HP LaserJet Pro MFP M127fn - DNS issue, hundreds of UDP connections affects my router 100% CPU usage

[EugenX]

Hi all,

We've bought about ten pieces (HP LaserJet Pro MFP M127fn), tested only one the other 9 are waiting for their time to be sent in our branch offices. The MFP works fine, no complains till later that day I noticed that our Mikrotik Router was struguling with high CPU usage, it took me some time to find the issue and it was the new bought MFP. Don't know why but it creates hundreds of UDP connections and almost 100% CPU usage goes to DNS service. As soon as I shutdown the MFP and delete all the connections everything goes back to normal. I've disabled almost all services (HP web service, Ipv6, SNMP, AirPrint, SLP, LPD, WS-Discovery, Bonjour), leaving only Ipv4 but without luck the issue persists. Here are some print screens confirming my saying:

http://i.imgur.com/UiOPSiu.jpg

http://i.imgur.com/dlgObPb.jpg

http://i.imgur.com/4RmQhot.jpg

http://i.imgur.com/oBuo9UO.jpg

http://i.imgur.com/Zf77V6b.jpg

Don't know if it is the same case but it look like, found this post that ha no answer to the issue: http://h30434.www3.hp.com/t5/Printer-Networking-and-Wireless/New-HP-LaserJet-Pro-MFP-M127fw-network-...

Why does this happen? And how to solve my issue? Thank you in advance.

[Gemini02]

Hi @EugenX ,

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post serial numbers and case details.

If you are unfamiliar with how the Forum's private message capability works, this Post has instructions.

Thank You.

[subnero2001]

Has anybody got a solution to this? I am having exactly the same problem same printer and a Mikrotik Router.

[Gemini02]

Hi @subnero2001,

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post serial numbers and case details.

If you are unfamiliar with how the Forum's private message capability works, this Post has instructions.

Thank You.

[mbronnimann]

Was there any resolution to this? We have a printer doing the same thing. Our recommendation right now is to not purchase printers like this until the issue is resolved. 

[EugenX]

No solution from HP. I just made a rule on my router to drop UDP packets from HP printer IP. But this is not  long term solution, HP has to do something about this.

[agoulding]

Has this issue been resolved by HP?

Our campus DNS servers are getting flooded with queries from a small number of these printers. They are trying to resolve "localhost" at at rate of about 1000 queries/second. That sounds suspiciously like the UDP packet flood described above.

We will block ports at the server and network layer as a workaround. However, we would prefer a solution implemented closer to the source of the problem.

[PaulHaldane]

I noticed this problem at work this week because I'm one of the sysadmin team that looks after the University's DNS servers.

Symptoms were that a single networked device (MFP176n) was making over 1000 requests a second.

Checking the behaviour of the DNS servers I realised that instead of returning 127.0.0.1 for localhost's IP address as they should, they were returning NXDOMAIN (ie no such domain).

Once I'd fixed that on our DNS servers the MFP stopped making the requests (presumably once it had made a single successful query).

Summary:

1. There are probably many DNS server installations out there which don't return 127.0.0.1 when asked for localhost's IP address. You can check if the server you're using does by running

nslookup localhost

Should come back with 127.0.0.1. If you get NXDOMAIN then you'll probably see this problem.

2. Most network devices "know" that localhost's IP address is 127.0.0.1 (often through standard entry in local hosts file). Even if this series of MFPs doesn't know this, it's antisocial for them to repeat the request quite so often.

[Bacul6]

We've also been experiencing this issue with MFP M127s at the university where I work.  In our case, our DNS servers successfully resolve localhost to 127.0.0.1 with no problems.  However, the constant outflow of UDP connection requests chokes the printer's network's firewall, causing serious disruption on the local user net.  What we're interested in is how can we get the printer to behave more politely, and stop with the thousands of connections at a time.  

[PaulHaldane]

I know that fixing DNS lookups of "localhost." made this problem go away for us.

NB the device is looking for "localhost." (note the trailing "." indicating this is a fully-qualified domain name).

You may find that lookups of "localhost" will work but "localhost." don't.

I agree that HP's implementation is anti-social - after all if the DNS server returns NXDOMAIN there's really no point in asking again. The DNS server isn't going to give a different answer just because you ask 1000s of times :->.