This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

A ghost prints during the night on a printer.

1

Hi, Each night, without any people send anything, a printer prints 10 blank pages. When the printer is not connected to the network, it prints nothing. Impossible to know who send this (what server, what device, what machine on the network, during the night, without any people in the plant). So I'm searching a tool, that I lunch on my desktop on the afternoon, to discover which IP address sent some traffic to this printer. Our network countains 390 PC, 20 servers, 40 IP printers, and others IP tools, in 5 buildings. Question 1 : is wireshark the good tool to have this information. Q2 : if yes, how can I do this ? Q3 : if no, is there another tool to do this ?

asked 20 Oct '17, 05:57

JMiG's gravatar image

JMiG
21113
accept rate: 0%

Is this a enterprise type printer, or a simple model? What kind of logging / accounting can it do? Does this allow you to at least narrow down when this job is being printed?

(20 Oct '17, 08:27) Jaap ♦

It's a label printer => "Intermec PD42". Normally only the MRP software (when we receeive a shipment, the software automatically prints labels for the received parts). This software runs only on a server. The server send labels. But I searched in the logs of this software, a not any label has been sent during the night.

(20 Oct '17, 08:33) JMiG

One Answer:

1

Yes, Wireshark would be my tool of choice (or any other packet capture tool). Problem is that it won't do any good to run it on your desktop: the packets going to the printer are not going to be visible there in a switched network.

What you need to do is this:

  1. Find the switch the printer is connected to
  2. determine if that switch is manageable and can be configured for a SPAN port (also called monitor port), which means that you can send copies of packets from one port (the printer port) to the port where you attach your Wireshark laptop/PC
  3. if the switch is not configurable for SPAN you are in trouble and need to find other ways, e.g. using a TAP (which you probably don't have) or getting a small configurable switch you can insert into the link to the printer
  4. capture the packets

For capture setup information, check out

https://wiki.wireshark.org/CaptureSetup/Ethernet

https://blog.packet-foo.com/2016/10/the-network-capture-playbook-part-1-ethernet-basics/

In the end you should have packets around the time the printer prints (make sure the capture laptop/PC clock is correct) and can easily see the IP/MAC the traffic is coming from.

answered 20 Oct '17, 06:03

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%