Revision history  [back]

If you're sure that the printer communicates over port 9100 and you don't see it in the capture (using promiscuous mode) then it is most likely the traffic did not pass the point in the network were you did the capture.

Take a look at https://wiki.wireshark.org/CaptureSetup/Ethernet

Since nowadays networks uses switches you'll need a tap or a (managed) switch in monitor mode to capture the traffic to/from this device.

And when the printer is using WIFI then take a look at this: https://wiki.wireshark.org/CaptureSetup/WLAN , or use the monitor mode of the Access Point.