Receive notifications of new posts by email. ChallengeĬan you manage to extract the printed pages out of this trace? D ) Filter for the iPhone’s MAC address in the trace to find all appropriate packets: “eth.addr = d4:a3:3d:97:60:6d”: Printing via AirPrint: Overview.įiltering for “ipp” shows only some HTTP-like lines, while there are much more packets involved in the “tcp.port eq 631” flows: Printing via AirPrint: IPP. Hard to troubleshoot, but working without any configuration. My printing of a single page took about 10 TCP/UDP streams and roughly 1200 packets. In my case, the iPhone found the printer via some MDNS discoveries that are shown in the trace as well. AirPrintĪpple’s AirPrint uses the Internet Printing Protocol IPP on TCP port 631 (I have never heard of it). In the list of options for the SSL protocol, you’ll see an entry for (Pre)-Master-Secret log filename. Expand Protocols, scroll down, then click SSL. The Preferences dialog will open, and on the left, you’ll see a list of items. It seems like the mere print data is encoded in the same way as the Raw variant: Printing via LPD/LPR TCP port 515. Open Wireshark and click Edit, then Preferences. Wireshark’s display filter is “lpd” while you can find the whole stream with “tcp.port eq 515” or the like. The Line Printer Daemon protocol/Line Printer Remote protocol (or LPD, LPR) uses TCP port 515. You’ll find it via “tcp.port eq 9100”: Printing via Raw TCP 9100. Wireshark has no protocol dissector for this raw printing (little discussion here). It is also called HP Jetdirect, or the like.

Wireshark android equ