak. Depending on the OS, hilarity or disaster ensues. Mac knows users will do anything despite? ulimit set to prevent it from working? Jul 29, 2013 at 19:55

Not the answer you're looking for? Browse other questions tagged .