Proxmox - Wake-on-LAN (WOL) Monitoring & Sniffer#

This guide outlines a persistent, lightweight background service for monitoring and logging Wake-on-LAN (WOL) Magic Packets on the Proxmox network. The payload is retained so the target MAC can be identified even when a server has multiple NICs or alternate MAC addresses.

2026-08-03 Antigravity chat: agy –conversation=3b2d07f7-d649-4fed-9976-8f0deadf60f9

1. Overview & Purpose#

• Primary Target: HP3 (10.1.1.13), documented MAC ec:b1:d7:7c:a9:48
• Additional Targets: Any WOL target visible on the monitored segment, including HP2 (94:57:a5:65:7e:88)
• Capture Host: MMProxmox / MacMini (10.1.1.10)
• Capture Interface: bond0 (active-backup bond; nic1 currently active)
• Objective: Capture the source IP, source Ethernet MAC, timestamp, VLAN, and WOL payload target MAC.
• Resource Overhead: Near zero (~1 MB RAM, 0% CPU overhead).

2. Systemd Service Specification#

The sniffer uses tcpdump running as a background systemd daemon. It listens on the physical uplink (bond0) for UDP port 9/7 and raw Ethernet WOL traffic, retaining the complete packet payload in /var/log/wol_sniffer.log.

Wake-on-LAN (WOL) Configuration & Inventory#

This guide covers how to enable, persist, and verify Wake-on-LAN (WOL) across Linux nodes and Proxmox hosts, followed by a comprehensive MAC address inventory for the local and remote clusters.

1. Verification & Manual Activation#

Check WOL Support#

Use ethtool to check if your network interface supports the “Magic Packet” (designated by the letter g).

# Replace eno5 with your actual interface name
ethtool eno5 | grep Wake-on

Output Interpretation: