314 IPP and 44897 Raw Print Results: The Office Device Layer on the Open Internet
Printers are the least interesting device category in most security programmes and one of the most consistently reachable. A ZoomEye query set collected on 22 September 2026 returned:
| Query | Total results |
|---|---|
port:9100 (raw print / JetDirect) |
44,897 |
port:631 (IPP) |
314 |
port:161 (SNMP) |
299 |
The raw print port has more than a hundred times the count of the IPP port. That ratio is the most useful observation in the dataset, because it describes how printers are configured rather than how many printers exist.
Why the raw print port dominates
Port 9100 is the raw printing port, historically associated with HP JetDirect and now implemented by most network printers and print servers. It accepts a print job as a raw byte stream and passes it to the print engine. There is no authentication, no encryption and no protocol negotiation.
The port is enabled by default on a very large number of devices because it is the simplest way to make printing work. It is also the port that most print management software uses, which means disabling it frequently requires changing the print queue configuration on every client.
That combination, default-enabled and disruptive to disable, explains the count. The raw print port is not exposed because someone chose to expose it; it is exposed because it is on by default and nobody turned it off.
Why IPP is much smaller
IPP on port 631 is the Internet Printing Protocol. It is an HTTP-based protocol with support for authentication and TLS. It is the modern standard and the default on many operating systems.
The count is much smaller for two reasons. First, IPP is frequently bound to localhost or to the local network only, because it is used by the operating system's print subsystem rather than by the network. Second, IPP over TLS is often on a different port, and an IPP service that requires authentication may not respond to an unauthenticated probe in a way that allows identification.
SNMP and the device management layer
SNMP on port 161 is included because it is the management protocol for the same device population. A printer that answers on 161 with the default community string public exposes its configuration, including model, firmware version, serial number and often the printer's own address book.
The count of 299 is small relative to the raw print port, which suggests that SNMP is more often filtered than the print port. That is consistent with network policy: SNMP is a management protocol and is more likely to be restricted, while printing is a user-facing function and is more likely to be permitted.
What an exposed printer actually exposes
A printer is not only a printer. Modern office devices are general-purpose computers with a print engine attached. Depending on the model, an exposed device may expose:
- Stored documents. Many devices spool jobs to internal storage, and some retain a copy of every job printed.
- An address book. Contact lists, sometimes synchronised from a directory service.
- Credentials. Devices configured to scan to email or to a file share store the credentials for those services.
- Firmware update capability. An unauthenticated firmware update path is a persistence mechanism.
- A web administration interface. Frequently with a default password.
The raw print port is the entry point that requires no credentials at all, which is why the count matters more than the protocol's apparent simplicity.
What to check in your own estate
- Query your own netblocks for 9100, 631 and 161. Any result is a finding.
- Check the device's stored data. Spooled jobs, address books and scan-to credentials.
- Check the administrative interface. Default passwords on the web console are the most common finding.
- Check the firmware version. Printers are long-lived and rarely patched.
- Check whether the exposure is required. Remote printing across a network boundary is usually a convenience that can be replaced with a print server inside the perimeter.
Limitations
These figures are a snapshot collected on 22 September 2026. The raw print port count is likely a reasonable estimate of directly reachable devices; the IPP and SNMP counts are more sensitive to how each implementation responds to a probe and to how the service is bound.
A device that answers on 9100 is a reachable print service. It is not confirmed to store documents or to have a default administrative password. Those require device-specific verification.
References
- ZoomEye, cyberspace search engine. Query set:
port:9100,port:631,port:161; collected 22 September 2026. - IANA, Service Name and Transport Protocol Port Number Registry.
- IETF, RFC 8010: Internet Printing Protocol/1.1: Encoding and Transport.
- IETF, RFC 1157: A Simple Network Management Protocol (SNMP).
- NSA, Managing Network Devices: Printers and Multifunction Devices.
Top comments (0)