Get originating IP for a tcp/ip print job

[MicahS-Xerox]

great, let me know how this goes for you. We have great success with this. 

[JordanAXAUQE-AA]

That is a very good way to find out who is doing what. I'm still working on getting it fully working with Windows 7.

[MicahS-Xerox]

Most people will tell you that its not possible, however its actually quite simple. You will need a network Hub and a laptop. You install software called Wireshark on the laptop and run the software. Leave it running until a job comes out from that account. 

You'll be able to look through the logs and see the Source and Destination IP's.

I hope this helps 

[codemonkey · Accepted solution]

After talking with my local rep and his call to Xerox level 2 support, there is no way to get the IP address of the PC that submitted the print job.  Disappointing.

[codemonkey]

Thanks for the reply Fabio.  I figured that is what is happening.  That's why I would like to get the IP address of the sender.  I can use that to determine whether Dan is unwittingly sending the print jobs or if someone has hacked Dan's password and is trying to mess with me.  I had Dan change his password yesterday.

Do you know if the originating IP is stored with the job?  If so, how do I retrieve that information?

[Fabio]

normally the job owner is stored in the spool file, so thats why the machine knows its from user x so dan is maybe sending those jobs by mistake or some1 else is logging in with dan users credentials on another pc :)

[codemonkey]

This concerns a WC5765 printer, but I don't think the model matters in this case.  Every few weeks, several secure print jobs appear in the job queue as belonging to Dan.  Dan is not in the same department as the printer, so he does not need to print there.  Dan says he is not sending the jobs to the printer.  I checked the event log on the print server, and there is no record of those jobs going to any printer.  I think that whoever is sending these jobs has set up a local tcp\ip port for printing to this printer.

Is there a way to find out the originating IP address of a print job in the job queue?