I scanned a school network once and printed about 40 pages of http request on every printer. I think turned out you just send anything on 9100 and it prints. I think it was nmap trying to detect the host with a query.