Random Characters being printed
Hi All:
Started working at a new job. The org has 20+ Konica Minolta and Lexmark Printers. A new print server was put in (PAPERCUT MF) and a new W2019 Std Print Server VM was built and deployed to support this new mechanism for printing via Papercut.
Everymorning on various devices, there will be a series of printed pages with random characters at the top that reminds me a bit of a print driver misconfiguration. The tops of the pages will have two or three rows of random characters that print any where on 3 pages or sometimes as much as 100 pages.
This has been going on for years from what I understand and doesn't seem related at all to this new print server project that was done this summer.
Anyways, I was thinking of using WIRESHARK to help root cause where the SOURCE of the traffic is. I was thinking of putting a tap in front of one of the lesser used printers with the hopes of collecting the IP addresses of ANY IP source that may be trying to communicate to the printer.
TBH, I don't k now what DESTINATION port is being printed to but suspect it's PORT 9100, though it could be IPP (631) or other (LPR 515 or 721-731)
So my thought is to get a NETGEAR 5-port GS305ev2 and setup port mirroring. I'd plug one port into the LAN cable coming in from the switch, another into the printer, and mirror traffic coming from the switch port. Using Wireshark, I'd like to start a capture.
My question isn't so much how to start a capture, but how to setup a FILTER to capture EVERY UNIQUE SOURCE IP and PORT going to the PRINTER IP (ANY PORT).
My thought was to let this setup run for the night. We have no idea where the print jobs are coming from, but our users say that the random printed pages are on the printers before they start their jobs at 8:00am.
Something is sending jobs to these devices. My thought is to try and at least identify the SOURCE of the jobs and then to dig into those endpoints to see what applications may be configured to be printing to these printers.
IDK if it's some old device or scheduled print job using IP printing. Really have no idea.
Looking for thoughts and advise. IDK how to setup a capture filter to try and restrict the packets recorded. I'm simply trying to identify any endpoints that are communicating to one specific printer for now as a pilot. It's possible that the source identified MAY be the root cause of the random printing on all the printers. IDK.
Why do you want to set a filter, don't you want to capture all traffic to see what's going on?
Just worried about having some massive PCAP log (haystack) to try rummage through really. I figure if I could limit the traffic, it'd be easier to identify UNIQUE sources.