Posted 12 March 2008 - 12:18 AM
It's not really a problem, but if the traffic concerns you, just go to the 192.168.1.56 box and have them stop monitoring the printer queue. I suspect they have the print queue status window running with automatic refresh set, or something similar. Once you said you shared a printer this other box was using, the opnum field can be resolved to a particular Rpc call, in this case for the MS Remote Printing protocol (MS-RPRN). If you look at the trace, you see pairs of requests and responces for 3 different opnums, repeated in sequence over and over. opnum0x45 is RpcOpenPrinterEx(), 0x4 is RpcEnumJobs(), and 0x1D is RpcClosePrinter(). So you have is someone at IP 192.168.1.56 who is in a loop opening a printer on your box, enumerating the jobs on it, then closing the printer. Sounds like the printer status window with auto-refresh running to me, but it could be any application that is getting current printer jobs every so often.
Hope that helps.