Method and system for testing client in local area network
By combining named pipe files and the SMB protocol, secure testing of clients within a local area network is achieved, solving the problems of easy identification and isolation and port exposure in existing methods, and improving security and concealment.
Patent Information
- Application Number
- CN202411150767.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-21
- Publication Date
- 2025-01-07
AI Technical Summary
Existing client security testing methods within a local area network are easily identified and isolated by other clients, and require listening on new ports, leading to complexity and exposure risks.
Using named pipe files and the SMB protocol, the system listens for and forwards scan traffic through the first socks5 service program on the target client. It establishes a connection with the target client using the SMB protocol and writes scan data into the named pipe file to achieve scanning and detection of other clients on the local area network, avoiding the opening of new ports.
It improves the security and concealment of clients within the local area network, simplifies the testing process, reduces the risk of being identified and isolated, and enhances the concealment of testing equipment.
Smart Images
Figure CN119276533A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a testing method and system for a client in a local area network. Background Art
[0002] With the rapid development of the Internet, the World Wide Web has become a carrier of a large amount of information. Various things that previously required going out can now be done online without leaving home. While bringing convenience, it also brings security risks. Therefore, it is often necessary to conduct pre-rehearsal security penetration tests and non-hazardous penetration tests to discover the loopholes and security risks that exist in the Internet.
[0003] During security penetration testing, if the test engineer's test equipment obtains the login permission of a Windows host, then the test engineer needs to perform security tests on other Windows hosts in the local area network where the Windows host is located. However, the current testing method is easily identified and isolated by other clients. Therefore, a testing method is urgently needed for this scenario. Summary of the invention
[0004] The present application provides a method and system for testing a client in a local area network, which can implement security testing of the client in the local area network.
[0005] In order to achieve the above objectives, this application adopts the following technical solutions:
[0006] In a first aspect of an embodiment of the present application, a method for testing a client in a local area network is provided, which is applied to a test device in a test system for a client in a local area network, wherein the test system further comprises a plurality of clients, the plurality of clients are located in the same local area network, and the test device is not located in the local area network, and the method comprises:
[0007] After obtaining the operation authority of a target client among the multiple clients, sending a target program to the target client, the target program including a named pipe file and a first socks5 service program, the first socks5 service program being used to monitor the named pipe file;
[0008] After establishing a connection with the target client based on the SMB protocol, scanning data is written into the named pipe file, and the scanning data includes forwarding instructions and scanning traffic, so that the first socks5 service program in the target client forwards the scanning traffic to other clients in the local area network according to the forwarding instructions after listening to the scanning data, so as to scan and detect the other clients.
[0009] As a possible implementation manner, after sending the target program to the target client, the method further includes:
[0010] Obtain the IP, username and password of the target client;
[0011] The establishing a connection with the target client based on the SMB protocol includes:
[0012] The target client is authenticated using the IP, user name and password of the target client, and after the authentication is passed, a connection is established with the target client based on the SMB protocol.
[0013] As a possible implementation, the target program is also used to generate a file name of the named pipe file. Before writing the scan data into the named pipe file, the method further includes:
[0014] Get the file name;
[0015] The scan data is written into the named pipe file according to the file name.
[0016] As a possible implementation, the test device includes a second socks5 service program, and the second socks5 service program is used to monitor the named pipe file; after scanning and detecting the other clients, the method further includes:
[0017] If the second socks5 service program monitors the write information in the named pipe file, the scanning detection result is obtained from the write information.
[0018] As a possible implementation manner, after sending the target program to the target client, the method further includes:
[0019] The target program is used to modify the connection permission of the named pipe file to remote connection, and the authentication mode of the named pipe file is modified to no authentication.
[0020] As a possible implementation manner, writing the scan data into the named pipe file includes:
[0021] Obtaining a target port in the test device;
[0022] The scan data is written into the named pipe file through the target port.
[0023] As a possible implementation manner, writing the scan data into the named pipe file through the target port includes:
[0024] Get the link address of the scanning tool;
[0025] The link address of the scanning tool is written into the named pipe file through the target port.
