Hello bwillie
Welcome to ask.wireshark.org.
In general, a printer's model number is rarely broadcasted over the network. Since there is no fixed field in a network protocol there is no feature in Wireshark to identify the model.
Under certain, very specific circumstances, you might have a chance to find some information about the printer in a trace file:
- If you record traffic in the same network segment as the printer (say a SOHO network where printer and computer reside side by side) you can identify the manufacturer from the printers MAC address.
- Some printer drivers use the SNMP protocol to poll status information, like available paper, ink or toner. In rare circumstances the SNMP packets might reveal further information like manufacturer, model number or SW version.
- Many networks printers support the Simple Service Discovery Protocol (SSDP) protocol. They either broadcast their presence to the network or respond to queries from another system. These packets might include more information.
- Printers might support more protocols, which are not directly related to printing. Examples are FTP, SMB or LLTD. These packets can include further details. For FTP and SMB I would look at the banner presented during session setup.
- If the printer is poorly managed a web interface might be exposed to HTTP (opposed to HTTPS). These fields are only available if a user or administrator accesses the web interface during the capture operation.
Good luck
Eddi
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
