Proxmox - Wake-on-LAN (WOL) Monitoring & Sniffer#

This guide outlines a persistent, lightweight background service for monitoring and logging Wake-on-LAN (WOL) Magic Packets on the Proxmox network. The payload is retained so the target MAC can be identified even when a server has multiple NICs or alternate MAC addresses.

2026-08-03 Antigravity chat: agy –conversation=3b2d07f7-d649-4fed-9976-8f0deadf60f9

1. Overview & Purpose#

• Primary Target: HP3 (10.1.1.13), documented MAC ec:b1:d7:7c:a9:48
• Additional Targets: Any WOL target visible on the monitored segment, including HP2 (94:57:a5:65:7e:88)
• Capture Host: MMProxmox / MacMini (10.1.1.10)
• Capture Interface: bond0 (active-backup bond; nic1 currently active)
• Objective: Capture the source IP, source Ethernet MAC, timestamp, VLAN, and WOL payload target MAC.
• Resource Overhead: Near zero (~1 MB RAM, 0% CPU overhead).

2. Systemd Service Specification#

The sniffer uses tcpdump running as a background systemd daemon. It listens on the physical uplink (bond0) for UDP port 9/7 and raw Ethernet WOL traffic, retaining the complete packet payload in /var/log/wol_sniffer.log.

The capture must not use the any pseudo-interface when applying Ethernet filters: Linux cannot apply ether filters to that cooked interface. It also must not filter on ether host <target-MAC> because the Ethernet destination of a normal WOL packet is broadcast; the target MAC is repeated in the UDP payload. The service therefore captures the WOL traffic broadly and identifies the target from the hex dump.

Service File Code (/etc/systemd/system/wol-sniffer.service)#

[Unit]
Description=Wake-on-LAN Packet Sniffer
After=network.target

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'echo "[$(date -u +%%Y-%%m-%%dT%%H:%%M:%%SZ)] WOL Sniffer Service Started" >> /var/log/wol_sniffer.log'
ExecStart=/usr/bin/tcpdump -i bond0 -l -nn -e -s 0 -XX "udp port 7 or udp port 9 or ether proto 0x0842"
StandardOutput=append:/var/log/wol_sniffer.log
StandardError=append:/var/log/wol_sniffer.log
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target

3. Installation Guide for Hypervisors#

Node 1: MMProxmox (10.1.1.10 / MacMini)#

1. Create the systemd service unit file:

   sudo nano /etc/systemd/system/wol-sniffer.service

2. Paste the service configuration code above.
3. Reload systemd daemon and enable the service:

   sudo systemctl daemon-reload
   sudo systemctl enable --now wol-sniffer.service

4. Verify service status:

   systemctl status wol-sniffer.service

Node 2: HP1Proxmox (10.1.1.11 / HP1)#

1. Create the systemd service unit file:

   sudo nano /etc/systemd/system/wol-sniffer.service

2. Paste the service configuration code above.
3. Reload systemd daemon and enable the service:

   sudo systemctl daemon-reload
   sudo systemctl enable --now wol-sniffer.service

4. Verify service status:

   systemctl status wol-sniffer.service

4. Log Inspection & Troubleshooting#

Viewing Captured WOL Packets#

When HP3 powers on unexpectedly, inspect the log file on either node:

cat /var/log/wol_sniffer.log

Sample Log Output:#

[2026-08-03T20:04:28Z] WOL Sniffer Service Started
20:04:28.102934 IP 10.1.2.230.49152 > 255.255.255.255.9: UDP, length 102

• Interpretation: 10.1.2.230 transmitted the Magic Packet to port 9 at 20:04:28.

Confirmed Capture — 2026-08-11#

The corrected bond0 capture identified a VirtualBox VM as the WOL source:

All three packets were broadcast to 255.255.255.255:9 on VLAN 12. The 08:00:27 OUI indicates a VirtualBox-originated sender. The VM at 10.1.2.200 is therefore the current leading candidate for the automation that woke HP2 and HP3.

5. Log Rotation Configuration (Optional)#

To prevent /var/log/wol_sniffer.log from growing indefinitely over time, add a logrotate rule:

File: /etc/logrotate.d/wol-sniffer#

/var/log/wol_sniffer.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
}

6. Deactivation & Removal Guide#

If you no longer need the monitoring service or wish to temporarily pause packet sniffing, use the following commands:

Temporarily Pause / Stop Monitoring#

sudo systemctl stop wol-sniffer.service

(The service will stop immediately, but will start automatically again on the next reboot).

Permanently Disable (Prevent Auto-Start on Boot)#

sudo systemctl disable --now wol-sniffer.service

(Stops the service immediately and prevents it from starting on subsequent reboots).

Completely Remove Service & Clean Up Logs#

To completely purge the service and log files from the host:

# 1. Stop and disable the service
sudo systemctl disable --now wol-sniffer.service

# 2. Delete systemd service file and logrotate rule
sudo rm -f /etc/systemd/system/wol-sniffer.service
sudo rm -f /etc/logrotate.d/wol-sniffer

# 3. Reload systemd daemon
sudo systemctl daemon-reload
sudo systemctl reset-failed

# 4. (Optional) Delete log file
sudo rm -f /var/log/wol_sniffer.log