[0026] In a second aspect of an embodiment of the present application, a test system for a client in a local area network is provided, characterized in that the system comprises: a test device and a plurality of clients, wherein the plurality of clients are located in the same local area network, and the test device is not located in the local area network;
[0027] The test device is used to send a target program to a target client among the multiple clients after obtaining the operation authority of the target client, wherein the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file;
[0028] The test device is further used to write scan data into the named pipe file after establishing a connection with the target client based on the SMB protocol, wherein the scan data includes a forwarding instruction and a scan flow;
[0029] The target client is used to forward the scanning traffic to other clients in the local area network according to the forwarding instruction after the first socks5 service program monitors the scanning data, so as to scan and detect the other clients.
[0030] As a possible implementation, the test device is further used for:
[0031] Obtain the IP, username and password of the target client;
[0032] The target client is authenticated using the IP, user name and password of the target client, and after the authentication is passed, a connection is established with the target client based on the SMB protocol.
[0033] As a possible implementation, the target program is further used to generate a file name of the named pipe file, and the test device is further used to:
[0034] The file name is obtained, and the scan data is written into the named pipe file according to the file name.
[0035] According to a third aspect of an embodiment of the present application, a testing device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the testing method for a client in a local area network according to the first aspect of an embodiment of the present application is implemented.
[0036] According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for testing a client in a local area network according to the first aspect of the embodiments of the present application is implemented.
[0037] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:
[0038] The test method for a client in a local area network provided by an embodiment of the present application is applied to a test device in a test system for a client in a local area network, wherein the test system also includes multiple clients, the multiple clients are located in the same local area network, and the test device is not located in the local area network. During the test, after obtaining the operation authority of a target client among multiple clients, a target program is sent to the target client, wherein the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file; after establishing a connection with the target client based on the SMB protocol, scan data is written to the named pipe file, wherein the scan data includes a forwarding instruction and a scan flow, so that the first socks5 service program in the target client forwards the scan flow to other clients in the local area network according to the forwarding instruction after monitoring the scan data, so as to scan and detect other clients, and the concealment is strong without opening a new port, which can improve the security of the client in the local area network. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] Figure 1 A structural diagram of a test system for a client in a local area network provided in an embodiment of the present application;
[0040] Figure 2 A flowchart of a method for testing a client in a local area network provided in an embodiment of the present application;
[0041] Figure 3 A structural diagram of a test device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0043] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.
[0044] Additionally, the use of “based on” or “according to” is meant to be open and inclusive, as a process, step, calculation, or other action “based on” or “according to” one or more conditions or values may, in practice, be based on additional conditions or beyond values.
[0045] With the rapid development of the Internet, the World Wide Web has become a carrier of a large amount of information. Various things that previously required going out can now be done online without leaving home. While bringing convenience, it also brings security risks. Therefore, it is often necessary to conduct pre-rehearsal security penetration tests and non-hazardous penetration tests to discover the loopholes and security risks that exist in the Internet.
[0046] During the security penetration test, if the test engineer's test equipment obtains the login permission of a Windows host, then the test engineer needs to perform security tests on other Windows hosts in the local area network where the Windows host is located.
[0047] The existing detection technology is not perfect, and there are several problems: New ports need to be monitored: When the customer only opens one port and the port is already occupied, it is necessary to modify the firewall configuration in other ways, which complicates the task. It is easy to be identified by internal scanners. After the port is opened, if there is a security scan inside, and it is found that the compromised Windows machine has opened a new port, the machine will be directly isolated. The characteristics of the Socks protocol are relatively obvious, and it is easy to be identified when the port is directly opened for use.
[0048] In other words, the current testing method can be easily identified and isolated by other clients. Therefore, a testing method is urgently needed for this scenario.
[0049] In order to solve the above problems, the present application embodiment provides a test system for a client in a local area network, such as Figure 1 As shown, the system includes: a test device 10 and multiple clients 20, the multiple clients 20 are located in the same local area network, and the test device 10 is not located in the local area network.
[0050] After obtaining the operation authority of a target client 201 among the multiple clients, the test device scans other clients 202 in the local area network through the target client 201 .
[0051] based on Figure 1 A testing system for a client in a local area network is shown, and an embodiment of the present application provides a testing method for a client in a local area network, such as Figure 2 As shown, the method includes:
[0052] Step 201, after obtaining the operation authority of a target client among the multiple clients, sending a target program to the target client, the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file.
[0053] Among them, the named pipe file can be responsible for passing the information of one process to another process, so that the output of the process becomes the memory part of the input of another process.
