35

Whats the best way to find printers in my network with nmap? Is it possible to save the printers ip to a file?

1

3 Answers 3

47

If you're leery of doing OS Fingerprinting for some reason, you can do a more targeted port-scan:

nmap -p 9100,515,631 192.168.1.1/24 -oX printers.xml

That'll scan for ports common to printers and printing systems.

  • 9100 = the RAW port for most printers, also known as the direct-IP port
  • 515 = the LPR/LPD port, for most printers, as well as older print-servers
  • 631 = the IPP port, for most modern printers, and CUPS-based print-server

Output is in XML.

3
  • Your answer was very helpful! Jan 22, 2011 at 3:28
  • This did not work for me. Sep 3, 2014 at 20:56
  • 12 years later, and I think this port list is still accurate!
    – sysadmin1138
    Mar 20, 2023 at 22:04
9

This reply answers your first question directly. For the second question, understanding the command will let you also put printer IP addresses in a file. So here we go:

nmap -p 515,631,9100 -oG - 10.81.129.0/24 | gawk '/open/{print $2}' | xargs --delimiter='\n' nmap -sU -p 161 -oG - | gawk '/open/{print $2}' | xargs --replace=$ipaddress snmpget -v 1 -O v -c public $ipaddress system.sysDescr.0 | sed 's/STRING:\s//'

Process description

  1. It scans a network searching for network entities that are listening on the default printer ports.
  2. Using the results of the previous step it will check for SNMP support on these devices.
  3. For each device that has SNMP support it queries the network entity for a device description.

Command breakdown

nmap - Network scanning. (Nmap.org)

  • -p 515,631,9100 Scan for TCP Port 515, 631 and 9100.
  • -oG - Use the grep-able output format.
  • -sU -p 161 Scan for UDP port 161.

gawk or awk - Process column-oriented text data. By default, whitespaces separates the line into columns. (Wikipedia)

  • gawk '/regexp/' Use regulair expression with gawk to filter out lines matching this regulair expression.
  • gawk '{<code>}' Use the awk C-like input language to manipulate the output.
  • gawk '{/open/print $2}' Search for lines matching “open” and print the second column.

xarg - Build and execute commands from given input. By default whitespaces separates the line into arguments. (Wikipedia)

  • --delimiter='\n' Separate arguments per new line (\n) instead of whitespace.
  • --replace=$ipaddress For each line, store the argument into $ipaddress.

snmpget or snmpwalk - Use SNMP GET request to query for information on a network entity. (net-snmp.org, more about SNMP on Wikipedia)

  • -c public Set community string to public.
  • -v 1 Set SNMP version to 1.
  • -O v Don’t print OID.
  • system.sysDescr.0 Variable to query. Description of this particular variable: "A textual description of the entity. This value should include the full name and version identification of the system's hardware type, software operating-system, and networking software. It is mandatory that this only contain printable ASCII characters."

sed - Parses and transforms text. (Wikipedia)

  • 's/day/night/' Find the first occurrence of the string day in a line, and replace it with night.
  • 's/STRING:\s//' Find STRING:\s and replace it with nothing. This removes STRING:\s from the input. \s stands for a whitespace.

There are some UNIX supported commands involved. Personally I made this chain work on a Windows machine using Cygwin to obtain those commands.

2
  • 3
    In Linux i used the following variation to show the IP and the SNMP system string. The '--replace=$ipaddress' didn't work in my environment: nmap -p 515,631,9100 -oG - 192.168.100.0/24 | gawk '/open/{print $2}' | xargs --delimiter='\n' nmap -sU -p 161 -oG - | gawk '/open/{print $2}' | xargs -I{} sh -c 'echo {} ; snmpget -v 1 -O v -c public {} system.sysDescr.0' | sed 's/STRING:\s//'
    – NoelProf
    Dec 7, 2015 at 23:12
  • The version of @NoelProf works great in CentOS 6. One thing which might be improved is the UDP scanning part. I tried the whole chain, but some of the printers where not discoverd; especially when they where behind a VPN. I figured it is because we only test exactly once if they answer on UDP port 161. But UDP might get lost on the way. It would be better to check it multiple times.
    – masgo
    Mar 9, 2017 at 0:07
5

The easiest way is to scan with nmap -O: nmap will usually correctly determine if a machine is a printer or not based on the OS.

nmap -O 192.168.1.1/24 -oG - | grep printer >> outfile

Should make it one entry per line and dump it to a file called "outfile". Obviously change the ip range to whatever range you're scanning

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .