Printer web connection problem

asked 2017-11-07 02:29:06 +0000

shhwang
3 ●3

updated 2017-11-09 16:50:53 +0000

Eddi

2379 ●8 ●48 ●59

I used to connect printer's website for usage checking,

However, sometimes I can't connect the printer's website.

I can connect target printer with telnet( port : 80 ), but, i cannot connect target printer with web browser...

...

belows are follow TCP Stream result

 GET / HTTP/1.1
 Accept: text/html, application/xhtml+xml, */*
 Accept-Language: ko-KR
 User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; TCO_20170914171800)
 Accept-Encoding: gzip, deflate
 Host: 172.1.108.202
 Connection: Keep-Alive
 ...

as soon as first http message sended( GET / HTTP/1.1 .. ), TCP Retransmission and RST is occured.

and this pattern show recursively.

edit retag flag offensive close merge delete

Comments

Can you share a capture file showing the pattern? (s. https://blog.packet-foo.com/2016/11/t...)

Uli ( 2017-11-07 22:03:33 +0000 )edit

I upload .pcapng file.

https://www.cloudshark.org/captures/f...

Thank you in advance.!

shhwang ( 2017-11-08 06:37:52 +0000 )edit

[updated: formatting to make the HTTP request easier to read]

Eddi ( 2017-11-09 16:51:23 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2017-11-09 16:59:20 +0000

Eddi

2379 ●8 ●48 ●59

Interesting trace file.

Most remarkable, the client is sending two identical HTTP requests over two separate TCP connections simultaneously. Pairs of the TCP connections are source ports 24409 / 244010 and 24414 / 24415. Please let us know, if this is due to some trace file sanitation, or the real behavior.

A couple of other things to look for:

What happens, if you use a different browser? This would allow us to check if the HTTP server is confused by the user-agent.
The HTTP request references an IP address. What happens, if you send the HTTP request using the hostname configured for the printer?

edit flag offensive delete link

Comments

It solved by 3rd-party company which deployed our network system. maybe cause by wrong configuration for routing setting. thank you.!

shhwang ( 2017-11-13 05:28:28 +0000 )edit

add a comment

answered 2017-11-09 22:29:56 +0000

mrEEde
4033 ●16 ●48 ●77

updated 2017-11-10 09:08:38 +0000

sindy
6209 ●5 ●66 ●55

You can actually connect using a browser also. Th e3-way handshake succeeds so there is an active listener at the printer. However the HTTP GET doesn't specify any file to get. I suggest you try
http://172.1.108.202/index.html
and report the results
Regards Matthias

edit flag offensive delete link

Comments

[http://172.1.108.202/index.html] did not work also..

shhwang ( 2017-11-13 05:27:24 +0000 )edit

add a comment