2554ci Randomly prints documents

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Samanator
    Service Manager

    Site Contributor
    VIP Subscriber
    500+ Posts
    • Sep 2017
    • 571
    #1

    2554ci Randomly prints documents

    The customer claims the attached document will print either when the machine comes out of warm up or randomly. The customer is president/owner of a company and has this machine in his office to exclusively print from. He is a mac user that installed the print driver himself.

    I do know that machines do not just randomly print documents. I installed the latest firmware on the machine during setup out of the box. I had to turn on WiFi direct printing so the customer could print from his phone. He did not wish to download the Kyocera print app.

    I remember long ago early digital machine would be set to automatically print out a configuration page when they would come on and one would would have to go in and turn that command off. The IT guy seems to think that this problem may be something like that. It's not, but I'm going to have to prove it.

    To be clear I think this is totally a network or mac issue, BUT since the machine is printing out pages allegedly by itself for the prime decisions make, it is now fallen to me to figure this out.

    This company has many machines we wish to replace. Any and all help is appreciated.
    Attached Files
    Tags: customer, document, machine, print, randomly
    • PrintWhisperer
      Trusted Tech

      250+ Posts
      • Feb 2018
      • 453
      #2
      Re: 2554ci Randomly prints documents

      This is web code being sent to the printer, but in a very unusual fashion.

      50.207.19.114 appears to be the printer and some 'host' is sending WEB code to the ALL OPEN TCP print ports IN ORDER. Someone may be war-driving the printer. (Wardriving involves attackers searching for wireless networks with vulnerabilities while moving around an area in a moving vehicle. )

      The header of the printed document shows webcode being directed at the following addresses:
      50.207.19.114:9100 is default printer port, the others are virtual printer ports for custom applications
      50.207.19.114:9101
      50.207.19.114:9102
      50.207.19.114:9103

      This is not normal and looks intrusive. Normally only port 9100 is used by Print Setup in most operating systems and only advanced users direct printers to ports 9101-9103

      Are there other network connections to the machine?

      I would set the WiFi Direct NOT to broadcast the SSID (if possible, I cannot check RN), change it, and make a note of it. Set up user to manually enter SSID for connections.
      "Being ignorant is not so much a shame, as being unwilling to learn" - Benjamin Franklin

        Comment

        • progoffice
          Trusted Tech

          250+ Posts
          • Nov 2008
          • 334
          #3
          Re: 2554ci Randomly prints documents

          Samanator - I sent you a PM regarding your issue.

            Comment

            • PrintWhisperer
              Trusted Tech

              250+ Posts
              • Feb 2018
              • 453
              #4
              Re: 2554ci Randomly prints documents

              Now that I think about it, the Wifi direct sets up a different IP schema. Still a good idea to make it un-adverstised.

              I am guessing it's a Wired connection and the traffic could be a security port scan.
              "Being ignorant is not so much a shame, as being unwilling to learn" - Benjamin Franklin

                Comment

                • slimslob
                  Retired

                  Site Contributor
                  25,000+ Posts
                  • May 2013
                  • 36833
                  #5
                  Re: 2554ci Randomly prints documents

                  The random garbage printed only at the top of many of the pages reminds me of what you would get in days of yore when you sent a job to a dot matrix printer using a laser driver or visa versa. The entire output is what the printer is trying to decipher the job header. Also seen it with early document publishing software when a job was sent to early PCL printers using a PostScript driver. 20 pages isn't bad, I seen go hundreds of pages with just a few lines of garbage at the top of each page.

                    Comment

                    • blackcat4866
                      Master Of The Obvious

                      Site Contributor
                      10,000+ Posts
                      • Jul 2007
                      • 22930
                      #6
                      Re: 2554ci Randomly prints documents

                      It's certainly some kind of non-print data. The way that I stopped such prints was to enable job accounting, ignore jobs without valid job account. That does mean that your user will have to enter a job account ID to use the machine, but it is a small price to pay to exclude this type of non-print data. And the job account ID is programmable into the print driver.

