WOL Advice Required

[BestGear]

Guys

I would appreciate some advice please surrounding WOL triggering.

Using WOL on a Server 2012R2 box -and it works, but keeps waking due to network activity.

As you know, the logs dont show anything beyond the network service woke the box - so I cant identify the network device or broadcast that is triggering WOL.

Its not a magic packet - and as far as I am aware no client attempting to access the server so it must be a broadcast or similar.

Is there any way that i can setup the WOL process to ignore any packets unless specifically addressed to this box?

I have used Intel and dare i say it, Realtek NICs just incase it varies (the driver functionality certainly varies!).

Thanks

David

 

[EffrafaxOfWug]

I could be wrong, but IIRC WOL traffic has to be targeted against a specific MAC address doesn't it...?

How often does the box wake up and what options are enabled in the NIC driver settings? Is only wake on magic packet enabled? How often does the box wake up from suspend?

Most WOL utilities default to broadcast traffic so if can likely run a wireshark capture for long enough on some other computer sitting on the same VLAN you should be able to see any WOL packets traversing the network.

Edit: yes, I'm wrong (I only use WOL on a couple of my linux boxes) - windows responds to more than just WOL packets it seems, there's a number of other things that can wake up windows which they've listed here:
* A directed packet to the MAC address of the network adapter
* A NetBIOS name resolution broadcast for the local computer name
* An Address Resolution Protocol (ARP) packet for the IPv4 address of the network adapter
* An IPv6 Neighbor Discovery packet for the network adapter's solicited-node multicast address

NetBIOS or ARPs are likely the culprits here.

I think the control options for this are driver-dependent but on my i210's there's a selection of what events the NIC will use to trigger a WOL event.

 

[klui]

Your driver needs to support it and expose the settings properly. What NIC are you using?

For newer Intel drivers, there are checkmarks in Power Management for

• Wake on Magic Packet
• Wake on Pattern Match
• Wake on Magic Packet from power off state
• Wake on Link Settings

The generic interface for Power Management will have a checkbox where you only allow magic packet.

 

[BestGear]

Hi

Thanks for the replies.

I am not using a magic packet - I am relying on traffic waking it, which does work, but wakes every few minutes!

I had seen the post with teh following - and answers inline...

* A directed packet to the MAC address of the network adapter - THATS WHAT I HOPE TO USE!
* A NetBIOS name resolution broadcast for the local computer name - NETBIOS IS DISABLED ON THE INTERFACE - BUT THOUGHT NB WOULD BE HANDLED BY THE OS NOT THE NIC
* An Address Resolution Protocol (ARP) packet for the IPv4 address of the network adapter - THIS IS WHAT MUST BE TRIGGERING IT
* An IPv6 Neighbor Discovery packet for the network adapter's solicited-node multicast address - I DISABLED IP6, SO DISCOUNTED

I have tried a couple of Intel NICS (cant remember the chip set but used Intels driver not MS, and also a typically crappy Realtek.

ARP offload is enabled (thinking that was the cause, but sadly no!).

WOL does work... I just want to only wake when direct traffic is sent to it - ie all broadcasts are enabled...

My other thought was if I could disable broadcasts at the switch just for that device?


David

 

[EffrafaxOfWug]

I am not using a magic packet - I am relying on traffic waking it, which does work, but wakes every few minutes!
...
* A directed packet to the MAC address of the network adapter - THATS WHAT I HOPE TO USE!

As I understand it, these two statements are contradictory. What do you mean when you say you want "traffic" to wake it?

* A NetBIOS name resolution broadcast for the local computer name - NETBIOS IS DISABLED ON THE INTERFACE - BUT THOUGHT NB WOULD BE HANDLED BY THE OS NOT THE NIC
* An Address Resolution Protocol (ARP) packet for the IPv4 address of the network adapter - THIS IS WHAT MUST BE TRIGGERING IT
* An IPv6 Neighbor Discovery packet for the network adapter's solicited-node multicast address - I DISABLED IP6, SO DISCOUNTED

I have tried a couple of Intel NICS (cant remember the chip set but used Intels driver not MS, and also a typically crappy Realtek.

ARP offload is enabled (thinking that was the cause, but sadly no!).

WOL does work... I just want to only wake when direct traffic is sent to it - ie all broadcasts are enabled...

My other thought was if I could disable broadcasts at the switch just for that device?

I'm not sure disabling NetBIOS will do anything to stop the behaviour, but you can't disable ARP (ARP offload just means there's a dedicated co-processor in the NIC silicon).

Terminology cleanup here I think; you want the computer to be able to be woken up by a WOL magic packet sent to the computer (usually by way of the target MAC address); you don't want ARP or Netbios traffic to trigger the wake-up which is apparently windows' default behaviour. If you only want the server to be woken by a magic packet, assuming your LAN drivers provide it you should hopefully be able to go into the NIC properties and disable WOL activity for anything other than magic packets. If you want your server to only be woken by either the ARP or NetBIOS or other traffic then disable magic packet and take steps to control the errant traffic that's causing you unwanted wakeups (but from my understanding that won't be easy).

Broadcasts aren't per-device, they go out to the network address and thus can be seen by every device in the network; that's what makes them broadcasts.