I came across a reference to cable modems speaking SNMP, and though it’d be neat to have something like Cacti query my cable modem periodically to see bandwidth usage.

Comcast, though, blocks SNMP access. I initially thought this was pretty cheap, but it turns out that it’s for good reason: while I’ve always thought of SNMP as a read-only way to see bandwidth usage, it turns out that it’s also able to set data, and that’s how much of the configuration is done. Thus they don’t really ‘block’ SNMP, as much as hide it from customers. From what I’ve read, they set a random ‘community’ string that only they (and those who can read the config files the cable modems pull down at boot), but further limit access to certain IP ranges.

But in the course of scanning for SNMP devices on my network, I did get a hit, from an unlikely source. It seems that our network printer, a consumer-grade inkjet with an Ethernet port, has an onboard webserver and an SNMP server.

Unfortunately, it seems they don’t publish MIBs for the output of the OfficeJets, meaning that, aside from some of the standard levels, we’re left to guess. I’ve put the output of an snmpwalk up on my webserver for anyone curious. Some potentially valuable data:

• mib-2.43.5.1.1.2.1 = INTEGER: 1
• mib-2.43.5.1.1.3.1 = INTEGER: 3
• mib-2.43.10.2.1.4.1.1 = Counter32: 8244
• mib-2.43.10.2.1.4.1.2 = Counter32: 8244
• mib-2.43.10.2.1.5.1.1 = Counter32: 275
• mib-2.43.10.2.1.5.1.2 = Counter32: 275
• mib-2.43.10.2.1.6.1.1 = INTEGER: 1
• mib-2.43.10.2.1.6.1.2 = INTEGER: 3

8244 is the printer’s page count, which seems to be “mib-2.43.10.2.1.4.1.1” and “mib-2.43.10.2.1.4.1.2,” though I’m not sure what the difference is. I don’t know what the 275 represents.

The web interface shows black and color cartidge ink levels; we’re at 1 out of 10 ‘bars’ on black, and 3 out of 10 ‘bars’ on color; thus the “1” and “3” next to each other gives me reason to believe that’s what they may represent.

Actually, these strings may be a further clue:

• mib-2.43.11.1.1.6.1.1 = STRING: “black ink cartridge”
• mib-2.43.11.1.1.6.1.2 = STRING: “tri-color ink cartridge”
• mib-2.43.11.1.1.6.1.4 = STRING: “ink blotter”

Note the 1.6.1.x prefix, with “1” referring to the black cartridge, “2” being the color, and “4” referring to a blotter. That causes this string of .1, .2, and .4 all in a row to stand out:

mib-2.43.11.1.1.2.1.1 = INTEGER: 1
mib-2.43.11.1.1.2.1.2 = INTEGER: 2
mib-2.43.11.1.1.2.1.4 = INTEGER: 2

mib-2.43.11.1.1.3.1.1 = INTEGER: 0
mib-2.43.11.1.1.3.1.2 = INTEGER: 0
mib-2.43.11.1.1.3.1.4 = INTEGER: 0

mib-2.43.11.1.1.4.1.1 = INTEGER: 3
mib-2.43.11.1.1.4.1.2 = INTEGER: 3
mib-2.43.11.1.1.4.1.4 = INTEGER: 4

mib-2.43.11.1.1.5.1.1 = INTEGER: 5
mib-2.43.11.1.1.5.1.2 = INTEGER: 5
mib-2.43.11.1.1.5.1.4 = INTEGER: 1

mib-2.43.11.1.1.6.1.1 = STRING: "black ink cartridge"
mib-2.43.11.1.1.6.1.2 = STRING: "tri-color ink cartridge"
mib-2.43.11.1.1.6.1.4 = STRING: "ink blotter"

mib-2.43.11.1.1.7.1.1 = INTEGER: 15
mib-2.43.11.1.1.7.1.2 = INTEGER: 15
mib-2.43.11.1.1.7.1.4 = INTEGER: 7

mib-2.43.11.1.1.8.1.1 = INTEGER: -2
mib-2.43.11.1.1.8.1.2 = INTEGER: -2
mib-2.43.11.1.1.8.1.4 = INTEGER: -2

mib-2.43.11.1.1.9.1.1 = INTEGER: 0
mib-2.43.11.1.1.9.1.2 = INTEGER: 21
mib-2.43.11.1.1.9.1.4 = INTEGER: 144

Of course,what it means is anyone’s guess right now.

Our ‘firmware’ version is listed in the web GUI as RL9002xNx, which comes up repeatedly:

mib-2.43.15.1.1.4.1.1 = STRING: "RL9002xNx"
mib-2.43.15.1.1.4.1.2 = STRING: "RL9002xNx"
mib-2.43.15.1.1.4.1.3 = STRING: "RL9002xNx"
mib-2.43.15.1.1.4.1.4 = STRING: "RL9002xNx"
mib-2.43.15.1.1.6.1.1 = STRING: "RL9002xNx"
mib-2.43.15.1.1.6.1.2 = STRING: "RL9002xNx"
mib-2.43.15.1.1.6.1.3 = STRING: "RL9002xNx"
mib-2.43.15.1.1.6.1.4 = STRING: "RL9002xNx"

I do hope to do some diff’s over time and see what changes, in the hopes of figuring out what some more of these go to…