Shell – way to intercept interprocess communication in Unix/Linux

command lineipcprocessshell

For intercepting/analyzing network traffic, we have a utility called Wireshark.

Do we have a similar utility for intercepting all the interprocess communication between any two processes in Unix/Linux?

I have created some processes in memory and I need to profile how they communicate with each other.

Best Answer

This depends a lot on the communication mechanism.

  • At the most transparent end of the spectrum, processes can communicate using internet sockets (i.e. IP). Then wireshark or tcpdump can show all traffic by pointing it at the loopback interface.

  • At an intermediate level, traffic on pipes and unix sockets can be observed with truss/strace/trace/..., the Swiss army chainsaw of system tracing. This can slow down the processes significantly, however, so it may not be suitable for profiling.

  • At the most opaque end of the spectrum, there's shared memory. The basic operating principle of shared memory is that accesses are completely transparent in each involved process, you only need system calls to set up shared memory regions. Tracing these memory accesses from the outside would be hard, especially if you need the observation not to perturb the timing. You can try tools like the Linux trace toolkit (requires a kernel patch) and see if you can extract useful information; it's the kind of area where I'd expect Solaris to have a better tool (but I have no knowledge of it).

    If you have the source, your best option may well be to add tracing statements to key library functions. This may be achievable with LD_PRELOAD tricks even if you don't have the (whole) source, as long as you have enough understanding of the control flow of the part of the program that accesses the shared memory.

Related Question