[0054] Socks5 is a proxy protocol that plays an intermediary role between the front-end machine and the server machine that communicate using the TCP / IP protocol, allowing the front-end machine in the intranet to access the server in the Internet or make the communication more secure.
[0055] The first socks5 service program and the second socks5 service program are both used to monitor the named pipe file and process the relevant information of the socks5 proxy protocol. The difference is that the first socks5 service program is located at the target client, and the second socks5 service program is located at the test device.
[0056] In addition, it is necessary to link the first socks5 service program and the second socks5 service program to the named pipe file respectively, so that the first socks5 service program and the second socks5 service program can monitor the named pipe file.
[0057] That is to say, after obtaining the operation authority of a target client among the multiple clients, it means that other clients in the local area network where the target client is located also have network security risks, and then the test of the clients in the local area network is triggered.
[0058] Step 202, after establishing a connection with the target client based on the SMB protocol, write scanning data into the named pipe file, the scanning data including forwarding instructions and scanning traffic, so that the first socks5 service program in the target client forwards the scanning traffic to other clients in the local area network according to the forwarding instructions after listening to the scanning data, so as to scan and detect the other clients.
[0059] Among them, the SMB (Server Message Block) protocol, as a LAN file sharing transmission protocol, is often used as a platform for research on secure shared file transmission. The SMB protocol can provide LAN users with relevant functions and mechanisms to ensure the reliability of transmission. 90% of data packets and 95% of bytes in the LAN are transmitted through the SMB protocol, which is to solve the problems of network stability and fairness of data flow when sharing bandwidth, congestion control and efficiency.
[0060] Scanning traffic is used to perform vulnerability scans or virus detection on other clients in the LAN.
[0061] The test method for a client in a local area network provided by an embodiment of the present application is applied to a test device in a test system for a client in a local area network, wherein the test system also includes multiple clients, the multiple clients are located in the same local area network, and the test device is not located in the local area network. During the test, after obtaining the operation authority of a target client among multiple clients, a target program is sent to the target client, wherein the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file; after establishing a connection with the target client based on the SMB protocol, scan data is written to the named pipe file, wherein the scan data includes a forwarding instruction and a scan flow, so that the first socks5 service program in the target client forwards the scan flow to other clients in the local area network according to the forwarding instruction after monitoring the scan data, so as to scan and detect other clients, and the concealment is strong without opening a new port, which can improve the security of the client in the local area network.
[0062] Optionally, after sending the target program to the target client in step 201, the method further includes:
[0063] Obtain the IP, username and password of the target client;
[0064] Correspondingly, the process of establishing a connection with the target client based on the SMB protocol in the above step 202 may be:
[0065] The target client is authenticated using the IP, user name and password of the target client, and after the authentication is passed, a connection is established with the target client based on the SMB protocol.
[0066] That is to say, before establishing a connection with the target client based on the SMB protocol, it is necessary to first obtain the IP, user name and password of the target client, and then during the connection process, use the IP, user name and password of the target client to verify the target client. After the verification is passed, a connection is established with the target client based on the SMB protocol.
[0067] Optionally, the target program in step 201 is further used to generate a file name of the named pipe file, and before writing the scan data into the named pipe file, the method further includes:
[0068] Obtain the file name; and write the scan data into the named pipe file according to the file name.
[0069] That is to say, before writing the scan data into the named pipe file, it is necessary to find the named pipe file according to the file name of the named pipe file, and then write the scan data into the named pipe file. After monitoring the scan data, the first socks5 service program forwards the scan traffic to other clients in the local area network according to the forwarding instruction to scan and detect other clients.
[0070] Optionally, the test device includes a second socks5 service program, and the second socks5 service program is used to monitor the named pipe file; after scanning and detecting the other clients, the method further includes:
[0071] If the second socks5 service program monitors the write information in the named pipe file, the scanning detection result is obtained from the write information.
[0072] It can be understood that after scanning and detecting the other clients according to the scanning data, the scanning traffic will obtain the scanning and detection results of each other client, and the scanning and detection results will be written into the named pipe file. If the second socks5 service program listens to the write information in the named pipe file, the scanning and detection results will be obtained from the write information.
