Three Ways to List Named Pipes in Windows

Sep 28, 2022 | 187 Words | 1 min |  #windows

Powershell

In Windows, device driver that implements Names Pipes is actually a file system driver (NPFS.SYS). That means you can just list pipes from C# or Powershell which can use .NET calls:

[System.IO.Directory]::GetFiles("\\.\\pipe\\")

output:

\\.\\pipe\\InitShutdown
\\.\\pipe\\lsass
\\.\\pipe\\ntsvcs
\\.\\pipe\\scerpc
\\.\\pipe\\Winsock2\CatalogChangeListener-414-0
\\.\\pipe\\epmapper
\\.\\pipe\\Winsock2\CatalogChangeListener-578-0
\\.\\pipe\\Winsock2\CatalogChangeListener-1cc-0
\\.\\pipe\\Winsock2\CatalogChangeListener-5a4-0
\\.\\pipe\\LSM_API_service
\\.\\pipe\\eventlog
\\.\\pipe\\Winsock2\CatalogChangeListener-c18-0
\\.\\pipe\\atsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-d70-0
\\.\\pipe\\WiFiNetworkManagerTask
\\.\\pipe\\spoolss
\\.\\pipe\\Winsock2\CatalogChangeListener-12d4-0
\\.\\pipe\\wkssvc
\\.\\pipe\\trkwks
\\.\\pipe\\srvsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-2b4-0
\\.\\pipe\\NvWksServiceDdisplayPipe
...

Sysinternals PipeList

Sysinternals PipeList does similar thing if you already have it installed:

pipelist.exe

output:

PipeList v1.02 - Lists open named pipes
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Pipe Name                                    Instances       Max Instances
---------                                    ---------       -------------
InitShutdown                                      3               -1
lsass                                             4               -1
ntsvcs                                            3               -1
scerpc                                            3               -1
Winsock2\CatalogChangeListener-414-0              1                1
epmapper                                          3               -1
Winsock2\CatalogChangeListener-578-0              1                1
Winsock2\CatalogChangeListener-1cc-0              1                1
Winsock2\CatalogChangeListener-5a4-0              1                1
LSM_API_service                                   3               -1
eventlog                                          3               -1
Winsock2\CatalogChangeListener-c18-0              1                1
atsvc                                             3               -1
Winsock2\CatalogChangeListener-d70-0              1                1
WiFiNetworkManagerTask                            1               -1
...

Sysinternals Process Explorer

It can also be achieved from Process Explorer. Go to Find -> Find Handle or DLL..

image-20220928093117681

Search for string \Device\NamedPipe. The advantage here is that after search is complete you can visually jump to processes and other objects offered by this great program.

image-20220928093314087

Hey, I really appreciate your interest in my work. If you want to reach out to me directly, you can send me an email anytime. I'd love to hear from you. But if you have something to say that others might benefit from, feel free to leave a comment below. I'll try to reply as soon as I can. Like what I do? Please:

See Also