Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that?

Edit: Even though it is accessible over the network, the application talks to it on the local machine.

share|improve this question
    
Similar question here. superuser.com/questions/313684/sniff-process-communication –  Xander Mar 7 '13 at 20:13

1 Answer 1

Here is a tutorial on using WinDbg to debug via named pipe:

Doing remote debugging using WinDbg is easy and can be done in one of a number of ways. In the following, ‘debugging server’ is the debugger running on the machine where you’d like to debug; ‘debugging client’ is the debugger controlling the session.

To start a server:

- WinDbg –server npipe:pipe=pipename (note: multiple clients can connect), or
- from within WinDbg: .server npipe:pipe=pipename (note: single client can connect)
share|improve this answer
    
This alone does not allow monitoring of named pipes, and since no password was supplied it will decrease the security of your server by exposing the kernel to unauthenticed users –  makerofthings7 Mar 9 '13 at 2:52
    
Why would the debugging be run on a live production server? From the OP's edit, it seemed he was not intending for network access to be used in his testing. –  Eric G Mar 9 '13 at 4:20
    
I don't get any indication that he is testing, even then it might even be off topic –  makerofthings7 Mar 9 '13 at 15:25
    
He asked how to eavesdrop on any named pipe, not how to start windbg server so that windbg clients can talk to it via named pipe. That's completely unrelated. –  Ben Bryant Jan 16 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.