                      Changing the IP will not help if whatever this data is, is broadcast to all IP's. IT support will insist that there is no non-print data hitting the machine's IP address, and I just never had the skills to prove otherwise. =^..^=
                      If you'd like a serious answer to your request:
                      1) demonstrate that you've read the manual
                      2) demonstrate that you made some attempt to fix it.
                      3) if you're going to ask about jams include the jam code.
                      4) if you're going to ask about an error code include the error code.
                      5) You are the person onsite. Only you can make observations.

                      blackcat: Master Of The Obvious =^..^=

                        Comment

                        • blackcat4866
                          Master Of The Obvious

                          Site Contributor
                          10,000+ Posts
                          • Jul 2007
                          • 22930
                          #7
                          Re: 2554ci Randomly prints documents

                          Originally posted by PrintWhisperer
                          This is web code being sent to the printer, but in a very unusual fashion.

                          50.207.19.114 appears to be the printer and some 'host' is sending WEB code to the ALL OPEN TCP print ports IN ORDER. Someone may be war-driving the printer. (Wardriving involves attackers searching for wireless networks with vulnerabilities while moving around an area in a moving vehicle. )

                          The header of the printed document shows webcode being directed at the following addresses:
                          50.207.19.114:9100 is default printer port, the others are virtual printer ports for custom applications
                          50.207.19.114:9101
                          50.207.19.114:9102
                          50.207.19.114:9103

                          This is not normal and looks intrusive. Normally only port 9100 is used by Print Setup in most operating systems and only advanced users direct printers to ports 9101-9103

                          Are there other network connections to the machine?

                          I would set the WiFi Direct NOT to broadcast the SSID (if possible, I cannot check RN), change it, and make a note of it. Set up user to manually enter SSID for connections.
                          Interesting read. Now I have more words to look up. =^..^=
                          If you'd like a serious answer to your request:
                          1) demonstrate that you've read the manual
                          2) demonstrate that you made some attempt to fix it.
                          3) if you're going to ask about jams include the jam code.
                          4) if you're going to ask about an error code include the error code.
                          5) You are the person onsite. Only you can make observations.

                          blackcat: Master Of The Obvious =^..^=

                            Comment

                            • PrintWhisperer
                              Trusted Tech

                              250+ Posts
                              • Feb 2018
                              • 453
                              #8
                              Re: 2554ci Randomly prints documents

                              Originally posted by slimslob
                              The random garbage printed only at the top of many of the pages reminds me of what you would get in days of yore when you....
                              You are exactly right and let me finish that sentence as a rule:

                              "...send any data to the printer that it cannot interpret as print code"

                              Print code always starts with an 'emulation tag'...something that tells the printer what language the file is in.

                              !PS-Adobe, %-12345x, !R! are all tags we see telling the controller what language to interpret and which should appear in proper print files.

                              Without a TAG the controller will treat the data (bits) as ASCII text and print the literal data, not an interpreted image.

                              NOW while printer code has a lot of binary and special code date that renders as gibberish, most computer code is written in ASCII text, so if it's sent to the printer we see the actual code.

                              Here there is clearly and HTTP designation in the output, which could also be part of an XML SOAP transaction, a known exploit. There are also some other vulerabilities via web interface hacking I can't go into but they're ALL fixed in the latest firmware.

                              The methodical way it goes from port 9100 to 9101, 9102 could just be a port scan from some security device as I mentioned. Locking down the IP address to a static user helps avoid all this traffic, if you can.
                              "Being ignorant is not so much a shame, as being unwilling to learn" - Benjamin Franklin

                                Comment

                                • Samanator
                                  Service Manager

                                  Site Contributor
                                  VIP Subscriber
                                  500+ Posts
                                  • Sep 2017
                                  • 571
                                  #9
                                  Re: 2554ci Randomly prints documents

                                  After all y'alls input, I went out to the location and turned off WiFi Direct. One of y'all PMed me with an observation that helped me to realize that WiFi Direct is most likely at the root of this problem.

                                  When I set up a machine, I usually turn of WiFi and with Kyocera machines WiFi Direct. I only use WiFi when the customer absolutely requires it. I have found with Kyocera machines if a client wants air print (and they don't want to download the Kyocera app), the easiest solution for me is to turn on WiFi Direct and the customer is happy. No one has to make sure they are logged into the correct WiFi network. Just print and go. The big cheese at this company wanted to be able to air print from his phone. Hence, I turned on WiFi Direct and everything seemed to be fine....until.

                                  So with WiFi Direct turn off, we will see. If the guy wants to print from his phone, he is going to have to make sure he is on the correct WiFi network.

                                  Thanks again for all the input.

                                    Comment

                                    Previous template Next
                                    Working...