I have two Linux processes communicating via a nameless pipe. How can monitor the traffic in the pipe? How can I inject data into the pipe? I have root access and know the pipe inode.


A nameless pipe is by nature private to the applications that have the file descriptor. There's no principled way to observe or modify the traffic on the pipe. I don't think there's a way to look at the pipe directly on Linux, either.

There is an unprincipled way of more or less doing what you're after, though: through the ptrace system call. You wouldn't be tacking onto the pipe per se, but onto one of the processes. For observation, use strace, e.g.

strace -p1234 -s99999 -e write

where 1234 is the process ID of a process that writes on the pipe. Modifying the data is harder, but can be done. I think the easiest way would be to first set up an intermediate process that copies its standard input to its standard output, plus the data you want to inject (and minus any data you want to suppress). Create two named pipes and start that intermediate process with stdin on one pipe and stdout on the other. Then use a debugger (e.g. GDB) to make both target processes execute open on the appropriate named pipe, then dup to place the pipe on the appropriate file descriptor. Note that there's a chance you'll crash one of the processes in the process.

(If you don't understand the last paragraph, I'm sorry, but it does require a certain level of technicity. I don't think there is an easier way.)

| improve this answer | |
  • Thanks, I understand. What I actually tried is going to /proc/$PID/fd, where I found the file entries for the unnamed pipes of one of the processes and I managed to read and data using simple cat and echo in the shell, but the behavior somewhat inconsistent. I need to investigate further. – jackhab Dec 16 '10 at 7:18
  • 1
    @jackhab: Oh, I thought it didn't work for pipes. But as you found out it won't help you that much for monitoring traffic, because each byte from the producer will go to exactly one consumer and you can't control whether your monitor or the actual consumer will get it. You should be able to inject data that way then. – Gilles 'SO- stop being evil' Dec 16 '10 at 8:09

Some tools useful for monitoring a pipe :

Pipe Viewer

For an already-running program where one doesn't control the piping, see the gdb method:
Redirecting Output from a Running Process.

Or one can use strace :

strace -ewrite -p $PID 2>&1 | grep "write(1"

shows only descriptor 1 calls. "2>&1" is to redirect stderr to stdout, as strace writes to stderr by default.

| improve this answer | |
  • 1
    What I meant is wiretapping to the pipe of already running process. Process A launches process B and talks with it via a pipe so I have no way to use proxy utilities like tee or pv. – jackhab Dec 16 '10 at 7:21
  • Added some more methods. – harrymc Dec 16 '10 at 9:03
  • Rather than using grep, you can specify "-e write=1" to limit the output to data written to fd 1. – William Pursell Jul 19 '11 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.