I want to listen for WOL (Wake-On-LAN) packets.
As WOL packets can be UDP/TCP/whatever (yes, even TCP, but probably useless), I have to check every incomming packets for the WOL specific pattern.

This can't be done directly with netfilter because the pattern is 6xFF + 16xtarget-MAC-address (so we have 96 variable bytes).

The tools I found can detect lots of protocols, but none are able to detect WOL.

Do you know a simple way to inspect every packets and run a script when a specific pattern is detected?

  • what about using tcp dump in linux did you try that ? – varnit May 9 '17 at 15:57
  • @varnit: if you have an answer with tcpdump, please write it – Gregory MOUSSAT May 9 '17 at 17:14
  • 1
    Is userspace OK or does it need to be in the kernel? Doing this in userspace would probably use libpcap, so apt-cache showpkg libpcap0.8 (at least on Stretch—name may vary by release) gives a lot of leads: security monitors like bro or snort may already do this and generic tools like netexpect and ngrep should both be able to. Also, if you want to do this in the kernel, I think the nftables kernel side can do it (though I don't think the userspace tools know how). – derobert May 9 '17 at 17:20

With ngrep, you can do this:

ngrep '\xff{6}(.{6})\1{15}'

That matches 0xff 6 times, followed by any 6 bytes, followed by those same 6 bytes repeated 15 more times. I confirmed that matches a packet generated by wakeonlan.

ngrep has options that are useful for scripting (e.g., -W single to have a single line per matched packet, -l to defeat buffering, -t for timestamps, -q to silence other output).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.