Joya Systems

Call Us: 1-877-DEV-KERNEL

RpcViewer

See Windows RPC activity as it happens.

Free download. No paid license key required.

RpcViewer is a real-time viewer for Windows RPC (Remote Procedure Call) activity. It captures RPC events as they happen on the system and shows them in a searchable, filterable table, so you can see which processes are making RPC calls, which interfaces and procedures they invoke, the transport and endpoint in use, the call status, and how long each call takes.

RPC sits underneath a large amount of Windows: service control, WMI, the firewall, printing, DCOM, task scheduling, and countless first- and third-party services all talk over it. When something fails with an opaque error or hangs waiting on another component, the call usually crosses an RPC boundary you cannot see from a normal debugger. RpcViewer makes that traffic visible.

Download RpcViewer (free)
RpcViewer showing live RPC calls with process, interface, procedure, protocol, endpoint, status, and duration.

What RpcViewer Shows

Each captured event is one row. The columns answer the questions you actually have when an RPC interaction misbehaves:

  • Process, PID, and TID for the side of the call you captured.
  • Type: the call phase, such as client/server start, stop, or call.
  • Service and Function: the resolved RPC service name and procedure name.
  • Interface (UUID) and Proc#: the interface identifier and procedure number.
  • Module: the DLL hosting the RPC interface.
  • Protocol and Endpoint: the transport (for example ALPC, named pipe, or TCP) and the endpoint address.
  • Status: the RPC call status code.
  • Duration: call time in microseconds, plus a configurable delta from the previous event.

Columns can be shown, hidden, and reordered, and the layout, filters, and highlight rules persist between sessions.

Live Capture and Offline Analysis

Start a capture and events stream into the list as they are generated; stop it when you have what you need. You can also open a previously saved ETL trace file to analyze RPC activity collected on another machine or at an earlier time, which is useful when you are handed a repro from a customer or a CI run rather than reproducing it locally.

Find the Signal Fast

RPC is high volume, so the viewer is built around cutting it down quickly:

  • Quick filter narrows the list by any field as you type.
  • Compound filters combine field, operator, and value conditions with AND/OR logic.
  • Find supports plain text, regex, case-sensitive, and whole-word search, forward or backward.
  • Highlight rules color-code rows that match conditions you define so failures or a specific interface jump out.

The RPC interface database resolves raw interface UUIDs to readable service and procedure names, and the monitoring guide walks through capturing live activity end to end.

Who Uses It

  • Driver and systems developers tracing how a user-mode service reaches a kernel component, or why a call returns an unexpected status.
  • Application developers debugging DCOM, WMI, or service interactions that fail with errors that say nothing about which RPC call actually broke.
  • IT and security engineers watching which processes call which RPC interfaces on a machine, and over which transports and endpoints.
  • Performance investigators using per-call duration to find slow or chatty RPC paths.

Requirements

  • Windows 10 or later.
  • Administrator privileges, which RPC event capture requires.

Get RpcViewer

RpcViewer is free. Download it, run it elevated, and start a capture to see RPC traffic on your machine right away.

Download RpcViewer (free)

Building or debugging Windows drivers? See our Windows driver development services and the WppViewer Studio trace viewer.

RpcViewer

  • What our customers say about us?

    Read our customer testimonials to find out why our clients keep returning for their projects.

    View Testimonials