# Understanding Devices in Linux: What Hides Behind /dev and /sys?

**Published by:** [SysOpsMaster // Aleksandr M.](https://paragraph.com/@sysopsmaster-aleksandr-m/)
**Published on:** 2025-12-01
**URL:** https://paragraph.com/@sysopsmaster-aleksandr-m/understanding-devices-in-linux-what-hides-behind-dev-and-sys

## Content

Linux exposes its hardware and low-level system interfaces in a surprisingly transparent way. Two directories—/dev and /sys—stand at the center of this architecture, yet many users interact with them daily without fully understanding what they represent. This article goes under the surface, explaining how Linux exposes devices, how the kernel structures them, and why /dev and /sys are foundational for system administration, storage management, and low-level debugging.1. What /dev Really Is/dev is not a typical directory. It is the kernel’s device interface, containing special files that represent hardware or virtual devices. These files:are not driversdo not store dataact as endpoints through which processes communicate with device drivers inside the kernelExamples:Disks (/dev/sda, /dev/nvme0n1)Partitions (/dev/sda1)Terminals (/dev/tty*)Random generators (/dev/random, /dev/urandom)Null sink (/dev/null)Whenever you write or read from a file in /dev, the kernel routes that operation directly to the corresponding driver.2. Types of Device FilesRunning:ls -l /devproduces output like:brw-rw---- 1 root disk 8, 1 Feb 10 10:15 sdb1 crw-rw-rw- 1 root root 1, 3 Feb 10 10:15 random prw-r--r-- 1 root root 0 Feb 10 10:15 pipe_data srw-rw-rw- 1 root root 0 Feb 10 10:15 sock_commThe first character identifies the device type:PrefixMeaningDescriptionbBlockoperates in fixed-size blocks (disks)cCharacterbyte-stream devices (keyboards, tty, input)pNamed pipe (FIFO)file-based process-to-process communicationsSocketIPC using Unix domain socketsLet’s walk through these.2.1 Block DevicesBlock devices move data in chunks (blocks). Examples:HDD / SSDUSB drivesSD cardsDisk partitionsThey support random access and use filesystems on top of them.2.2 Character DevicesCharacter devices represent streams. Examples:/dev/input/event* — keyboard, mouse/dev/ttyS0 — serial interface/dev/null — write-discard sink/dev/zero — endless stream of zero bytes/dev/random — entropy generatorWriting to /dev/null:echo "Hello" > /dev/null— deletes data instantly. No storage, no persistence, just a black hole.2.3 Named Pipes (FIFOs)Named pipes provide file-backed IPC:mkfifo /tmp/mypipe echo "test" > /tmp/mypipe & cat /tmp/mypipeTwo unrelated processes can exchange data through the pipe.2.4 SocketsUnix domain sockets allow high-performance interprocess communication:/dev/log — system loggingCustom sockets /dev/socket/my_appThey work like TCP/UDP sockets but stay inside the kernel.3. Major and Minor Device NumbersEach device file comes with identifiers:Major number (8) — device driver IDMinor number (1) — specific device instance within that driverAll partitions of /dev/sdb share the same major number but different minor numbers. This mapping is how the kernel routes read/write operations to the correct device.4. How /dev Devices Are Created/dev is populated dynamically at boot or when devices appear. Managers:udevd (systemd-udevd)mdevd (in lightweight distros)Their responsibilities:Detect new hardware eventsMatch rulesLoad driversCreate proper device files inside /dev, applying permissions and groupsNothing in /dev is permanent—remove the directory completely, reboot, and it will be rebuilt.5. What /sys Is and Why It Exists/sys exposes the kernel’s internal device tree and configuration through the sysfs virtual filesystem. It is not used for I/O. Instead, /sys provides:hierarchical hardware representationdevice metadatadriver bindingtunable kernel interfacesExamples:/sys/class/net/eth0/address /sys/block/sda/size /sys/devices/system/cpu/cpu0/cpufreq/scaling_governorEach of these is a window into kernel state.6. Practical ExamplesWrite to the null device:echo "Hello" > /dev/nullRead random bytes:head -c 10 /dev/randomGet network interface MAC address:cat /sys/class/net/eth0/addressNamed pipe communication:mkfifo /tmp/mypipe echo "msg" > /tmp/mypipe & cat /tmp/mypipeConclusion/dev and /sys form the foundation of how Linux represents hardware and kernel structures:/dev gives interfaces to devices/sys gives introspection and configurationtogether they allow transparent, UNIX-style simplicity for hardware abstractionUnderstanding them gives you precise control over disks, terminals, input streams, drivers, and the kernel itself.

## Publication Information

- [SysOpsMaster // Aleksandr M.](https://paragraph.com/@sysopsmaster-aleksandr-m/): Publication homepage
- [All Posts](https://paragraph.com/@sysopsmaster-aleksandr-m/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@sysopsmaster-aleksandr-m): Subscribe to updates
- [Twitter](https://twitter.com/ops_sys15369): Follow on Twitter