[Snort-users] HP Printing

Erek Adams erek at ...577...
Wed May 8 15:03:03 EDT 2002

On Wed, 8 May 2002, Dan Fiorito wrote:

> Has anyone ever attempted to capture data from a client to a print
> server? I need to search for some key words if possible.
> Is there anyway to convert PCL gobble gook!

Find out the ports in use.  One should be random, one should be static.  Then
see what 'session: printable'[0] might give you.

I'd guess it's going to use a lpd system, so check port 515/tcp.

Good luck!

Erek Adams

[0]	http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.18

More information about the Snort-users mailing list