# Why would a printer scan our network, and can printers be used to attack other computers?

A printer that suddenly connects to hundreds of internal addresses within a few minutes is either badly configured or compromised. Some printers and their drivers legitimately look for devices or scan-to-folder targets, but that pattern is regular and limited; mapping whole address ranges is not. Printers run full operating systems, often with old firmware, default passwords, web interfaces and stored address books, so attackers can take one over and use it as a quiet base from which to scan, relay connections or store tools, knowing nobody looks at its logs. Update the firmware, change the default password, disable the services you do not need, and put printers in their own segment that can reach the print server but not every computer. NetSenX flags scanning on every plan, from a SPAN or TAP port, without any software on the printer.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/why-would-a-printer-scan-our-network

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [How do we stop an attacker who is already in our network?](https://netsenx.com/en/faq/how-to-stop-an-attacker-already-in-our-network)
- [How fast do attackers move once they are inside?](https://netsenx.com/en/faq/how-fast-do-attackers-move-once-inside)
- [How do we know if the PC we use for online banking is infected?](https://netsenx.com/en/faq/is-the-pc-we-use-for-online-banking-infected)
- [How would we know if our ERP database was copied out of the company?](https://netsenx.com/en/faq/how-would-we-know-if-our-erp-database-was-copied-out)
- [Can network monitoring tell a backup upload from data theft?](https://netsenx.com/en/faq/can-network-monitoring-tell-a-backup-from-data-theft)