How do I monitor network traffic for IPP (LPD/LPR)?

Question

I'm writing an application that sends print jobs over IPP to an LPR print server. I need a way to monitor the traffic going between that server and my development box. Right now I'm just sending jobs from the command line with the lpr command.

I've tried setting up Wireshark, but I can't find anything at all going to the IP address of the print server. Besides that, the Wireshark output is a little overwhelming, as I'm not sure what protocols I need to be paying attention to for IPP traffic.

What protocols do I need to be watching? Are there caveats of which I should be aware?

Yes, I'm using CUPS, both through various GUI elements in Mac OS X, as well as through the `lpr` command (where the network printer is the default). — Steve Nay, Jun 29 '10 at 22:52
`lpr` is a (client) command to send jobs off to a server. There is no such thing as an *LPR print server*. There are LPD print servers however... If you send via IPP, that would make the target an *IPP print server*. The CUPS commandline named `lpr` does speak IPP when you send off a job. On Windows there is an equally-named `lpr` client command (for the cmd window), but it does speak the "LPD" protocol, not IPP. — Kurt Pfeifle, Jul 05 '10 at 20:45

score 2 · Accepted Answer · answered Jun 29 '10 at 22:45

2

IPP is HTTP over port 631.

answered Jun 29 '10 at 22:45

Ignacio Vazquez-Abrams

111,361
10
201
247

Thanks! Just for historical purposes I'll include this link: http://wiki.wireshark.org/IPP. You can also filter with `ipp` without having to specify the port at all. – Steve Nay Jun 29 '10 at 22:54
That's because `ipp` *is* the port, as given by `/etc/services`. – Ignacio Vazquez-Abrams Jun 29 '10 at 22:59
It's only the **transport** part of IPP that is taken from HTTP. The rest isn't. IPP is a protocol of its own. – Kurt Pfeifle Jul 05 '10 at 20:47

Kurt Pfeifle · Answer 2 · 2010-07-07T13:04:09.003

IPP as a standard uses port 631.

If your print server is CUPS, watch out for TCP as well as UDP. Also, in your cupsd.conf you could have an admin switched to a different port for IPP.

Windows also can pose as an IPP print server. But Microsoft supports IPP/1.0 only (which never became a Standard on the IETF, 1.0 always remained a Draft -- the first official standard was IPP/1.1). And Microsoft uses port 80, not 631.

How do I monitor network traffic for IPP (LPD/LPR)?

2 Answers2