Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

For intercepting/analyzing network traffic, we have a utility called Wireshark.

Do we have a similar utility for intercepting all the interprocess communication between any two processes in Unix/Linux?

I have created some processes in memory and I need to profile how they communicate with each other.

share|improve this question
1  
What IPC mechanism(s) are you using for the communication? –  axel_c Aug 20 '10 at 13:31
    
@axel_c: The process source is not with me, but I think I read "Shared Memory" somewhere in the documentation. –  Lazer Aug 20 '10 at 13:35

2 Answers 2

up vote 18 down vote accepted

This depends a lot on the communication mechanism.

  • At the most transparent end of the spectrum, processes can communicate using internet sockets (i.e. IP). Then wireshark or tcpdump can show all traffic by pointing it at the loopback interface.

  • At an intermediate level, traffic on pipes and unix sockets can be observed with truss/strace/trace/..., the Swiss army chainsaw of system tracing. This can slow down the processes significantly, however, so it may not be suitable for profiling.

  • At the most opaque end of the spectrum, there's shared memory. The basic operating principle of shared memory is that accesses are completely transparent in each involved process, you only need system calls to set up shared memory regions. Tracing these memory accesses from the outside would be hard, especially if you need the observation not to perturb the timing. You can try tools like the Linux trace toolkit (requires a kernel patch) and see if you can extract useful information; it's the kind of area where I'd expect Solaris to have a better tool (but I have no knowledge of it).

    If you have the source, your best option may well be to add tracing statements to key library functions. This may be achievable with LD_PRELOAD tricks even if you don't have the (whole) source, as long as you have enough understanding of the control flow of the part of the program that accesses the shared memory.

share|improve this answer
    
Thanks a lot, @Gilles. –  Lazer Aug 20 '10 at 21:34

This will show what a process reads and writes:

strace -ewrite -p $PID

It's not clean output (shows lines like: write(#,) ), but works! (and is single-line :D ) You might also dislike the fact, that arguments are abbreviated. To control that use -s parameter that sets the maxlength of strings displayed.

It catches all streams, so You might want to filter that somehow.

You can filter it:

strace -ewrite -p $PID 2>&1 | grep "write(1"

shows only descriptor 1 calls. 2>&1 is to redirect stderr to stdout, as strace writes to stderr by default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.