Printer Traffic

[Manuales]

Hi ..
could you tell me what i have to do according to the following request? i mean, how can i verify that one?


While testing the migration to the new firewall we have found a lot of printer traffic being blocked coming from California and NewJersey going to 111.222.69.243. The source IP addresses are 111.222.80.64 (port 9100) and 111.222.65.139 (port 515). The traffic is hitting the firewall and being blocked, Can you look at the print queues and let me know what device you are expecting at 111.222.69.243? This traffic has been blocked for a long time, it is not related to the firewall migration, but we identified it because we were looking for odd dropped traffic today.

I do not know what device the requester refers.
could you please let me know what i have to do?

Thanks.

[Patrick Wallek · Accepted solution]

Have you tried pinging 111.222.69.243? What about nslookup to see if it has a hostname? You could also try telnet and a web browser to see if that IP address responds.

[Manuales]

If i ping 111.222.69.243 does not responds and if i nslookup does not responds: Non-existent domain.

This guy wants to know the following:
what device you are expecting at 111.222.69.243?

what do i have to check to let him know that one?

[James R. Ferguson]

Hi Manuales:

> This guy wants to know the following:
what device you are expecting at 111.222.69.243?

I think that he is asking about the expected protocol at the port assigned. For example, port 515 is the standard port for LPR/LPD (so-called "remote" or Line-Printer-Remote/Line-Printer-Daemon) implementations.

Regards!

...JRF...

[Manuales]

ok .. we could verify it ...
it is a printer ip address ...

thanks.

[Bill Hassell]

The HP JetDirect LAN card normally uses port 9100 and it is not unusual for port 515 (standard Unix printing) as well as port 9100 to be blocked by routers and firewalls. This is the default configuration and must be overidden once the traffic is determined to be safe for Internet transmission. A printer is particularly unsafe because the sender rarely thinks about the consequences of having their print job copied and examined.

The source of the blocked traffic is where you start looking. If you are not expecting the traffic, someone has a badly configured system that needs to be fixed. If you are indeed expecting the printer traffic, I would leave it blocked until your security department evaluates what is happening and makes a decision on whether to shutdown the printing traffic or allow it through the firewall.

Of course this all assumes that there is a printer located at the two IP addresses. Note that 9100 can only be a printer, most likely an HP model, while the port 515 machine might be a computer acting as a print server.

[A. Clay Stephenson]

I would request that the Firewall team open ports 515 (LPR/LPD protocol) and ports 9100-9102 (HP JetDirect Protocol). While the vast majority of JetDirect devices use port 9100 only, some external JetDirects have multiple parallel and serial ports so that one external JetDirect can service up to 3 physical printers (hence ports 9100,9101, and 9102).