9100

Port 9100/tcp carries two IANA service-name registrations rather than one: hp-pdl-datastr ("PDL Data Streaming Port," assignee Shivaun Albright, registered 2002-04) and pdl-datastream ("Printer PDL Data Stream," assignee Stuart Cheshire, registered 2002-09), and both names are dual-registered on 9100/udp as well. The IANA Reference column is blank for both rows; the only RFC mention is inside IANA's own free-text assignment note on pdl-datastream, which says the name is primarily registered for DNS SRV records (RFC 2782) and that 9100 is the conventional default port, not a hard requirement. In practice 9100 is the de-facto standard for "raw" or "JetDirect" / "AppSocket" network printing: a client opens a plain TCP connection to the printer, streams a print-ready document (PCL, PostScript, or PDF) with no job-wrapper protocol, and closes the connection — the printer processes the bytes exactly as it would over a parallel or USB cable. Because the channel is bidirectional it also carries Printer Job Language (PJL) status and control commands and returns responses, which is what makes it useful and also exploitable. CUPS on Unix and the Windows "Standard TCP/IP Port" monitor both use raw/9100 by default, and virtually every network-capable laser, inkjet, or multifunction device implements it. The absence of any authentication makes an internet-exposed 9100 a recurring finding on Shodan-style scans: documented risks include arbitrary PJL/PostScript/PCL command injection, reading or writing the printer's file system on some models (enabling job interception or storage abuse), denial-of-service and physical effects, and pivoting from the printer into the internal network. The standard tool cited for this class of testing is PRET (Printer Exploitation Toolkit, RUB-NDS). Guidance is consistent: do not expose 9100 to the open internet — firewall it to trusted internal segments.

IANA assignment

dual registration — hp-pdl-datastr "PDL Data Streaming Port" (assignee Shivaun Albright, registered 2002-04) and pdl-datastream "Printer PDL Data Stream" (assignee Stuart Cheshire, registered 2002-09); reference column blank for both; both names dual-registered 9100/tcp + 9100/udp [Confirmed] — cached IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9100

IANA reference / RFC

Reference column blank (no RFC cited by IANA). RFC 2782 appears only inside IANA's free-text assignment note on pdl-datastream (name primarily for DNS SRV records; 9100 is the conventional default port, not required) [Confirmed] — cached registry, verbatim Assignment Notes field

Registration dates

hp-pdl-datastr 2002-04; pdl-datastream 2002-09; no modification date recorded for either (blank, not fabricated) [Confirmed] — cached registry

Range class

registered (1024–49151)

Related ports

515/tcp (LPD/LPR), 631/tcp (IPP/CUPS)

Primary use

raw / "JetDirect" / "AppSocket" network printing — direct PDL (PCL/PostScript/PDF) byte stream over a plain TCP connection with no job-wrapper protocol; bidirectional, so it also carries PJL status/control commands [Confirmed] — http://hacking-printers.net/wiki/index.php?title=Port_9100_printing ; https://book.hacktricks.xyz/network-services-pentesting/9100-pjl

Common software

CUPS and the Windows "Standard TCP/IP Port" monitor use raw/9100 by default; implemented by essentially all network-capable printers/MFPs. PRET (Printer Exploitation Toolkit, RUB-NDS) is the standard testing tool

Security implications

no authentication on raw 9100 → internet-exposed instances are a recurring Shodan finding; documented risks include PJL/PostScript/PCL command injection, printer file-system read/write on some models (job interception, storage abuse), DoS/physical effects, and internal-network pivoting [Confirmed] — https://book.hacktricks.xyz/network-services-pentesting/9100-pjl ; https://www.securityweek.com/hackers-can-abuse-hp-enterprise-printers-storage/

Exposure figures

secondary reporting cites 21,000+ internet-exposed HP printers on 9100 (publication date unconfirmed) and ~150% growth in exposed 9100 endpoints 2019–2021 (Germany/Russia/France/Netherlands/UK most exposed) — from a SecurityWeek write-up of researcher/vendor scan data, not verified against a primary dataset

Malware associations

no widely-documented malware family uniquely dependent on 9100 as a primary C2 or propagation channel found; risk is opportunistic abuse of exposed printers rather than a named campaign [Unknown]

Typically seen on

network printers and multifunction devices, print servers, and hosts with a raw print queue configured

Analyst note

an internet-facing 9100 is almost always a misconfiguration; restrict to trusted internal segments and firewall it off the open internet.

