Three Ways to List Named Pipes in Windows


In Windows, device driver that implements Names Pipes is actually a file system driver (NPFS.SYS). That means you can just list pipes from C# or Powershell which can use .NET calls:




Sysinternals PipeList

Sysinternals PipeList does similar thing if you already have it installed:



PipeList v1.02 - Lists open named pipes
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals -

Pipe Name                                    Instances       Max Instances
---------                                    ---------       -------------
InitShutdown                                      3               -1
lsass                                             4               -1
ntsvcs                                            3               -1
scerpc                                            3               -1
Winsock2\CatalogChangeListener-414-0              1                1
epmapper                                          3               -1
Winsock2\CatalogChangeListener-578-0              1                1
Winsock2\CatalogChangeListener-1cc-0              1                1
Winsock2\CatalogChangeListener-5a4-0              1                1
LSM_API_service                                   3               -1
eventlog                                          3               -1
Winsock2\CatalogChangeListener-c18-0              1                1
atsvc                                             3               -1
Winsock2\CatalogChangeListener-d70-0              1                1
WiFiNetworkManagerTask                            1               -1

Sysinternals Process Explorer

It can also be achieved from Process Explorer. Go to Find -> Find Handle or DLL..


Search for string \Device\NamedPipe. The advantage here is that after search is complete you can visually jump to processes and other objects offered by this great program.


To contact me, send an email anytime or leave a comment below.