Network printer and hpnp

[so_2]

Hi

Please could any one clarify the communication flow between server running hpnp and network printer ?
I have one such system and I captured some data using lsof and is pasted below.

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hpnpf 21689 lp 4u IPv4 0xe7059040 0t825 TCP mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100 (ESTABLISHED
)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hpnpf 21689 lp 4u IPv4 0xe7059040 0t825 TCP mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100 (ESTABLISHED
)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hpnpf 21689 lp 4u IPv4 0xe7059040 0t825 TCP mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100 (ESTABLISHED
)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hpnpf 21689 lp 4u IPv4 0xe7059040 0t825 TCP mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100 (ESTABLISHED
)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hpnpf 21689 lp 4u IPv4 0xe7059040 0t825 TCP mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100 (ESTABLISHED
)


Here printer is connected to the server using port 9100. When a user tries to print something on printer lb04, could you please
tell me how the communication start?

Whether the printer request for (xxxx something ) to the server on port 9100 , or the server sends data to the printer on a random
port?

if some one explain me the full details of the socekt "mfgprd.bcm-ltd.co.uk:58608->lb041.int.bcm-ltd.co.uk:9100" craeted after I
tried a test print on this printer.

It will be very helpfull for me as I have a big problem whcih need to be resolved after knowing this?

Thanks in advance
S.O

[Jonathan Fife · Accepted solution]

The print server listens on port 9100 (typically). When a print request goes into the queue on the host side, the lpsched daemon runs the interface script in /var/spool/lp/interface/ and passes it the job information. That script then calls the model script to format the request and pipes the output of that to the hpnpf command. That command, as you see, establishes communication from a random host port number to port 9100 on the print server, and sends its data over that socket.

If you need more detail on what exactly goes on in that communication I would suggest installing ethereal and sniffing anything headed to port 9100 on the print server.

[so_2]

Thanks a lot Jonathan, for your fast and usefull reply.

Now i am pasting below a data captured by running netstat -an in loop and and greepd for 99.99.99.99

tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.64101 99.99.99.99.9100 SYN_SENT

I dont have a printer configured at address 99.99.99.99
All the request are in Syn_sent status.

When i checked with lsof -i:9100 again looped and done for long time , the output I got have pasted on my initial query.
There are no trace of this IP on the output.

So would you able to tell me whether this request showing the ipadderss 99.99.99.99 is originating from server or is it from outside of the server?

Thanks again
s.o

[Jonathan Fife]

That is pretty odd. I would make sure you have nothing set up at 99.99.99.99 in /etc/hosts, or in your /var/spool/lp/interface file.

grep 99\.99\.99\.99 /etc/hosts /var/spool/lp/interface

Does lb041.int.bcm-ltd.co.uk resolve to 99.99.99.99 by any chance?

[Bill Hassell]

hpnpf is the printer communication program and the man page indicates what you can do with this program. Essentially, hpnpf opens the socket on port 9100, checks status, sends data and checks acknowledgements, then closes the port. That's all it does. If you want to see a more detailed log of what it does, use -l as in:

hpnpf -x 12.34.56.78 -l /var/tmp/hpnpf.log /etc/fstab

If you want to see the entire handshake, get a copy of Wireshark (formerly Ethereal) and trace the conversation.

[so_2]

Thanks...

I have nothing configured on 99.99.99.99.
I checke as suggested but nothing found.

