what makes a printer a printer in a network?

Question

I am scanning a network using nmap. I assume that this network has copy machines and printers with IP addresses. Is there a way I can differentiate the regular computers from the printers? nmap can detect the OS, but is it sufficient?

Thank you for any ideas.

Answer 1

Do a range scan and look for open port 515 and 9100. That will tell you which addresses belong to printers.

nmap -p 515,9100 192.168.1.1-200 -oG - | grep open

Then check for ports that are "Open". There is an --open directive, but it's not working for me, for whatever reason.

515 is also used by print servers, so if you have a domain controller (or whatever) acting as a print server, it'll show up here as well. That's where checking 9100 comes in.

Edit:

You can also just do nmap -O 192.168.1.1/24 -oG - | grep printer and trust that nmap will correctly identify the device.