Why would a printer scan our network, and can printers be used to attack other computers?

A printer that suddenly connects to hundreds of internal addresses within a few minutes is either badly configured or compromised. Some printers and their drivers legitimately look for devices or scan-to-folder targets, but that pattern is regular and limited; mapping whole address ranges is not. Printers run full operating systems, often with old firmware, default passwords, web interfaces and stored address books, so attackers can take one over and use it as a quiet base from which to scan, relay connections or store tools, knowing nobody looks at its logs. Update the firmware, change the default password, disable the services you do not need, and put printers in their own segment that can reach the print server but not every computer. NetSenX flags scanning on every plan, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port, without any software on the printer.

← All 69 questions on Attack techniques explainedAll topics