Laserjet M477dn reboots when attached to network

[K3OSP]

I have two printers doing the same problem, when attached to the network the printers reboot.  We have tried updating the printer driver ONLY no additional software from HP. printer reboots.  We took it off our network it doesn't reboot we can print test pages all day long, put it back on the network it will reboot and not able to print a test page.

We removed the unit from the network and hooked it up to a private hub with no internet connection, have a good link we programed an IP Address, no issues we hooked up a laptop disconnected it from the network and plugged it in to the hub printer still doesn't have a problem I installed the driver for the printer and was able to do a test print printer works just fine.  I just printed out a 1200 page file printer works perfectly as excepted as soon as we plug it back into the network it reboots. 

What is causing this? HP Wolf Security? what information are they receiving and sending to the printer to cause this? why?  We turn this off as our network is secured we don't need this, we don't want this feature from HP nor do we want the HP+ and it's getting harder and harder to find printers that don't offer it.  Is there a way to turn this off and get the printer working the way it should?

Thank you,

John Joseph K3OSP

CEH Certified, Network +, Security +

[Repairatrooper]

Honestly, in my experience this sounds more like someone has linked to the printer over the network with a wrong driver or a corrupt print job. Have also witnessed this behavior in cases of duplicate IP address assignments. Have you been able to use wireshark to determine if there is data coming from a particular IP address just before the power off happens?

[K3OSP]

Thanks for the information, however I have more than just one printer doing this.  This is the only one I am working on at this time I have a HP Laserjet 401DN along with some other models they keep popping up.  The computers are getting the drivers from a Print Server we just installed the latest driver a couple of days ago hoping that would solve the problem, it didn't.  if I put the printer back on the network and block the IP Address from going out to the internet so it's only local to our network, it works perfectly, as soon as we remove the block it starts to reboot.  on the private network I setup to test with I have wireshark running and seeing a lot of broadcast messages I am going to be turning off a bunch of services and see what happens.  I am awaiting permission from our IT Director before I put wireshark, I have to follow company policy even more so as of my background in security and he's paranoid.

[K3OSP]

After doing a lot more troubleshooting on the M477DN and the 401DNE printer that we are having a problem with I think I have found the problem but it makes no since and so far they are both working now just fine.  I logged into the web interface of the printers and turned off WS-Discovery, as soon as I did this the 401DNE is no longer giving me a 59.9 Service error and they both stopped rebooting...  I have printed out over 1200 envelopes on the 477DN printer and over 100 pages on the 401DNE not one reboot.

So now my question is what is the WS-Discovery doing? can anyone provide me with an answer?

Thanks,

John

[NC77]

I do not know what is causing the WSD problems.  I usually install my HP printers manually with the IP address.  If printer has a WSD labeled port, strange events seem to occur.  

[K3OSP · Accepted solution]

The printers are set with static IP's I know what the WS-Discover does but not sure what's it's doing in this case.  What had not been a problem in the past is becoming more and more of a problem, the number is growing as to the printers as soon as I turn off WS-Discovery they stop rebooting.  I have sniffed the network I'm not seeing anything unusual, no DoS or any other type of attacks when this is happening.  That was something we were thinking that we have an insider or someone gained access to our network without us knowing it,

I'm not seeing any strange traffic leaving the printers either I spent hours going through logs.  We are starting to thin HP is checking the printers seeing the firmware is out of date or something else and is causing this?  These new programs they have with Wolf Security and HP Plus who knows what they are gathering and doing.

[Repairatrooper]

As a matter of course we disable WSD because it just causes too many problems. Even if you have a printer configured and working, Windows loves to dump your working printer and replace it with an IPP driver on a WSD port.