[0073] Optionally, after sending the target program to the target client in step 201, the method further includes:
[0074] The target program is used to modify the connection permission of the named pipe file to remote connection, and the authentication mode of the named pipe file is modified to no authentication.
[0075] Optionally, writing the scan data into the named pipe file includes:
[0076] Acquire a target port in the test device; and write the scan data into the named pipe file through the target port.
[0077] The target port is a port in the test device, and the target port may be port 1080. The scan data may be written into the named pipe file through port 1080.
[0078] Specifically, the step of writing the scan data into the named pipe file through the target port includes:
[0079] Obtaining a link address of a scanning tool; and writing the link address of the scanning tool into the named pipe file through the target port.
[0080] The scanning tool may be Nmap, which is a network connection terminal scanning software used to scan the network connection terminals opened by online computers.
[0081] The link address of the scanning tool is written into the named pipe file through the target port, and other clients can be scanned using Nmap.
[0082] The test method of the client in the local area network provided by the embodiment of the present application is applied to a test device in a test system of the client in the local area network, and the test system also includes multiple clients, and the multiple clients are located in the same local area network, and the test device is not located in the local area network. During the test process, after obtaining the operation authority of a target client among multiple clients, a target program is sent to the target client, and the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file; after establishing a connection with the target client based on the SMB protocol, scan data is written to the named pipe file, and the scan data includes forwarding instructions and scan traffic, so that the first socks5 service program in the target client forwards the scan traffic to other clients in the local area network according to the forwarding instruction after monitoring the scan data, so as to scan and detect other clients. By using the file pipeline of the SMB protocol, no new port is opened, and the concealment is stronger. And the operation is simple, and it can be executed by simply uploading a file. The characteristics of the Socks traffic are hidden in the file processing pipeline protocol, which improves security.
[0083] The present application embodiment provides a test system for a client in a local area network. The test system is as follows: Figure 1 As shown, the system includes:
[0084] A test device 10 and multiple clients 20, wherein the multiple clients 20 are located in the same local area network, and the test device 10 is not located in the local area network;
[0085] The test device 10 is used to send a target program to a target client 201 among the multiple clients 20 after obtaining the operation authority of the target client 201, wherein the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file;
[0086] The test device 10 is further used to write scan data into the named pipe file after establishing a connection with the target client 201 based on the SMB protocol, wherein the scan data includes a forwarding instruction and a scan flow;
[0087] The target client 201 is used to forward the scanning traffic to other clients 202 in the local area network according to the forwarding instruction after monitoring the scanning data based on the first socks5 service program, so as to scan and detect the other clients 202.
[0088] In one embodiment, the testing device 10 is further used for:
[0089] Obtain the IP, username and password of the target client 201;
[0090] The target client 201 is authenticated using the IP, user name and password of the target client 201 , and after the authentication is passed, a connection is established with the target client 201 based on the SMB protocol.
[0091] In one embodiment, the target program is further used to generate a file name of the named pipe file, and the test device 10 is further used to:
[0092] The file name is obtained, and the scan data is written into the named pipe file according to the file name.
[0093] In one embodiment, the test device 10 includes a second socks5 service program, and the second socks5 service program is used to monitor the named pipe file; the test device 10 is also used to:
[0094] If the second socks5 service program monitors the write information in the named pipe file, the scanning detection result is obtained from the write information.
[0095] In one embodiment, the testing device 10 is further used for:
[0096] The target program is used to modify the connection permission of the named pipe file to remote connection, and the authentication mode of the named pipe file is modified to no authentication.
[0097] In one embodiment, the testing device 10 is specifically used for:
[0098] Acquire a target port in the test device 10;
[0099] The scan data is written into the named pipe file through the target port.
[0100] In one embodiment, the testing device 10 is specifically used for:
[0101] Get the link address of the scanning tool;
[0102] The link address of the scanning tool is written into the named pipe file through the target port.
[0103] The test device in the test system of the client in the local area network provided in this embodiment can execute the above-mentioned test method embodiment of the client in the local area network. Its implementation principle and technical effect are similar and will not be described in detail here.
[0104] For the specific definition of the test system for the client in the local area network, please refer to the definition of the test method for the client in the local area network mentioned above, which will not be repeated here. Each module in the test device in the test system for the client in the local area network can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor of the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.
