Slow Network Scan to Folder from M525 and M575

[scanuserg]

Since starting to work with the M525 and M575 MFP a few years ago I have experienced very slow scans to a shared folder in environments with a variety of scan document destinations. The scans take 2 to 4 minutes to process. I see a few other posts about what appears to be the same issue but with no posted solution.

Just recently I found a solution for one environment I'll list below.  The solution helped to identify the cause, but not how to address the issue in all environments.

Setting up a scan option completes successfully, including communication with the destination, but it takes an unusually long time. A scan begins with 'verifying access please wait.' This step lasts anywhere from 1 to 2 minutes. The 'sending' step takes a similar amount of time, or slightly less time in some cases.

1. An M3035 configured in the same environment does not have this problem. Different Xerox printers (example model 6655) with an identical configuration did not have this problem, but the replacement M525 did.

2. A common scan destination in small environments is a USB flash drive on a Mikrotik router, using their SMB support (stated as being 2.002). That location worked great with an M3035 but not with the M525 or M575 that replaced it. A work-around was to use FTP on the same device instead, and that config scans as fast as expected. Scanning to an Ubuntu Samba v2 server with all other network settings the same as the router flash drive setup is also slow (the slowest, actually).

3. Using the IP address instead of the server name does not make a difference. The problem is not a name resolution issue because finding the server by name works fine. Turning off IPv6 doesn't help. Turning off 'verify folder access' does speed up the process because it eliminates that step, but the scan and transfer step still takes 1 to 2 minutes.

4. The printers are all configured by DHCP IPv4 running on the router. In most cases the DHCP server on the router is set to give the router as the DNS server. DNS on the router would then forward requests to a local server if present (Windows Server), or if no local server was present DNS would forward to an Internet DNS server (Cloudflare, Google). Also in some cases static host entries for local servers are maintained in the router DNS settings.

What finally made scanning normal speed in one environment was to set DHCP to give the HP printer an address specifying the Windows server as the DNS server, not the router DNS forwarder. Next, this environment just happens to have printers and servers on different subnets, with firewall rules limiting what access the printers have on the servers. SMB/CIFS on port 445 was always permitted, but what made all the difference was allowing port 88 Kerberos.

Using connection tracking in the router I could finally see the real problem (after I set the DNS to the Windows server, but before allowing port 88): The HP M525/M575 printers try to establish a Kerberos connection, which takes 1 to 3 minutes to time out if there is no response . Only then will it start the scan, and then it's still slow, probably because it's trying the auth step a second time.

What is needed is a way to shorten the Kerberos timeout to something reasonable, or better yet a way to tell the printer the destination server doesn't support Kerberos so don't bother checking for it (request SMB 2.x only, perhaps). If there is a way to do this in the current firmware I haven't found it.

[Repairatrooper]

One of the options when you setup scan to folder is "verify location before scanning". Turn that off, it slows everything down as the machine verifies the scan location before performing a scan, instead of just trusting that the settings are correct.

[scanuserg]

Thank you but I did mention that in the paragraph marked number 3.