This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to get LPD data content

0

Hello,

can you help me please, how to get LPD data file from my capture file? I know hot to get data file from IPP protocol, but I have problems with LPD (data file is divided into more frames - IPP data file is in one frame so I can just export it easily). Here is my printcap file: http://speedy.sh/9ZEV7/LPDtext.pcapng

Thank you! :)

asked 10 Dec '13, 15:05

Andyn's gravatar image

Andyn
6335
accept rate: 0%


One Answer:

2

Right click on any of the LDP frames and choose "Follow TCP Stream". In the pop-up window that appears, de-select 'Entire conversation' from the drop down box and choose the data direction that shows the string "%!PS-Adobe-3.0". Then select everything between %!PS-Adobe-3.0 and %%EOF (including those two). Press CTRL-C (Copy) and paste it into a Text Editor. Then save it as test.ps (PostScript file).

UPDATE

Unfortunately copy-paste to an editor does not work, as there are some binary characters the will get lost. So, please use the following method:

  • Right click on any of the LDP frames and choose "Follow TCP Stream".
  • In the pop-up window that appears, de-select 'Entire conversation' from the drop down box and choose the data direction that shows the string "%!PS-Adobe-3.0".
  • Save that in RAW format to a file: test.ps (PostScript file).
  • open test.ps with an editor that can handle binary data (I used gvim).
  • remove everything before %!PS-Adobe-3.0
  • remove everything after %%EOF
  • save the modified version
  • open it with GSview

GSview shows the following content for your document:

      Test tisku s LPD protokolem. 
      Úterý, 10. prosinec 2013 

Regards
Kurt

answered 11 Dec '13, 05:54

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 12 Dec '13, 00:09

Thank you for your reply. I tried it but it doesn't work. I print from Mac OS X 10.9 to Ubuntu 13.04. When I save these lines to pdf on my MAC, content of the new PDF file is the same like before (%!PS-Adobe-3.0...%%EOF). When I try it on Ubuntu, the opened PDF file is loading its content infinitely. But output of my printer (CUPS PDF virtual printer) is correct.

(11 Dec '13, 11:34) Andyn

sorry, my fault. It's a PostScript file not a PDF file. I simply chose the wrong extension and I've corrected my answer.

If you want to view that file, you'll need a PostScript viewer, like GSview or Adobe Acrobat Reader.

(11 Dec '13, 12:19) Kurt Knochner ♦

Thank you, but it didn't help. I think there is a problem in that data file. Structure of the PDF file looks strange. Or not? Maybe there is a problem with Mac...

(11 Dec '13, 15:18) Andyn

I sent another file with IPP from Mac -> Ubuntu and I have the same problem (but I had sent it with IPP from Ubuntu -> Mac without problems).

(11 Dec '13, 15:22) Andyn

It's not a PDF file. It's Postscript!

BTW: Do you think you will get the original document (PDF, word, etc.) if you extract IPP or LPR/LPD data? You won't. It's either PCL, Postscript, GDI or any other 'printer language'. In your case it is Postscript.

(11 Dec '13, 15:28) Kurt Knochner ♦

see the UPDATE in my answer.

(12 Dec '13, 00:05) Kurt Knochner ♦

It works now. Thank you very much!!! :)

(12 Dec '13, 03:38) Andyn

Good.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(12 Dec '13, 04:51) Kurt Knochner ♦
showing 5 of 8 show 3 more comments