Jump to content

Ricoh MFD wireshark trace


Stevie
 Share

Recommended Posts

Having real issues with Ricoh's Sharescan (well it's Nuance's officially but Ricoh use it on their MFDs). Have about 14 MFDs all working fine with PCC (follow me printing) but Sharescan works for about 30-40mins, then randomly they all lose connection to Sharescan which runs on a server. The server appears fine, everything else on the network appears fine. If you then restart ShareScan Manager it pings all the MFDs and they all start to talk to the server again.

I want to take one MFD and do a wireshark trace on it. Not sure where to start though.

Not using wireshark much, how do I take a trace from the MFD to the server, so when they lose connection I can see what is going on?

Link to comment
Share on other sites

Just having a thought, I'm assuming I just run wireshark on the server then filter out the IPs of the MFDs that talk to it. I'll have a look tomorrow.

I think you are on the right track. IP display filters for Wireshark:

"ip.dst == x.x.x.x" (Match destination IP)

"ip.src == x.x.x.x" (Match source IP)

"ip.addr == x.x.x.x" (Match either)

I believe you can also specify networks (e.g. "ip.addr == 10.10.0.0/16").

Incidentally, your problem sounds like it could be something like the NICs going into sleep mode or some such? Might be worth looking for an option along those lines in the MFD settings. I'd probably be asking Ricoh support before spending my time sniffing packets, because this may be something easy to fix they see all the time.

Good luck!

Link to comment
Share on other sites

I think you are on the right track. IP display filters for Wireshark:

"ip.dst == x.x.x.x" (Match destination IP)

"ip.src == x.x.x.x" (Match source IP)

"ip.addr == x.x.x.x" (Match either)

I believe you can also specify networks (e.g. "ip.addr == 10.10.0.0/16").

Incidentally, your problem sounds like it could be something like the NICs going into sleep mode or some such? Might be worth looking for an option along those lines in the MFD settings. I'd probably be asking Ricoh support before spending my time sniffing packets, because this may be something easy to fix they see all the time.

Good luck!

Thanks for info.

Well this is where it gets interesting :) because we have spoken to Ricoh and they don't know why it's happening. Nuance own Equitrac printing and Sharescan, so it's Nuances software on the MFDs. Ricoh keep saying they can't get engineers to us in the time we need them, so I'm trying to learn what I need to do, so instead of wasting time waiting for them, look at stuff myself.

So far I've learnt a lot from the last Ricoh software engineer that comes to install all the software. I now know how to install equitrac and sharescan to a new, fresh MFD that has come in and doesn't have it installed. I can then add it to the print queue, convert it to a equitrac port so the print goes via equitrac. Then add the MFD to sharescan so they can scan.

Your suggestion sounds like something they'd mentioned. Because they noticed all the times were out on the MFDs and weren't set properly (I never did this, the original Ricoh engineers did this when they were originally setup the MFDs) because the hardware engineers just install them and make sure they print, they don't seem to do anything with the management of them via their web consoles.

So I set all the timers as requested on all the MFDs (they were going to send one of the software engineers to do it, but that was pointless, it's a simple change I knew how to do and wasn't going to wait for them to arrive). They've checked and confirmed the settings are OK but still, the MFDs will suddenly all drop connection to the Sharescan server.

It's odd.

Link to comment
Share on other sites

Well Wireshark should show you any TCP resets.

What about looking for patterns? For example, do the devices lose connection after 30/40 minutes regardless of use, or is it only when they haven't been used for that long? If all devices lose connection at the same time, and regardless of when they were last used, it sounds like the server is the key and I would start looking on that.

Obviously, make sure you have the latest hot fixes and software installed.

Link to comment
Share on other sites

Looking through the Wireshark trace and googling TCP reset and how to filter it, I came back with the following and the following is when Sharescan had followen over and I was restarting the Sharescan Manager.

All the MFDs are on the 10.97.7 range, the Sharescan server is the 10.97.3.96 IP

http://ge.tt/658HdMv/v/0?c

Don't know if this is all the MFDs suddenly sending TCP reset packets to the server.

Edited by Stevie
Link to comment
Share on other sites

  • 3 weeks later...

Good stuff - Glad you got it fixed!

I'm speculating, but from your trace it looked to me like the devices and the server were getting out of synch on the connections. For example, reasons the server may respond directly with a RST could be because of a firewall/HIPS (unlikely because it was working before) or because the server thinks it already has a connection open to that device on the same port. It suggests to me that the device thought the connection had closed and was trying to re-establish it, but the server thought the old one was still open so was rejecting the new connection. All guesswork, of course, but certainly Nuance's issue to fix.

Link to comment
Share on other sites

This is what was in the hotfix notes:

Issue Addressed:
When a lot of (more than 70) MFPs are registered to a single manager,
sometimes the manager hangs and the MFPs can’t connect to perform a new workflow.

Solution:
Cost Recovery was modified to include lock timers so it will
abandon dead connections instead of waiting for them infinitely.


This hotfix is intended for users running eCopy ShareScan 5.1, Build 5.1.20419.0

Seems to have fixed our issue but we only have 18 devices, not 70 :)

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...