monitor interprocess pipe traffic

Question

I have two Linux processes communicating via a nameless pipe. How can monitor the traffic in the pipe? How can I inject data into the pipe? I have root access and know the pipe inode.

Answer 1

A nameless pipe is by nature private to the applications that have the file descriptor. There's no principled way to observe or modify the traffic on the pipe. I don't think there's a way to look at the pipe directly on Linux, either.

There is an unprincipled way of more or less doing what you're after, though: through the ptrace system call. You wouldn't be tacking onto the pipe per se, but onto one of the processes. For observation, use strace, e.g.

strace -p1234 -s99999 -e write

where 1234 is the process ID of a process that writes on the pipe. Modifying the data is harder, but can be done. I think the easiest way would be to first set up an intermediate process that copies its standard input to its standard output, plus the data you want to inject (and minus any data you want to suppress). Create two named pipes and start that intermediate process with stdin on one pipe and stdout on the other. Then use a debugger (e.g. GDB) to make both target processes execute open on the appropriate named pipe, then dup to place the pipe on the appropriate file descriptor. Note that there's a chance you'll crash one of the processes in the process.

(If you don't understand the last paragraph, I'm sorry, but it does require a certain level of technicity. I don't think there is an easier way.)

Answer 2

Some tools useful for monitoring a pipe :

Pipe Viewer
tee

For an already-running program where one doesn't control the piping, see the gdb method:
Redirecting Output from a Running Process.

Or one can use strace :

strace -ewrite -p $PID 2>&1 | grep "write(1"

shows only descriptor 1 calls. "2>&1" is to redirect stderr to stdout, as strace writes to stderr by default.