Proxmox - Wake-on-LAN (WOL) Monitoring & Sniffer#
This guide outlines a persistent, lightweight background service for monitoring and logging Wake-on-LAN (WOL) Magic Packets on the Proxmox network. The payload is retained so the target MAC can be identified even when a server has multiple NICs or alternate MAC addresses.
2026-08-03 Antigravity chat: agy –conversation=3b2d07f7-d649-4fed-9976-8f0deadf60f9
1. Overview & Purpose#
- Primary Target: HP3 (
10.1.1.13), documented MACec:b1:d7:7c:a9:48 - Additional Targets: Any WOL target visible on the monitored segment, including HP2 (
94:57:a5:65:7e:88) - Capture Host:
MMProxmox/ MacMini (10.1.1.10) - Capture Interface:
bond0(active-backup bond;nic1currently active) - Objective: Capture the source IP, source Ethernet MAC, timestamp, VLAN, and WOL payload target MAC.
- Resource Overhead: Near zero (~1 MB RAM, 0% CPU overhead).
2. Systemd Service Specification#
The sniffer uses tcpdump running as a background systemd daemon. It listens on the physical uplink (bond0) for UDP port 9/7 and raw Ethernet WOL traffic, retaining the complete packet payload in /var/log/wol_sniffer.log.