Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have turned off my Ubuntu PC with sudo poweroff. After several days I found it is running back. How to know, which event turned it on?
Computer has no keyboard and mouse attached, and power button is blocked.
Is there a systematic way to know the reason of power on in Ubuntu?
If it is network, then how to trace packets, being able to turn computer on?
Some BIOSes have a setting to boot up after a power failure, which is useful to boot a kiosk computer, a server, or a PC where the power button is disabled on purpose or by failure.
An otherwise unnoticed short power outage may then have caused an unwanted boot.
It might be worth mentioning your hardware (there are ways to make HW wake up after some time through BIOS/EFI).
You can disable Wake-on-LAN, both in BIOS/EFI or in Linux: How to disable Wake on Lan. Catching Wake-on-LAN packets might be possible, but definitely not easy.
To monitor Wake On Lan packets, you can capture them using another computer on the network (as WoL is sent to broadcast) with tshark -i wlan0 -w outfile.pcap -p 'ether proto 0x0842 or udp port 9'
Afterwards, you can load the capture file in Wireshark, where you can see MAC address of the sender.
I had this issue on a Dell Optiplex and the problem turned out to be a wake-on-a-schedule feature in the BIOS, not wake-on-lan. It was set to boot my machine every morning. You can read more about this feature here: http://www.inspectmygadget.com/2009/01/08/little-known-bios-features-wake-up-a-computer-on-a-schedule and here https://www.makeuseof.com/answers/bios-computer-boot-specific-time/.