Here is the log i got using the command
hpnpf -x 99.99.99.99 -l /var/hpnplog

logs===
====
12:35:43 hpnpf[14096] OpenSocket: using 16K send buffer
12:35:43 hpnpf[14096] MakeConnection: 99.99.99.99, port 9100
12:36:59 hpnpf[14096] Error (connect): Connection timed out
12:36:59 hpnpf[14096] Fail to make network connection, ETIMEDOUT
12:37:59 hpnpf[14096] OpenSocket: entered
12:37:59 hpnpf[14096] OpenSocket: using 16K send buffer
12:37:59 hpnpf[14096] MakeConnection: 99.99.99.99, port 9100
12:39:16 hpnpf[14096] Error (connect): Connection timed out
12:39:16 hpnpf[14096] Fail to make network connection, ETIMEDOUT
12:40:16 hpnpf[14096] OpenSocket: entered
12:40:16 hpnpf[14096] OpenSocket: using 16K send buffer
12:40:16 hpnpf[14096] MakeConnection: 99.99.99.99, port 9100
12:41:32 hpnpf[14096] Error (connect): Connection timed out
12:41:32 hpnpf[14096] Fail to make network connection, ETIMEDOUT
12:42:32 hpnpf[14096] OpenSocket: entered
12:42:32 hpnpf[14096] OpenSocket: using 16K send buffer
12:42:32 hpnpf[14096] MakeConnection: 99.99.99.99, port 9100
12:43:48 hpnpf[14
======

My network team says the tarsffic I shown in my previos request (ie 99.99.99.99:9100 with status SYN_SENT) is originated from my server. But I am not able to find any process in my server initilising this traffic.

I have process for established connections to port 9100 in my server but those prs and ip address are valid.

With this much of information do any one predict that this traffic is not from server ? Or do i need to install ethreal to conclude?

Thanks
s.o

[Jonathan Fife]

The connection is almost definitely being initiated by the server -- hpnpf doesn't listen for incoming requests, it is run from the interface script (or manually, if you are so inclined).

That IP must be specified somewhere on the server as a commandline argument, in a configuration script, or defined as a host. There is no easy way to determine the last two other than searching all the files on your server.

Can you do an nslookup on 99.99.99.99? Does it resolve? If so, try the following with the resolved hostname as well as the IP. If it doesn't resolve, just use the IP.

Since 99.99.99.99 is unreachable the files hpnpf is trying to print will still be around. If you do an lpstat -o you should see any pending requests, which you can then match up to files in the /var/spool/lp/request directory. Look for files with older timestamps. If any older files aren't needed, you can stop the print spooler (lpshut), remove the files (make sure to get both of the related files -- each request has a properties file and the actual request file), and then re-start the spooler (lpsched).

HTH

[Bill Hassell]

To see all the (JetDirect card) printers and their addresses, use this command:

grep ^PERIPH /etc/lp/interface/*

This will show how each printer was configured. PERIPH will show either a hostname or an IP address. If hostnames are shown, use this mini-script to decode all of them:

for JDPRN in /etc/lp/injterface/*
do
echo $JDPRN
getip $(grep ^PERIPH $JDPRN | cut -d = -f 2)
done

That will show what the actual IP addresses are based on this specific machine.

[so_2]

Hi

Being busy with some critical problems i am unable to test it today as both of you suggested. I will do it on monday .
Thanks for your continued help.

s.o

[so_2]

Hi

I ran the script and i got it......
/etc/lp/interface/qlb101
28.1.253.106
/etc/lp/interface/qlb102
28.1.253.247
/etc/lp/interface/qlb103
99.99.99.99
/etc/lp/interface/qlb104.

After that I cancelled all the print request to qlb103 and I removed the queue using "removequeue" command.
I then removed all the files related with the printer queue hoping that i will have a pleasure time today .
But still the traffic is coming.
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT
tcp 0 1 10.214.8.68.58570 99.99.99.99.9100 SYN_SENT

. What wrong I did here?
How can i get rid of this ?

Thanks again.
s.o

[Bill Hassell]

Shutdown the spooler (lpshut) then make sure all lp processes have been terminated:

ps -f -u lp

Kill anything owned by lp. Also check that there are no hpnpf processes:

UNIX95=1 ps -f -C hpnpf

Once the ps command reports no more lp and hpnpf processes, watch for the bad address on the network again. If it is still there, you may need to use lsof to track down the process that is causing the SYN messages.