How SNMP restrictions impact PaperCut Hive and Pocket

Overview

For organizations with strict security policies, it is common practice to disable the older network protocols like Simple Network Management Protocol (SNMP) versions 1 and 2 (SNMPv1/v2). This article:

• explains how PaperCut Hive uses SNMP
• explains how restricting SNMP in your environment affects PaperCut Hive
• provides recommendations for maintaining security without losing critical functionality.

What is SNMP?

SNMP is a standard internet protocol used for collecting and organizing information about managed devices on IP networks. In a printing context, administrators commonly use it to monitor printer status, read consumable levels (like toner), and collect meter reads. There are three versions of SNMP.

Security considerations: SNMPv1/v2 versus SNMPv3

From a security standpoint, SNMPv1 and SNMPv2 are less secure because they use a simple “community string,” which acts like a password transmitted in clear text. In secure environments, SNMPv3 is the preferred version because it provides robust security features, including:

• Authentication: Verifies that the message is from a valid source.
• Encryption: Scrambles the content of the message to prevent snooping.

PaperCut Hive currently uses SNMPv1/v2 with public community strings for specific monitoring and discovery functions, as outlined in our system requirements .

The impact of using only SNMPv3 with PaperCut Hive and Pocket

When SNMP is used in an organization, SNMPv1/v2 can be disabled to restrict the system to use only SNMPv3.

Disabling SNMPv1/v2 blocks specific PaperCut Hive and Pocket monitoring and device setup features. However, it doesn’t affect core printing functionality, including Secure Print Release and print tracking.

Important: Disabling SNMPv1/2 prevents the PaperCut Hive embedded application from being embedded on Xerox Multifunction Devices (MFDs). For these devices, the PaperCut Hive or Pocket installation workflow is covered in Critical requirement for Xerox Devices.

Unaffected core functionality

Your organization’s primary printing operations will continue to function securely and reliably:

• Secure Print Release: Users can continue to release their print jobs securely at any device.
• Print Job Tracking and Reporting: PaperCut Hive will accurately track and report all print activity.
• User Authentication: Authentication at the device or via the mobile app remains fully functional.
• Edge Mesh Operation: The distributed Edge Mesh will continue to process print jobs efficiently.

Lost functionality

If you restrict the use of SNMPv1/2 on your network, the following capabilities in PaperCut Hive and Pocket are lost:

• Automatic discovery of printers and their capabilities: This might not function, requiring you to configure manual printer discovery.
• Real-time printer status: For example, Offline, Paper Jam, Error. The device status will show the warning, ‘Unable to get the status of the printer’ on the Printer Details side drawer.
• Toner and ink levels: These will not be available.
• Low toner alerts: Because toner levels are unavailable, the Low Toner Alerts will not be triggered.
• Meter reads: PaperCut Hive will be unable to collect meter readings from devices, and hardware meters won’t display data on the Printer Details side drawer.
• Mobile Release: End-users who use the mobile app to release jobs might see the printer with an amber unreachable status.
• The PaperCut Hive embedded application will not install on Xerox MFDs: For more information, see Critical requirement for Xerox devices.

Recommended workflow in SNMP-restricted environments

For the most secure and efficient operation, we recommend the following workflow for printer discovery and management in PaperCut Hive.

1. Initial printer discovery

For the initial setup, enable SNMPv1/v2 temporarily to allow PaperCut Hive or Pocket to discover all network printers. For more information, see How printers are discovered on the network and locally .

2. Securing printer discovery

Configure PaperCut Hive or Pocket to discover new printers via IP address only.

1. Navigate to Easy Print & Scan > Auto Printer Discovery.
2. Under When should we search?, select On Demand.
3. Under Search in, select Targeted Search.
   
   
4. Click Save Changes.

This ensures that PaperCut Hive will not continuously scan your network using SNMPv1/v2.

3. Adding a new printer

When you add a new printer to your network, follow these steps to add it to PaperCut Hive or Pocket:

1. Navigate to Easy Print & Scan > Auto Printer Discovery.
2. In the Look at these IP addresses field, enter the IP address of the newly added printer.
3. Click Discover Now.

4. Configure printer error alerts

Since automatic notifications for printer errors are not available when SNMPv1/v2 is restricted, disable these alerts.

1. Navigate to Print Security > Printer Errors.
2. Under Level, select Off.
   
3. Click Save Changes.

Critical requirement for Xerox devices

Due to a specific requirement of the device platform, you must enable SNMP on Xerox MFDs to install the PaperCut Hive embedded application:

1. Temporarily enable SNMPv1/v2 on the Xerox device.
2. Install the PaperCut Hive embedded application from the admin console.
3. After the installation is confirmed, disable SNMP on the device. The embedded application will remain functional.

Our commitment to security

PaperCut is dedicated to continuous improvement and addressing our customers’ evolving security needs. Support for more secure protocols like SNMPv3 is a highly requested feature and is under active consideration for our development roadmap. Let us know if you’re interested by raising a ticket through our Support Portal and mention “CCEM-1155”.

For the latest product updates, please monitor the official PaperCut Hive Release Notes .

Have more questions? Let us know! We’re here to help. Feel free to contact your PaperCut Partner or our Support Team .