Wake on LAN monitoring software

[aland75]

I have an issue with a PC regularly 'waking' from sleep mode, and I suspect that something on the network could be broadcasting a WoL packet.
I'm trying to find some software that can monitor, and report on WoL packet activity, to see if this is actually the cause, and the IP (or MAC) address of the source.
Google is only finding software to initiate WoL rather than monitor it.

Can anyone suggest something?

[trashbat]

Do you actually want WoL on the problem machine for any reason? Because you can just turn it off.

How familiar with this stuff are you? e.g. on Windows you can theoretically use powercfg to find the last wake reason. But I might be telling you things you already know.

[budgie smuggler]

You can use wireshark for this, use filter "ether proto 0x0842 or udp port 9"

Or this looks like another candidate but i've never used it https://apreltech.com/Blog/Wake_on_lan_Sniffer

Before you do that though, assuming it's a windows PC, open a command prompt and run powercfg -lastwake

Probably find it's a scheduled task for something or other

[eeLee]

Windows?
powercfg –lastwake


Use Event Viewer
If you want to get more information, you can perform a deep search by using Windows Event Viewer.

Use Windows Search to search for event viewer and click the search result to open it.
In Event Viewer, you need to go to Windows Logs > System.
Scroll down to find the Power - Troubleshooter option and click it to open it.
In the General tab, you can see what woke up your computer in the Wake Source You can also find some other information like Sleep Time and Wake Time.

[aland75]

Thanks for the suggestions. Strangely, in the BIOS, WoL is off, apparently, however, powercfg shows:

>powercfg -lastwake
Wake History Count - 1
Wake History [0]
Wake Source Count - 1
Wake Source [0]
Type: Device
Instance Path: PCI\VEN_8086&DEV_153A&SUBSYS_06171028&REV_05\3&11583659&0&C8
Friendly Name: Intel(R) Ethernet Connection I217-LM
Description: Intel(R) Ethernet Connection I217-LM
Manufacturer: Intel

So that's the ethernet adapter!

[trashbat]

Yep. But you can turn it off in Windows too, in the properties of the network adapter in Device Manager. On Win11 at least, it's called 'wake on magic packet' and there's also a Power Management tab for it.

[Funk]

aland75 said:

Thanks for the suggestions. Strangely, in the BIOS, WoL is off, apparently, however, powercfg shows:

>powercfg -lastwake
Wake History Count - 1
Wake History [0]
Wake Source Count - 1
Wake Source [0]
Type: Device
Instance Path: PCI\VEN_8086&DEV_153A&SUBSYS_06171028&REV_05\3&11583659&0&C8
Friendly Name: Intel(R) Ethernet Connection I217-LM
Description: Intel(R) Ethernet Connection I217-LM
Manufacturer: Intel

So that's the ethernet adapter!

Take a look at the power management settings on the LAN adapter. It can be set to wake the machine in Windows:

[aland75]

Thanks, since disabling that, it's been fine.
I assumed that it also needed WoL enabled in the BIOS for that to work, but obviously not.
I've had this PC for ~5 years and this has only started happening in the last month or so. So that suggests that either something on my network is sending WoL packets, or some Windows update has a bug that causes it to wake randomly - often seconds after I put it to sleep.

[Funk]

Glad you got it sorted.