Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am scanning a network using nmap. I assume that this network has copy machines and printers with IP addresses. Is there a way I can differentiate the regular computers from the printers? nmap can detect the OS, but is it sufficient?

Thank you for any ideas.

share|improve this question

migrated from stackoverflow.com Jun 8 '10 at 14:23

This question came from our site for professional and enthusiast programmers.

2  
You mean you don't know? You probably shouldn't be using nmap on someone else's network! –  Joel Coehoorn Jun 8 '10 at 15:39

1 Answer 1

Do a range scan and look for open port 515 and 9100. That will tell you which addresses belong to printers.

nmap -p 515,9100 192.168.1.1-200 -oG - | grep open

Then check for ports that are "Open". There is an --open directive, but it's not working for me, for whatever reason.

515 is also used by print servers, so if you have a domain controller (or whatever) acting as a print server, it'll show up here as well. That's where checking 9100 comes in.

Edit:

You can also just do nmap -O 192.168.1.1/24 -oG - | grep printer and trust that nmap will correctly identify the device.

share|improve this answer
1  
Add "631" to the interesting ports. IPP printers use 631. LPR/LPD printers use 515. HP JetDirect (or AppSocket) printers very often use 9100 (some also use 4010, 4020, 4030 and 5503). –  Kurt Pfeifle Jul 5 '10 at 21:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.