For intercepting/analyzing network traffic, we have a utility called Wireshark.

Do we have a similar utility for intercepting all the interprocess communication between any two processes in Unix/Linux?

I have created some processes in memory and I need to profile how they communicate with each other.

  • 1
    What IPC mechanism(s) are you using for the communication?
    – axel_c
    Aug 20, 2010 at 13:31
  • @axel_c: The process source is not with me, but I think I read "Shared Memory" somewhere in the documentation.
    – Lazer
    Aug 20, 2010 at 13:35

2 Answers 2


This depends a lot on the communication mechanism.

  • At the most transparent end of the spectrum, processes can communicate using internet sockets (i.e. IP). Then wireshark or tcpdump can show all traffic by pointing it at the loopback interface.

  • At an intermediate level, traffic on pipes and unix sockets can be observed with truss/strace/trace/..., the Swiss army chainsaw of system tracing. This can slow down the processes significantly, however, so it may not be suitable for profiling.

  • At the most opaque end of the spectrum, there's shared memory. The basic operating principle of shared memory is that accesses are completely transparent in each involved process, you only need system calls to set up shared memory regions. Tracing these memory accesses from the outside would be hard, especially if you need the observation not to perturb the timing. You can try tools like the Linux trace toolkit (requires a kernel patch) and see if you can extract useful information; it's the kind of area where I'd expect Solaris to have a better tool (but I have no knowledge of it).

    If you have the source, your best option may well be to add tracing statements to key library functions. This may be achievable with LD_PRELOAD tricks even if you don't have the (whole) source, as long as you have enough understanding of the control flow of the part of the program that accesses the shared memory.


This will show what a process reads and writes:

strace -ewrite -p $PID

It's not clean output (shows lines like: write(#,) ), but works! (and is single-line :D ) You might also dislike the fact, that arguments are abbreviated. To control that use -s parameter that sets the maxlength of strings displayed.

It catches all streams, so You might want to filter that somehow.

You can filter it:

strace -ewrite -p $PID 2>&1 | grep "write(1"

shows only descriptor 1 calls. 2>&1 is to redirect stderr to stdout, as strace writes to stderr by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.