ASA IPS and HP Jetdirect

Unanswered Question
Mar 30th, 2010


This week I started getting alerts from my IPS regarding the activity of some of my HP printers.  IPS is logging "1104-0 IP Localhost Source Spoof" .  I have sniffed what a few of the printers were doing and the only activity being sent to out the Internet towards the IPS is the printer trying to communicate with 

Has anybody else experienced this type of behavior?

Thank you,


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Farrukh Haroon Thu, 04/22/2010 - 07:03

Why don't you configure the printer correctly so that it does not use the loopback address for communication?

Or use 'even action filters' on the IPS to bypass these signatures for the concerned IP. Or disable the signature all together.




This Discussion