Windows Printer Discovery

I was surprised to find that Windows had automatically detected my printer, even though the printer doesn't talk SMB/NMB and Windows doesn't talk DNS-SD. It turns out that a printer communication protocol called WS-print has been available since Windows Vista.


WS-Discovery uses SOAP-over-UDP to discover devices on the network. Thanks to Wireshark, we can see the service transmites a UDP packet to (or ff02::c for IPv6), port 3702:

Wireshark also shows the client broadcasts a Resolve message for the UUID (to the multicast address), and the client responds with a ResolveMatch packet (to the client's address) containing much the same information as the original broadcast. There is actually a slight difference: the transport address in this response doesn't include the /lxkWSdevice path. Probably just a quirk of the printer's code?

Clients can also initiate a search for a device. python-ws-discovery reveals that the client transmits a Probe message, and the service responds with a ProbeMatches message containing the EndpointReference as above (but again without /lxkWSdevice).


Back to Wireshark, the client does a HTTP POST to the transport address:

to which the printer responds:

Of interest are the references to Lexmark. It seems they manufactured this printer for Dell! This also explains the origin of /lxkWSdevice in the transport address.

Further communication takes place using a new URL, given for the uri:prn endpoint in this message. (Weirdly, Windows uses IPv4 from this point onwards, but I'll assume that communication over IPv6 would produce similar results. Here's an example:

If you squint, you can just about make out the IEE 1284 Device ID string in the DeviceId element (line 16).

I think that's enough XML for today.

In theory a CUPS backend could be written to communicate with printers using WS-Print. In practice there's no point since the printers probably all speak DNS-SD anyway.

CategoryTechnote WindowsPrinterDiscovery (last edited 2017-03-14 15:17:21 by sam)

© Sam Morris <>.
Content may be distributed and modified providing this notice is preserved.