Mysterious errored print job

Posted by Gumbyohson@reddit | talesfromtechsupport | View on Reddit | 18 comments

Recent issue at a customer. A Konica Minolta printer keeps receiving an errored job over and over which blocks the queue for other jobs. Printer in question does not provide IP address for source of the job but does state the staff name which is not someone who works from that office. Clearing the spooler on all local devices and rebooting the printer doesn't stop the issue.

Unable to get packet capture from any network devices. On a whim, check the firewall and see port 9100 requests from a remote S2S connected PC. Cleared the spooler on that PC, job keeps coming. Restarted VPN, job keeps coming. Create a firewall rule to block the port and IP and job keeps coming

Can't reboot the firewall at production hours. End up loading into the advanced shell of the firewall (recentish patch level Sophos XG) and killing all current connections using "conntrack -F".

Turns out the S2S is very recent and connected from a crappy TP-Link and the remote PC had a bunch of print jobs sent to the wrong printer cause the queues are deployed to all devices. During the build of the VPN, the job got sent and the Sophos kept replaying the packet over and over for a week. Killing the connections killed the bad packet. Printer now working again.