What is the difference between a builtin command and one that is not?

From your comments, you seem to be confused about exactly what a shell is. The kernel is responsible for managing the system. It's the part that actually loads and runs programs, accesses files, allocates memory, etc. But the kernel has no user interface; you can only communicate with it by using another program as an intermediary.

A shell is a program that prints a prompt, reads a line of input from you, and then interprets it as one or more commands to manipulate files or run other programs. Before the invention of the GUI, the shell was the primary user interface of an OS. On MS-DOS, the shell was called command.com and few people ever tried to use a different one. On Unix, however, there have long been multiple shells that users could pick from.

They can be divided into 3 types. The Bourne-compatible shells use the syntax derived from the original Bourne shell. C shells use the syntax from the original C shell. Then there are nontraditional shells that invent their own syntax, or borrow one from some programming language, and are generally much less popular than the first two types.

A built-in command is simply a command that the shell carries out itself, instead of interpreting it as a request to load and run some other program. This has two main effects. First, it's usually faster, because loading and running a program takes time. Of course, the longer the command takes to run, the less significant the load time is compared to the overall run time (because the load time is fairly constant).

Secondly, a built-in command can affect the internal state of the shell. That's why commands like cd must be built-in, because an external program can't change the current directory of the shell. Other commands, like echo, might be built-in for efficiency, but there's no intrinsic reason they can't be external commands.

Which commands are built-in depends on the shell that you're using. You'll have to consult its documentation for a list (e.g., bash's built-in commands are listed in Chapter 4 of its manual). The type command can tell you if a command is built-in (if your shell is POSIX-compatible), because POSIX requires that type be a built-in. If which is not a built-in in your shell, then it probably won't know about your shell's built-ins, but will just look for external programs.

There are three levels of built-in utilities:

• Some utilities are really part of the shell as a programming language, even though they are not reserved words. They are control flow utilities (., :, break, continue, return, trap, exit, exec, eval), parameter-related utilities (set, unset, shift, export, readonly, local¹, typeset¹), alias utilities (alias², unalias²) and times³. These special built-ins get special treatment:

  • If you pass the wrong arguments to a special built-in, the shell itself may abort, rather than just skipping to the next command after displaying an error message.
  • The pre-assignment syntax foo=bar utility has a different meaning: it's an ordinary parameter assignment (i.e. equivalent to foo=bar; utility), instead of assigning to the environment for the duration of the utility only.

• Some utilities need to be implemented inside the shell because they act on the shell's internal settings. This includes:

  • utilities that act on the shell's current directory such as cd, dirs, pushd, popd;
  • job control utilities such as bg, disown, fg, jobs, wait;
  • utilities that read or manipulate other shell attributes such as builtin, command, hash, read, type, ulimit, umask;
  • utilities related to interactive features, when they're present, such as fc, history, bind.
• Some utilities are typically implemented as built-ins purely for performance: echo, printf, test, true, false.

Advanced shells such as bash, ksh and zsh typically have more built-ins, often to implement non-standard features (usually for interaction). The manual of each shell will tell you what commands are built-in, though some shells (zsh, at least) support dynamically-loadable modules that can provide more built-ins.

¹ _{Unknown to POSIX, but special in ksh and several other shells.}
² _{Ordinary in POSIX, but special in ksh and several other shells.}
³ _{In ksh, times is a wrapper around the time keyword: it's an alias for { { time;} 2>&1;}. Note that POSIX allows time to be an external utility with ordinary parsing or a keyword that applies to a whole pipeline (which it is in ksh, bash in zsh).}

A builtin is a command provided by the shell, rather than by an external program. Here are the lists for bash's builtins (they are also listed in the bash man page) and zsh's builtins. ksh provides a list by running builtin.

To know if a particular command is a builtin, you can run type command. Try type for and type ls to see this.