Updated: September 20, 2026

Proxmox - Wake-on-LAN (WOL) Monitoring & Sniffer#

This guide outlines a persistent, lightweight background service for monitoring and logging Wake-on-LAN (WOL) Magic Packets on the Proxmox network. The payload is retained so the target MAC can be identified even when a server has multiple NICs or alternate MAC addresses.

2026-08-03 Antigravity chat: agy –conversation=3b2d07f7-d649-4fed-9976-8f0deadf60f9

1. Overview & Purpose#

• Primary Target: HP3 (10.1.1.13), documented MAC ec:b1:d7:7c:a9:48
• Additional Targets: Any WOL target visible on the monitored segment, including HP2 (94:57:a5:65:7e:88)
• Capture Host: MMProxmox / MacMini (10.1.1.10)
• Capture Interface: bond0 (active-backup bond; nic1 currently active)
• Objective: Capture the source IP, source Ethernet MAC, timestamp, VLAN, and WOL payload target MAC.
• Resource Overhead: Near zero (~1 MB RAM, 0% CPU overhead).

2. Systemd Service Specification#

The sniffer uses tcpdump running as a background systemd daemon. It listens on the physical uplink (bond0) for UDP port 9/7 and raw Ethernet WOL traffic, retaining the complete packet payload in /var/log/wol_sniffer.log.

The capture must not use the any pseudo-interface when applying Ethernet filters: Linux cannot apply ether filters to that cooked interface. It also must not filter on ether host <target-MAC> because the Ethernet destination of a normal WOL packet is broadcast; the target MAC is repeated in the UDP payload. The service therefore captures the WOL traffic broadly and identifies the target from the hex dump.

Service File Code (/etc/systemd/system/wol-sniffer.service)#

[Unit]
Description=Wake-on-LAN Packet Sniffer
After=network.target

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'echo "[$(date -u +%%Y-%%m-%%dT%%H:%%M:%%SZ)] WOL Sniffer Service Started" >> /var/log/wol_sniffer.log'
ExecStart=/usr/bin/tcpdump -i bond0 -l -nn -e -s 0 -XX "udp port 7 or udp port 9 or ether proto 0x0842"
StandardOutput=append:/var/log/wol_sniffer.log
StandardError=append:/var/log/wol_sniffer.log
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target

3. Installation Guide for Hypervisors#

Node 1: MMProxmox (10.1.1.10 / MacMini)#

1. Create the systemd service unit file:

   sudo nano /etc/systemd/system/wol-sniffer.service

2. Paste the service configuration code above.
3. Reload systemd daemon and enable the service:

   sudo systemctl daemon-reload
   sudo systemctl enable --now wol-sniffer.service

4. Verify service status:

   systemctl status wol-sniffer.service

Node 2: HP1Proxmox (10.1.1.11 / HP1)#

1. Create the systemd service unit file:

   sudo nano /etc/systemd/system/wol-sniffer.service

2. Paste the service configuration code above.
3. Reload systemd daemon and enable the service:

   sudo systemctl daemon-reload
   sudo systemctl enable --now wol-sniffer.service

4. Verify service status:

   systemctl status wol-sniffer.service

4. Log Inspection & Troubleshooting#

Viewing Captured WOL Packets#

When HP3 powers on unexpectedly, inspect the log file on either node:

cat /var/log/wol_sniffer.log

Sample Log Output:#

[2026-08-03T20:04:28Z] WOL Sniffer Service Started
20:04:28.102934 IP 10.1.2.230.49152 > 255.255.255.255.9: UDP, length 102

• Interpretation: 10.1.2.230 transmitted the Magic Packet to port 9 at 20:04:28.

Confirmed Capture — 2026-08-11#

The corrected bond0 capture identified a VirtualBox VM as the WOL source:

All three packets were broadcast to 255.255.255.255:9 on VLAN 12. The 08:00:27 OUI indicates a VirtualBox-originated sender. The VM at 10.1.2.200 is therefore the current leading candidate for the automation that woke HP2 and HP3.

5. Log Rotation Configuration#

To prevent /var/log/wol_sniffer.log from growing indefinitely, MMProxmox uses the following logrotate rule. The postrotate hook restarts the tracer after rotation so tcpdump reopens the active log file instead of continuing to write to a deleted rotated inode.

File: /etc/logrotate.d/wol-sniffer#

/var/log/wol_sniffer.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
    sharedscripts

    postrotate
        systemctl try-restart wol-sniffer.service >/dev/null 2>&1 || true
    endscript
}

6. Deactivation & Removal Guide#

If you no longer need the monitoring service or wish to temporarily pause packet sniffing, use the following commands:

Temporarily Pause / Stop Monitoring#

sudo systemctl stop wol-sniffer.service

(The service will stop immediately, but will start automatically again on the next reboot).

Permanently Disable (Prevent Auto-Start on Boot)#

sudo systemctl disable --now wol-sniffer.service

(Stops the service immediately and prevents it from starting on subsequent reboots).

Completely Remove Service & Clean Up Logs#

To completely purge the service and log files from the host:

# 1. Stop and disable the service
sudo systemctl disable --now wol-sniffer.service

# 2. Delete systemd service file and logrotate rule
sudo rm -f /etc/systemd/system/wol-sniffer.service
sudo rm -f /etc/logrotate.d/wol-sniffer

# 3. Reload systemd daemon
sudo systemctl daemon-reload
sudo systemctl reset-failed

# 4. (Optional) Delete log file
sudo rm -f /var/log/wol_sniffer.log