Adding Network Printer causes massive TCPIP Activity

[jcgoode]

I have Windows 2K Pro with automatic updates (everything up to date). When I add a network printer (any printer on my Windows 2003 server) I immediately see a significant increase in TCPIP activity on my network interface. Ethereal packet trace shows repetitive groups of packets to and from the 2003 server and my pc involving the printer I just added. Printing works fine to the printer, but the TCPIP traffic never stops until I delete the printer. I see packets with "OpenPrinterEx", ClosePrinter, etc.

I have not witnessed this activity until recently and got a copy of Ethereal to see what was going on. I have Symantec antivirus (Liveupdate daily / scan weekly) and Spybot. Total system scans with both products find nothing.

I think it might be related to some recent Windows update, but I am unsure of exactly when this started.

Exhaustive google and microsoft searches find nothing similar, but I may not know what to search for.

Any help would be appreciated.

 

[bcastner]

This is likely due to false matrics.

Windows 32x does not in fact have a utility to count network traffic; it has a set of specs that the hardware/driver folks are asked to adhere to.

Which of course rarely works in fact. I have SONY workstations that report trillions of packets per second.

Sigh.

Microsoft describes the problem in this KB article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;296669&Product=winxp

____________________________
Users Helping Users

 

[jcgoode]

These packets are real and actually being sent over the network to the 2003 server. The Ethereal utility shows the activity on both ends and in a controlled environment I can see the activity lights when no other computers are connected to the network. The activity ceases when I delete the network printer from my pc. I do not see this traffic on any other pc in the network which has the network printer defined, just mine. The other pc's are Windows XP, ME, and 98.

 

[bcastner]

And what TCP/IP address is assigned the printer?
Is this being done by the Win2003 server DHCP service, or is it a manual assignment?

I would make a manual IP address for the printer. And under the Win2003 server I would reserve that IP address assigment so that it is not re-issued for another Host device.



____________________________
Users Helping Users

 

[bcastner]

Darn, I hit enter before intending to end the note above.

Having made all the DHCP reservations, now complete the same for the Win2003 DNS server. A lot of this traffic you see is an attempt by the server to get a satisfactory answer to its request to auto-register the printer DNS address.



____________________________
Users Helping Users

 

[jcgoode]

Actually, there are two printers. One is a Lanier attached to a parallel port on the server and the other is an HP with a JetDirect card.

I get the same symptoms on either printer.

Again, no other pc on the network has this problem.

 

[jcgoode]

I have resolved this problem. The culprit was my HP printer monitor software (the software which allows the "function buttons" (scan, fax, etc.) on my multifunction printer to work. Even though the network printers for which the packets being generated had absolutely nothing to do with the HP printer, exiting the printer monitor software (closing it) and removing it from my startup caused the TCP/IP traffic to go away. I do not know why this only happened when connecting to printers on the Windows 2003 server and not on the printers of the old NT server, but that is what fixed the problem. I am going to contact HP regarding this, but subsequent searches lead me to believe any proprietary print monitoring software is cabable of causing strange printer problems.