Internet-Security raven logo internet-security.com

TCP 9100

ProtocolTCP
Port9100
LabelsPDL Data Stream used for printing to certain network printers

Synopsis

  • TCP 9100 is the HP JetDirect “RAW” printing port (also called AppSocket or PDL Data Stream) used by many network printers.
  • Windows Print Spooler’s “Standard TCP/IP Port” in Raw mode sends jobs over 9100, and CUPS uses the “AppSocket/HP JetDirect” backend on the same port.
  • Major printer lines using 9100 include HP LaserJet/OfficeJet, Xerox, Canon, Ricoh, Kyocera, and Brother devices.
  • Zebra label printers accept ZPL print jobs on port 9100.
  • Embedded/bridge print servers such as p910nd (often on OpenWrt-based routers) and Axis print servers expose 9100 to forward jobs to USB/parallel printers.
  • Printers commonly accept PJL/PostScript/PCL streams over 9100 for job control and configuration (e.g., HP PJL).
  • This port is frequently abused when exposed publicly; tools like PRET (Printer Exploitation Toolkit) and past campaigns (e.g., “PewDiePie” printer spam) used 9100 to inject print jobs, read files, or reset devices.

Observed activity

Last 30 days Detailed chart

More information