Question Network printer uploading and download enormous amounts of data

[dbc636]

Not sure if this is right area, because its network, security, and printer issue...

I recently put a TP-Link Omada system in at my house:
Router: ER7206
Two Switches: TL-SG2210MP & TL-SG2008
Controller: OC200
Access Points: 2x EAP225 and 2X EAP615-Wall

One of the cool things about the Omada controller, is the dashboard which gives tons of information about your LAN, including data usage by each device.

My printer’s data use has caught my eye. The printer is an HP1525NW color laser. Over a 19-day period, it used 95TB of data. Upload and download each. So total almost 190TB. And that’s not a typo, terabytes.

This printer, on a busy month prints maybe 10-20 pages of documents. Rarely any photos, and nothing even close to this amount of data.

I did a factory reset and made sure the firmware is up to date. Incidentally, the newest firmware version from HP is 2014.

It continued to upload and download a large amount of data. In a 24 hour period 17.35GB. I hadn't printed anything other than a test page during that 24 hours.

I created an access control list setting that blocks the printer from the router (so it can't talk to the internet), but still allows it to talk to the LAN, so we can still print.

There’s no shortage of online articles that say printers are a vector for network intrusion. Many specifically mention HP.

I’m wondering if I’ve fallen victim to that? Have a got a little nasty creeping around in my printer, and LAN? Or is there something else going on that I’m not taking into account.

Just wondering if anyone else had similar experiences, and what, if anything was done to mitigate it?

 

[rgd1101]

it is connected to the internet?

 

[bill001g]

How much more information can you get about the traffic. I guess it depends on how the controller is collecting that data. Can you get a list of IP addresses it is talking to. Might give you a clue as to what the printer is up to.

The manufactures put so much crap in equipment now days the connects to the cloud even when you don't need or want it. I mean I guess there are people who just have to print from their phone when they are out of the house but I can't see it a huge demand.

Like most this stuff unless the device actually needs something on the internet to function you want to prevent it from having internet access. Look at all the cases where camera systems or thermostats have been hacked.
The most fool proof way to prevent a device from getting internet access is to either leave the gateway blank so it does not know where the router is or put in a gateway IP that does not exist. You can of course when you have a better router use firewall filters like you do. Note on high speed internet connections using these filters can bottleneck the cpu on the router.

Since you have fancy equipment and if you want to investigate what I would do is load wireshark on your machine. You can then use the switch to give your pc a copy of all the data on the printers port. I forget what they call this feature many times it called mirror but I know most tplink smart switches have the ability to allow you to capture the actual traffic. Wireshark has all kinds of fancy filter tools that will let you pull reports of stuff like IP addresses and port etc. It is all going to depends on if the IP addresses it is talking to give you much of a clue. I mean if it was something like say torrent running you are just going to get lots of random IP and random ports.