Port 515 – LPD

TCP

Port 515 is the LPD (Line Printer Daemon) port for Unix print spooling. LPD accepts print jobs from remote clients using the LPR protocol. LPD is unencrypted and has minimal authentication – exposed instances allow unauthorized printing and potential file disclosure. IPP on port 631 is the modern replacement.

Port Number

515

Protocol

TCP

Service

Line Printer Daemon

Range

IANA Well-Known (0–1023)

Description

Line Printer Daemon on port 515 implements the LPR/LPD protocol for submitting print jobs to remote printers and print servers. The protocol dates to BSD Unix and provides queue management, job submission, and status queries. LPD on port 515 has known vulnerabilities including buffer overflows and format string bugs in legacy implementations. The protocol provides only hostname-based access control – any host in the allowed list can print. Modern environments should use IPP (Internet Printing Protocol) on port 631 with CUPS, which provides authentication, encryption, and richer job management.

Security risks

1CVE-2001-0670: LPRng (popular Unix print daemon) format string vulnerability – remote code execution via crafted print job headers (one of the earliest remote exploits)
2No authentication: LPD accepts print jobs from any host listed in /etc/hosts.lpd or hosts.equiv – IP-based trust only, trivially spoofable
3Print job content inspection: LPD transmits documents in cleartext – print jobs containing sensitive data (HR documents, financial reports) visible on the network
4Queue manipulation: with access to port 515, attacker can remove print jobs (lprm), reorder the queue, and determine what others are printing (information disclosure)
5Bounce attack: LPD's relay capability allows using the print server as a proxy to scan internal networks or access services on the print server's localhost

Firewall guidance

Disable LPD entirely and use IPP (port 631) or IPP over TLS (IPPS). If legacy LPD clients exist: restrict port 515 to specific print client subnets. On CUPS: disable the LPD backend (cupsd.conf: do not load the cups-lpd helper). Block port 515 from the internet unconditionally.

Diagnosis commands

List available printers and their accepting state

shell

lpstat -a

Check for LPD vulnerabilities (format string, access control)

shell

nmap -p 515 --script lpd-vuln target

BSD/LPRng: show queue status for all printers

shell

lpc status all

Check if LPD is running (should not be on modern systems)

shell

ss -tlnp | grep 515

Usage examples

Port 515 – LPD

shell

lpr -P printer file.ps
lpq -P printer
lprm -P printer jobid

Common services on this port

LPRngBSD lpdCUPS (legacy LPD support)Windows Print Spooler (LPR port monitor)

Related ports

631

IPP/CUPS (modern replacement)

9100

JetDirect (raw TCP printing)

515

LPD/LPR (this port)

History

LPD (Line Printer Daemon) protocol was defined in RFC 1179 (1990), standardizing the BSD print spooler from the early 1980s. Port 515 was assigned for the daemon. LPR (Line Printer Remote) is the client. The protocol was designed for trusted campus networks with no security considerations. IPP (Internet Printing Protocol, port 631) was created in 1999 as the modern replacement with authentication, encryption, and rich job management.

FAQ

Should I still use LPD/LPR?

No. IPP (port 631) replaces LPD entirely with: authentication (username/password or certificates), encryption (IPPS = IPP over TLS), richer features (color management, finishing options, job status). CUPS on Linux/macOS uses IPP natively. Windows 10+ supports IPP. The only reason to keep LPD is legacy Unix systems or old hardware print servers that only speak LPR.

How do I disable LPD on CUPS?

CUPS includes a cups-lpd helper for backward compatibility. Disable it: systemctl disable cups-lpd.socket [email protected] (systemd) or remove 'ServerAlias *' from cupsd.conf and ensure Port 515 is not listed in Listen directives. Verify: ss -tlnp | grep 515 should show nothing. CUPS still serves IPP on port 631.

Specification

RFC 1179 – Port 515 specification →