I have turned off my Ubuntu PC with sudo poweroff. After several days I found it is running back. How to know, which event turned it on?

Computer has no keyboard and mouse attached, and power button is blocked.

Is there a systematic way to know the reason of power on in Ubuntu?

If it is network, then how to trace packets, being able to turn computer on?

  • 1
    if you suspect WOL, then you could monitor the LAN with another computer .... use an ethernet hub so that you can monitor the traffic between your PC and LAN ...... i don't even know if you can buy a hub any more – jsotola Mar 16 at 4:47

Some BIOSes have a setting to boot up after a power failure, which is useful to boot a kiosk computer, a server, or a PC where the power button is disabled on purpose or by failure.

An otherwise unnoticed short power outage may then have caused an unwanted boot.

  • 1
    So, how to detect if it was this? – Dims Mar 16 at 8:47
  • 1
    The obvious test would be to simulate a power failure by unplugging your machine, but this is not recommended. It may lead to data loss. The BIOS should have an option for this somewhere. My Asrock BIOS has this as "Restore on Power Loss > Power ON" in the "Advanced" tab. You BIOS may have a different name for that. – Takkat Mar 16 at 9:08

I had this issue on a Dell Optiplex and the problem turned out to be a wake-on-a-schedule feature in the BIOS, not wake-on-lan. It was set to boot my machine every morning. You can read more about this feature here: http://www.inspectmygadget.com/2009/01/08/little-known-bios-features-wake-up-a-computer-on-a-schedule and here https://www.makeuseof.com/answers/bios-computer-boot-specific-time/.


It might be worth mentioning your hardware (there are ways to make HW wake up after some time through BIOS/EFI).

You can disable Wake-on-LAN, both in BIOS/EFI or in Linux: How to disable Wake on Lan. Catching Wake-on-LAN packets might be possible, but definitely not easy.

To monitor Wake On Lan packets, you can capture them using another computer on the network (as WoL is sent to broadcast) with tshark -i wlan0 -w outfile.pcap -p 'ether proto 0x0842 or udp port 9' Afterwards, you can load the capture file in Wireshark, where you can see MAC address of the sender.

  • 1
    I don't want to disable WOL, I am utilizing it. I just want to know what is going on. – Dims Mar 15 at 19:22
  • 1
    @Dims That is not something you have mentioned in your question. I added monitoring WOL to my updated answer – Jakub Lucký Mar 16 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.