l is an alias for ls -CF, which behaves differently from plain ls.

-C

-C makes ls print output in column form. When stdout is a terminal (rather than being redirected to a file or non-terminal device, or piped to another command), -C is implied. So running ls -C is the same as running ls. But they are not equivalent when ls is redirected or piped. For example:

ek@Kip:~/firefox$ ls

application.ini             libfreebl3.chk    libxpcom.so

blocklist.xml               libfreebl3.so     libxul.so

chrome                      libmozalloc.so    mozilla-xremote-client

chrome.manifest             libmozsqlite3.so  omni.ja

components                  libnspr4.so       platform.ini

crashreporter               libnss3.so        plugin-container



...



ek@Kip:~/firefox$ ls | less



application.ini

blocklist.xml

chrome

chrome.manifest

components

crashreporter



...

In contrast, ls -C (or -l) outputs in column form regardless of what kind of device stdout is. ls -C | less looks like the top output (but paged by less, of course).

-F

The main visible difference between ls and l is due to the -F flag, which causes ls to append symbolic suffixes (called indicators) to the entries it displays. These indicators identify what kind of file or directory they are.

Compare this to the output of the first ls command above:

ek@Kip:~/firefox$ ls -F

application.ini             libfreebl3.chk     libxpcom.so*

blocklist.xml               libfreebl3.so*     libxul.so*

chrome/                     libmozalloc.so*    mozilla-xremote-client*

chrome.manifest             libmozsqlite3.so*  omni.ja

components/                 libnspr4.so*       platform.ini

crashreporter*              libnss3.so*        plugin-container*



...

Here:

• / means the entry is a directory.


• * means the entry is a normal file and is executable (i.e., has executable permissions).


• The absence of any indicator means the entry is a normal file that is not executable.

There are several other indicators:

• @ means the entry is a symbolic link (see also man symlink).


• | means the entry is a FIFO device (remember, many resources in Unix-like OSes are represented by filesystem entries).


• = means the entry is a socket.


• > means the entry is a door.

The --classify flag and --indicator-style=classify are equivalent to -F.

Source: GNU Coreutils manual, Section 10.1.5 General output formatting

In conclusion, l (ls -CF) is similar to but not the same as ls.

It's also good to keep in mind:

The same text can be both a regular command and an alias.

This is commonly used to specify options that are widely considered both highly useful and harmless, such as automatic colorization (where color is applied when stdout is unredirected or is a terminal, so the escape codes specifying colors are virtually guaranteed not to be misinterpreted).

By this principle, ls is itself an alias.

ek@Kip:/$ alias ls

alias ls='ls --color=auto'

So what command really gets executed when you run l? This one:

/bin/ls --color=auto -CF

1. The shell (bash) resolves commands that don't contain a / to the first match appearing in PATH, which in Ubuntu for ls is /bin/ls.


2. Aliases can contain aliases. Alias resolution is not recursive (an alias cannot call itself, though it can call a regular command that has the same name). But it does support nesting.

So l resolves to ls -CF which resolves to ls --color=auto -CF.

Aliases can be changed.

These aliases exist because they're set up that way by default, but every user can change their aliases. See man alias, Chapter 25 and Appendix M in the Advanced Bash-Scripting Guide, and How save my "alias" entries forever.

Related: What do the different colors mean in ls?