nmap HP LaserJet P3015 Printer has open ports 80, 443, 3389, 8080, 23456, but not 515 (line printer/line printer daemon), 631 (internet printing protocol), 9100 (hp jetdirect), so ipp://172.22.0.43/ now fails

nmap-printer.txt

Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-30 08:32 CEST
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:32
Completed NSE at 08:32, 0.00s elapsed
Initiating NSE at 08:32
Completed NSE at 08:32, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 08:32
Completed Parallel DNS resolution of 1 host. at 08:32, 0.02s elapsed
Initiating SYN Stealth Scan at 08:32
Scanning 172.22.0.43 [65535 ports]
Discovered open port 443/tcp on 172.22.0.43
Discovered open port 80/tcp on 172.22.0.43
SYN Stealth Scan Timing: About 18.72% done; ETC: 08:35 (0:02:15 remaining)
SYN Stealth Scan Timing: About 45.42% done; ETC: 08:34 (0:01:13 remaining)
Completed SYN Stealth Scan at 08:34, 108.73s elapsed (65535 total ports)
Initiating Service scan at 08:34
Scanning 2 services on 172.22.0.43
Completed Service scan at 08:34, 12.41s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 172.22.0.43
Retrying OS detection (try #2) against 172.22.0.43
Initiating Traceroute at 08:34
Completed Traceroute at 08:34, 0.02s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 08:34
Completed Parallel DNS resolution of 2 hosts. at 08:34, 0.02s elapsed
NSE: Script scanning 172.22.0.43.
Initiating NSE at 08:34
Completed NSE at 08:35, 19.38s elapsed
Initiating NSE at 08:35
Completed NSE at 08:35, 0.00s elapsed
Nmap scan report for 172.22.0.43
Host is up (0.00089s latency).
Not shown: 65529 filtered ports
PORT      STATE  SERVICE       VERSION
80/tcp    open   http          Virata-EmWeb 6.2.1 (HP LaserJet http config)
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-server-header: Virata-EmWeb/R6_2_1
|_http-title: Did not follow redirect to https://172.22.0.43/
113/tcp   closed ident
443/tcp   open   ssl/http      HP-ChaiSOE 1.0 (HP LaserJet http config)
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-server-header: HP-ChaiSOE/1.0
| http-title: HP LaserJet P3015 Printers
|_Requested resource was /hp/device/this.LCDispatcher
| ssl-cert: Subject: commonName=HP Jetdirect 6E923EB7/organizationName=Hewlett-Packard Co.
| Issuer: commonName=HP Jetdirect 6E923EB7/organizationName=Hewlett-Packard Co.
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: md5WithRSAEncryption
| Not valid before: 2012-03-01T00:00:00
| Not valid after:  2017-03-01T00:00:00
| MD5:   4d7e dc16 89ae 6af1 b6e6 5184 1118 2ec3
|_SHA-1: 6daf bc41 96c0 5700 1572 f38d 2328 e236 0b47 4a21
|_ssl-date: 1970-01-01T00:15:44+00:00; -48y241d06h19m01s from scanner time.
3389/tcp  closed ms-wbt-server
8080/tcp  closed http-proxy
23456/tcp closed aequus
Device type: broadband router|webcam|switch|general purpose|printer|WAP|firewall
Running (JUST GUESSING): Ambit embedded (94%), Cisco embedded (94%), Tandberg embedded (94%), Avaya embedded (94%), FreeBSD 4.X|6.X (94%), HP embedded (94%), AirSpan embedded (92%), ZyXEL embedded (91%)
OS CPE: cpe:/h:ambit:u10c018 cpe:/h:cisco:epc3925 cpe:/o:freebsd:freebsd:4.9 cpe:/h:hp:laserjet_p3005 cpe:/h:zyxel:gs1910 cpe:/o:freebsd:freebsd:6.2 cpe:/o:freebsd:freebsd:4.11
Aggressive OS guesses: Ambit U10C018 or Cisco EPC3925 cable modem, or Tandberg video conferencing system (94%), Avaya 4000- or 5000-series Ethernet Routing switch (94%), FreeBSD 4.9-RELEASE (94%), HP LaserJet P3005 printer (94%), AirSpan ProST WiMAX access point (92%), ZyXEL GS1910 switch (91%), FreeBSD 6.2-RELEASE (90%), m0n0wall 1.22 - 1.23b1 firewall (FreeBSD 4.11) (89%), Motorola SVG1202 router (89%), Avaya 4526GTX switch (88%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 0.011 days (since Thu Aug 30 08:18:32 2018)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: 172.22.0.43; Device: printer

Host script results:
|_clock-skew: mean: -17773d06h19m01s, deviation: 0s, median: -17773d06h19m01s

TRACEROUTE (using port 8080/tcp)
HOP RTT     ADDRESS
1   0.50 ms 172.22.1.1
2   1.47 ms 172.22.0.43

NSE: Script Post-scanning.
Initiating NSE at 08:35
Completed NSE at 08:35, 0.00s elapsed
Initiating NSE at 08:35
Completed NSE at 08:35, 0.00s elapsed
Read data files from: /usr/local/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 145.62 seconds
           Raw packets sent: 131226 (5.778MB) | Rcvd: 121 (5.659KB)