Network scanners, printers broadcasting

Home Forums Security General Security Network scanners, printers broadcasting

This topic contains 5 replies, has 3 voices, and was last updated by  Jae 2 weeks, 1 day ago.

Viewing 6 posts - 1 through 6 (of 6 total)
  • Author
    Posts

  • Jae
    Participant
    #609069

    I hope I have this in the correct forum.
    I had an issue brought to me and I have a couple of questions.  Is there a tool/software that can be used to scan a network and show these ad hoc network connections?
    Or what is a good tool to use for someone not up-to-date with networking issues?  I was told there were a “bunch of printers broadcasting on ad hoc networks” in the environment, I want to look at the wireless network to verify this for myself.  I did a google search on printers broadcasting and something I read about an HP printer pointed me in the direction of checking to see if the wifi direct setting is turned on.
    I have not been to the site yet.  I will be checking in the next day or two when I have access to the printers the status of this setting. At that time I’d like to do a before and after look of what’s being shown on the network, and if changing the setting is the solution.  The next question is, if they’re still broadcasting next step/s to resolve the situation?

    Thank you


    wullieb1
    Moderator
    #609393

    For network scanning i use Advanced IP Scanner. Free and lightweight and will scan the network for you.

    Wireshark should be able to get broadcasts for you but that might be a bit of overkill.

    How does the customer know that these printers are broadcasting on Ad-Hoc networks? Do the printers have Wi-Fi built in?

    What kind of printers are they?


    Jae
    Participant
    #609394

    Hi Wullieb1,

    Thanks for the response.  I went to their office yesterday evening and ran Advance IP Scanner (after doing google research on scanners).  When I connected to their network I could see 2 ricoh’s (MPC4500 and MP5055) and 2 HP (LJ1102w and 4500) after having disabled settings mentioned above.  Yes the HP’s have built in, I contacted the company that installed the ricoh’s and they gave me the instructions for turning off the wifi direct which also turns off wifi.  I am not able to see the devices when connected to their guest network.

    So is this scan (AIS) showing that these devices are still broadcasting?  I was able to access the webpage of the ricoh and see the basic settings, unable to make changes because it’s password protected.

    I also ran Wireshark and have to figure out how to read the data captured.

    Any additional thoughts?

    Thanks

    • This reply was modified 2 weeks, 3 days ago by  Jae.

    wullieb1
    Moderator
    #609397

    AIS will only tell you the device is on the network not whether its broadcasting or not.

    Are the switches that are used in the office managed at all?

    You could sniff the traffic on the netowrk and look for broadcast packets, should be signified by a FF:FF:FF:FF:FF:FF in wireshark. Be aware that all devices may need to broadcast depending on the circumstances.

    Are the networks experiencing a broadcast storm or just broadcasts on the network?

    https://community.cisco.com/t5/switching/how-to-identify-broadcast-traffic-source/td-p/1890640

    Blood
    Blood
    Moderator
    #609408

    “Ad Hoc networks” may imply different subnets. Did you also scan for devices across a broad range of addresses, not just the known range of the network?


    Jae
    Participant
    #609432

    Wullieb1 – Took a look at the link you provided.  I believe they’re managed switches and I’ll have to check with the company who’s responsible for them.  I’m not sure if there’s a storm or what.  I’m going by the info. presented to me that I want to verify for myself.  Will re-run wireshark and see what that shows.

    Blood- I scanned known ranges.

     

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.