Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just bought a new HP Officejet 6500 printer. It has a built-in ethernet port, so I happily connected it to my network. While I was playing around with it, I saw that it stopped responding periodically. Looking around, I saw that the firewall is blocking the printer because of a UDP Port Scan:

Printer blocked due to UDP Port Scan

So my questions are:

  • Is it normal for a network printer/scanner to do a UDP Port Scan?
  • If it is, how can I tell Mcafee that it's OK?
    • Could it be that it's legitimate, but Mcafee is simply being overly cautious?
  • If it isn't, how can I fix it?

Edit:

Is there any way to see which UDP ports are being accessed and maybe triggering this?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

We have run into the same problem. The fix according to https://kc.mcafee.com/corporate/index?page=content&id=KB66283 is to add the IP of the printer to your Trusted Networks list. I think that is a bit of an over-reaction, but it appears that they don't have a better solution.

share|improve this answer
    
and did this work for you? –  Nathan Fellman Sep 9 '10 at 20:40
    
What version of IPS do you have? –  Nathan Fellman Sep 9 '10 at 20:41
    
Unfortunately, my workplace's policies don't allow me to set trusted hosts or networks. The best they suggested is to simply disable the firewall when I want to use the printer/scanner. Oh well... this was the most helpful answer, so you get the green arrow :-) –  Nathan Fellman Sep 9 '10 at 21:32

Looking at the Printer's manual the printer uses UDP port 5353. Allowing this port will help to fix your failure to print. In my experience most Anti-Virus software are being overly cautious for good reasons (they don't want to get sued). If you are behind a router, and have a firewall installed, more than likely hackers are not trying to get to you, especially from the UDP port.

UDP Scanning

Port scanning usually means scanning for TCP ports, which are connection-oriented and therefore give good feedback to the attacker. UDP responds in a different manner. In order to find UDP ports, the attacker generally sends empty UDP datagrams. If the port is listening, the service should send back an error message or ignore the incoming datagram. If the port is closed, then most operating systems send back an “ICMP Port Unreachable” message. Thus, you can find out if a port is NOT open, and by exclusion determine which ports are open. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).

Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernal may limit destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded.

reference

share|improve this answer
    
I tried this, but it didn't help. –  Nathan Fellman Aug 31 '10 at 17:41
    
You allowed the service from the McAfee firewall? or just enabled the UDP port 5353? –  KronoS Aug 31 '10 at 17:50
    
I just enabled the port from this host. What is the service that I should enable? –  Nathan Fellman Aug 31 '10 at 17:52
    
Being not very familiar with McAfee you might have to set a custom rule for that port. You also might need to open the port in windows firewall –  KronoS Aug 31 '10 at 18:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.