sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when
NirSoft wakes the computer.
The same with
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Wikipedia has this to say about the structure of a Wake-on-LAN packet (emphasis mine):
The magic packet is a broadcast frame containing anywhere within its payload 6 bytes of all 255 (FF FF FF FF FF FF in hexadecimal), followed by sixteen repetitions of the target computer's 48-bit MAC address, for a total of 102 bytes.
Since the magic packet is only scanned for the string above, and not actually parsed by a full protocol stack, it could be sent as any network- and transport-layer protocol, although it is typically sent as a UDP datagram to port 0, 7 or 9, or directly over Ethernet as EtherType 0x0842.
So, your current capture filter is not guaranteed to catch all WOL packets. And according to the documentation, it seems the WakeMeOnLan application has multiple ways to send the WOL packet, so you might need to make a short unfiltered test capture to find out what kind of WOL packets the application is sending, and then tailor your filter accordingly.