Unknown print jobs from Remote User

[Joe Arseneau]

They are just print jobs, no need to worry unless you have some bad things happening.

It is someone inside your LAN, that person uses Linux/Unix for their OS and they are either submitting from the command line or submitting from the webui of the printer.

[Spikoav8b]

I'm also seeing a mysterious looking print jobs:

Job Name Owner Status Type Copy Count

/var/opt/nc/dlms//ImageQuality/data/postscript/targets/X_calPage_normal_NW.ps	Remote User	Decomposing	print	1
/var/opt/nc/dlms//ImageQuality/data/postscript/targets/X_calPage_photo_NW.ps	Remote User	Decomposing	print	1
/var/opt/nc/dlms//ImageQuality/data/postscript/targets/X_calPage_enhance_NW.ps	Remote User	Pending	print	1

Should this concern me and how do I stop it from occuring?

[Joe Arseneau]

Those machines are too old to do the traces themselves, you would need to hook up a switch to intercept all traffic to and from the printer and run Wireshark yourself, which is not something I could explain/teach on this forum.

[karthikauro]

Hi Joe,

We are also facing similar issues with 75XX & 57XX families.

Do you have any information which will help on the same ?

Thanks!

Karthik Chandrasekaran

[Daniel.Gwin]

That's perfect! Thanks!

[Joe Arseneau · Accepted solution]

Are you running Qualys? Some older firmware releases would print garbage when being scanned.

It could be a new version of the Mirai botnet (Make sure you did not port forward the printer so users could print from outside the LAN)

But to narrow down where it comes from will require a trace,  luckily, current firmware revisions have that built in. So enable it, wait for one of those jobs, note the time, download the trace and view the job at that time to find it's source.

CWIS > Properties > Security > Logs > Network troubleshooting

Current firmwares can be found in these two links

WC783X

WC7845/7855

[Daniel.Gwin]

I have seemingly random print jobs from a "Remote User" showing up on our Workcentre 7845. It just prints otherwise blank pages of the following:

@EJL 1284.4 
EJL 
EJL 
EJL 

I basically have the same issue from this thread.

The additional problem I have is that we have 80 or so users that print directly to this printer using raw. Oddly, I still see usernames attached to these raw print jobs. You can see this in the attached screenshots (dgwin is me and the port configuration is mine). Is there any way of tracking down the culprit device, or maybe another way of disabling "Remote User's" ability to print? As you can imagine, I'd rather not have to reconfigure the printer port for every user here if I can avoid it.