Mcafee Host Intrusion Protection blocks all-in-one network printer

Question

I just bought a new HP Officejet 6500 printer. It has a built-in ethernet port, so I happily connected it to my network. While I was playing around with it, I saw that it stopped responding periodically. Looking around, I saw that the firewall is blocking the printer because of a UDP Port Scan:

So my questions are:

• Is it normal for a network printer/scanner to do a UDP Port Scan?
• If it is, how can I tell Mcafee that it's OK?
  • Could it be that it's legitimate, but Mcafee is simply being overly cautious?
• If it isn't, how can I fix it?

Edit:

Is there any way to see which UDP ports are being accessed and maybe triggering this?

Answer 1

We have run into the same problem. The fix according to https://kc.mcafee.com/corporate/index?page=content&id=KB66283 is to add the IP of the printer to your Trusted Networks list. I think that is a bit of an over-reaction, but it appears that they don't have a better solution.

Answer 2

Looking at the Printer's manual the printer uses UDP port 5353. Allowing this port will help to fix your failure to print. In my experience most Anti-Virus software are being overly cautious for good reasons (they don't want to get sued). If you are behind a router, and have a firewall installed, more than likely hackers are not trying to get to you, especially from the UDP port.

UDP Scanning

Port scanning usually means scanning for TCP ports, which are connection-oriented and therefore give good feedback to the attacker. UDP responds in a different manner. In order to find UDP ports, the attacker generally sends empty UDP datagrams. If the port is listening, the service should send back an error message or ignore the incoming datagram. If the port is closed, then most operating systems send back an “ICMP Port Unreachable” message. Thus, you can find out if a port is NOT open, and by exclusion determine which ports are open. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).

Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernal may limit destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded.

reference