Sniffing Print Jobs..?

[muck86]

Hello,

I'm currently working on a paper for printer security (for school).

But I have some troubles extracting the print-data from the captured file.

What i've done:

Printer IP: *.169

Client: *.111

Man in the Middle: *.38

I'm wondering why the printjob is printed on the "netbill-trans" Port <-?

How do i get the Printjob extracted? If i click on follow TCP-Stream, it looks kinda weird...

I give you the pcap file which i recorded from the man in the middle pc as an attachmend.///// Whoops, i cant attach this kind of file l, so i uploaded it on rs: PCAP-File

P.S.:There is an good article about this topic on Irongeeks Website, i read it, but it doesnt solve my problem.

thanks,

M