Nmap avoids sending to 9100 specifically to avoid sending data that the printer may misinterpret as data to be written to a page. You need to give it the --allp

Nmap avoids sending to 9100 specifically to avoid sending data that the printer may misinterpret as data to be written to a page. You need to give it the --allports option. --allports (Don't exclude any ports from version detection) . By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the Exclude directive in nmap-service-probes, or you can specify --allports to scan all ports regardless of any Exclude directive.