Port 9100 is registered with IANA under two distinct service names, both listed for TCP and UDP. The first is hp-pdl-datastr ("PDL Data Streaming Port"), registered 2002-04 with assignee Shivaun Albright; the second is pdl-datastream ("Printer PDL Data Stream"), registered 2002-09 with assignee Stuart Cheshire. The pdl-datastream entry carries an IANA assignment note explaining that the name is primarily registered for use in DNS SRV records (RFC 2782), which let a protocol run on any port with 9100 as the default. Both service names are separately registered on 9100/tcp with matching dates, so 9100 is a dual TCP/UDP registration for each name rather than a single shared assignment. The IANA Reference column is blank for both entries and is left blank here — no RFC is cited by the registry. In real-world deployment this port is the well-known "raw," "JetDirect," or "AppSocket" printing service: a client sends printer-ready data (PostScript, PCL) directly to a network printer or print server. Critically, every independent technical and vendor source describes that raw-printing traffic as operating over TCP, because print jobs require reliable, connection-oriented delivery. No source documents a distinct, actively deployed UDP protocol or UDP-specific client on 9100. The UDP registration is best understood as the IANA-reserved counterpart to the TCP service rather than a separately used protocol. Likewise, published security concerns for 9100 (no authentication, no encryption, DoS risk, printer-exploitation tooling such as PRET, and Shodan port:9100 exposure counts) are documented for the TCP service specifically; no UDP-9100-specific exposure statistics or exploitation case studies were found, which is reported honestly as a gap rather than extrapolated from the TCP data.

IANA assignment (name 1)

hp-pdl-datastr — "PDL Data Streaming Port"; registered 2002-04; assignee Shivaun Albright; reference blank; dual-registered 9100/tcp + 9100/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV lines 12075–12076)

IANA assignment (name 2)

pdl-datastream — "Printer PDL Data Stream"; registered 2002-09; assignee Stuart Cheshire; reference blank; note: primarily registered for DNS SRV records (RFC 2782), default port 9100; dual-registered 9100/tcp + 9100/udp [Confirmed] — IANA registry (cached CSV lines 12077–12080)

Range class

registered (1024–49151)

IANA Reference

blank for both entries — no RFC cited by the registry; left blank (no RFC invented) [Confirmed]

Modification date

Unknown — blank in the registry CSV for both entries [Confirmed]

Related ports

515/tcp (LPD), 631/tcp (IPP/CUPS) — the network-printing cluster

Primary use

"raw" / JetDirect / AppSocket network printing — client streams printer-ready data (PostScript, PCL) directly to a printer or print server; documented as TCP in practice

Common software (TCP side)

CUPS raw backend, Windows Standard TCP/IP Port Monitor (raw), HP JetDirect / AppSocket-compatible printers and print servers, most network laser/inkjet MFPs; no UDP-specific software identified

Security implications

raw-printing service has no authentication and no encryption; associated with printer-exploitation tooling (PRET) and mass internet exposure (Shodan port:9100) — all documented for TCP; whether identical risks manifest over UDP is unverified

Typically seen on

network printers, multifunction devices, and print servers (TCP)

UDP-specific use

Unknown / likely negligible — IANA lists 9100/udp under the same names, but no source documents a distinct, actively deployed UDP protocol or client; treat as the reserved counterpart to the TCP service [Likely] — sslinsights.com; PaperCut (absence-of-evidence inference)

Analyst note

an open 9100 almost always indicates a network printer or print server; the actively used protocol is TCP-based. UDP-9100 activity is undocumented and worth investigating rather than assuming standard raw printing.