> I have a very simple question. If i captured a full
> print job in ethereal can i use it to recreate and
> or view what was being printed? This is really important
> to me because i am trying to do some important research for
> compliance at my job.
Hi Moses,
Yes - it is possible to recreate / view a print job from
a capture file, under some circumstances.
It is particularly easy if you are printing to a
PostScript printer - you can turn the PS print job
into an Adobe PDF file with a little bit of fiddling.
GhostScript can do this for you, along with Acrobat
Distiller.
There is a tool called "ChaosReader" that you may
find useful :
http://www.brendangregg.com/chaosreader.html
It works on libpcap files, and allows you to extract
sessions very simply. With a bit of assistance, it
is able to reconstruct print jobs for you.
See this post to the "Full Disclosure" security
mailing list for more clues on how to achieve this :
http://seclists.org/lists/fulldisclosure/2004/Jun/0039.html
The same techniques are still more-or-less applicable
if you are printing via SMB to a Windows or Samba hosted
print queue.
PCL and/or HPGL print jobs, though - I'm afraid I have
no idea where you would start! I am pretty sure they
could be reconstructed without too much hassle though.
Have a google for "PCL viewer", I'm sure you could turn
something up.
Best Regards,
Simon Hailstone
Orthogon Systems
