I used

sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9

but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.

The same with Wireshark

enter image description here

  • Target computer was turned off and can't execute any code. Source computer was running both WakeOnLan and wireshark – Dims Mar 16 at 8:45

Wikipedia has this to say about the structure of a Wake-on-LAN packet (emphasis mine):

The magic packet is a broadcast frame containing anywhere within its payload 6 bytes of all 255 (FF FF FF FF FF FF in hexadecimal), followed by sixteen repetitions of the target computer's 48-bit MAC address, for a total of 102 bytes.

Since the magic packet is only scanned for the string above, and not actually parsed by a full protocol stack, it could be sent as any network- and transport-layer protocol, although it is typically sent as a UDP datagram to port 0, 7 or 9, or directly over Ethernet as EtherType 0x0842.

So, your current capture filter is not guaranteed to catch all WOL packets. And according to the documentation, it seems the WakeMeOnLan application has multiple ways to send the WOL packet, so you might need to make a short unfiltered test capture to find out what kind of WOL packets the application is sending, and then tailor your filter accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.