[0105] The executor of the testing method for a client in a local area network provided in the embodiment of the present application may be a testing device, which may be an electronic device, a computer device, a terminal device, a server or a server cluster, and the embodiment of the present application does not specifically limit this.
[0106] Figure 3 This is a schematic diagram of the internal structure of a test device provided in an embodiment of the present application. Figure 3 As shown, the test device includes a processor and a memory connected via a system bus. The processor is used to provide computing and control capabilities. The memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The computer program can be executed by the processor to implement the steps of the test method for the client in the local area network provided in each of the above embodiments. The internal memory provides a cached operating environment for the operating system and the computer program in the non-volatile storage medium.
[0107] Those skilled in the art will understand that Figure 3 The internal structure diagram of the test equipment shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the test equipment to which the scheme of the present application is applied. The specific test equipment may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0108] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for testing a client in a local area network as in the embodiment of the present application are implemented.
[0109] In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer instructions. When the computer instructions execute the various steps of the testing method for the client in the local area network in the method flow shown in the above method embodiment.
[0110] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer execution instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).
[0111] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0112] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. A method for testing a client in a local area network, characterized in that: A test device applied to a test system of a client in a local area network, the test system further comprising a plurality of clients, the plurality of clients being located in the same local area network, the test device being not located in the local area network, the method comprising: After obtaining the operation authority of a target client among the multiple clients, sending a target program to the target client, the target program including a named pipe file and a first socks5 service program, the first socks5 service program being used to monitor the named pipe file; After establishing a connection with the target client based on the SMB protocol, scanning data is written into the named pipe file, and the scanning data includes forwarding instructions and scanning traffic, so that the first socks5 service program in the target client forwards the scanning traffic to other clients in the local area network according to the forwarding instructions after listening to the scanning data, so as to scan and detect the other clients.
2. The method according to claim 1, characterized in that After sending the target program to the target client, the method further includes: Obtain the IP, username and password of the target client; The establishing a connection with the target client based on the SMB protocol includes: The target client is authenticated using the IP, user name and password of the target client, and after the authentication is passed, a connection is established with the target client based on the SMB protocol.
3. The method according to claim 1, characterized in that The target program is also used to generate a file name of the named pipe file. Before writing the scan data into the named pipe file, the method further includes: obtaining the file name; The sending of the target program to the target client includes: The scan data is written into the named pipe file according to the file name.
4. The method according to claim 1, characterized in that: The test device includes a second socks5 service program, and the second socks5 service program is used to monitor the named pipe file; after scanning and detecting the other clients, the method further includes: If the second socks5 service program monitors the write information in the named pipe file, the scanning detection result is obtained from the write information.
5. The method according to claim 1, characterized in that: After sending the target program to the target client, the method further includes: The target program is used to modify the connection permission of the named pipe file to remote connection, and the authentication mode of the named pipe file is modified to no authentication.
6. The method according to claim 1, characterized in that Writing the scan data into the named pipe file comprises: Obtaining a target port in the test device; The scan data is written into the named pipe file through the target port.
7. The method according to claim 5, characterized in that Writing the scanned data into the named pipe file through the target port includes: Get the link address of the scanning tool; The link address of the scanning tool is written into the named pipe file through the target port.
8. A test system for a client in a local area network, characterized in that: The system comprises: a test device and a plurality of clients, wherein the plurality of clients are located in the same local area network, and the test device is not located in the local area network; The test device is used to send a target program to a target client among the multiple clients after obtaining the operation authority of the target client, wherein the target program includes a named pipe file and a first socks5 service program, and the first socks5 service program is used to monitor the named pipe file; The test device is further used to write scan data into the named pipe file after establishing a connection with the target client based on the SMB protocol, wherein the scan data includes a forwarding instruction and a scan flow; The target client is used to forward the scanning traffic to other clients in the local area network according to the forwarding instruction after the first socks5 service program monitors the scanning data, so as to scan and detect the other clients.
9. The system according to claim 8, characterized in that The test equipment is also used to: Obtain the IP, username and password of the target client; The target client is authenticated using the IP, user name and password of the target client, and after the authentication is passed, a connection is established with the target client based on the SMB protocol.
10. The system according to claim 8, characterized in that The target program is further used to generate a file name of the named pipe file, and the test device is further used to: The file name is obtained, and the scan data is written into the named pipe file according to the file name.