5

I have a Windows 10 server which has been operating well for some time using Wake On Lan. The Realtek adapter is set with Wake On Magic Packet enabled and Wake On Pattern Match disabled. Similarly, Windows is set to "Wake only on Magic Packet". This normally works well on my home network: I have a couple of WoL clients which can each wake the server when they need it, and the server is set to sleep promptly when it's no longer needed.

Recently I enabled IGMP Proxy on the home router to support an IPTV application. However, now, as soon as the server sleeps, it wakes again within a few seconds, triggered by a wake signal from the network adapter. Turn off IGMP Proxy and it stops waking up.

I am fairly confident that it is some kind of multicast packet that is triggering the wake. I have used Wireshark to sniff the packets causing the wake but I can't find the culprit: there are no Magic Packets at the time of the wake but lots of multicast ones.

So, what's going on? Why is the adapter waking on packets which don't seem to be Magic? And how can I fix it?

Update:

I've taken a packet capture (only 28 packets) which spans the period from sleep to wake on the server and so should contain the offending packet. I note that none of the frames contain the MAC address of the server (as a magic packet would) but most of them are UDP -> RTTP -> ISO/IEC 13818-1 -> DVB-EIT packets which contain a lot of "FF" stuffing (as a magic packet would).

There is also 1 ICMP v6 packet and 2 STP frames. I don't think these are doing it since I think I've seen wake captures without them - but I could be wrong.

However, note that the packet capture was via a switch. So it would see any magic packet that is broadcast (as the ones I send deliberately are) but it wouldn't capture a hypothetical magic packet sent direct to the MAC of the server. On the other hand, when I capture on the server (under the conditions under which it wakes, but when it is awake - of course) I don't see anything like a magic packet directed to its MAC address.

The NIC is a Realtek 8168 PCI GbE adapter as supplied on my Asus P 8Z77-V LX motherboard with the latest drivers from here.

UPDATED WITH MORE PRECISE SYMPTOMS

So, the IGMP was not the direct cause. I can reproduce the problem fairly reliably without using Multicast. If I simply send a particular UDP packet (payload) repeatedly to the adapter as a UDP broadcast I can eventually get it to wake. It typically takes 300 or 400 sends. The packet was copied out of a capture of the multicast stream and is typical of the sort of packets seen in it.

This is the Python 3 code that I used to send the packet (and the bytes of the packet shown as a hex dump):

import time
from socket import *
cs = socket(AF_INET, SOCK_DGRAM)

hex_dump = '''
0000   01 00 5e 51 82 fb 78 24 af 98 f3 30 08 00 45 88
0010   05 4c 00 00 00 00 3a 11 a8 31 6d 9f f7 fb ea 51
0020   82 fb 16 aa 16 aa 05 38 00 00 80 21 0c a1 f9 47
0030   9b 2e 00 00 00 2d 47 40 12 13 00 4f f0 37 04 6d
0040   fb 01 01 04 6d ff 00 01 4f d0 35 e4 1c 17 30 00
0050   00 30 00 20 1c 4d 1a 65 6e 67 15 52 75 67 62 79
0060   20 54 6f 6e 69 67 68 74 20 4f 6e 20 54 6f 75 72
0070   00 9b fe ae 4d ff ff ff ff ff ff ff ff ff ff ff
0080   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0090   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00a0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00b0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00c0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00d0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00e0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00f0   ff ff 47 1f ff 10 ff ff ff ff ff ff ff ff ff ff
0100   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0110   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0120   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0130   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0140   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0150   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0160   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0170   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0180   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0190   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
01a0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff 47 40
01b0   12 14 00 4f f0 3b 04 6e fb 00 01 04 6e ff 00 01
01c0   4f e3 83 e4 1c 16 26 00 02 04 00 80 20 4d 1e 65
01d0   6e 67 19 4c 69 76 65 3a 20 44 61 72 6d 73 74 61
01e0   64 74 20 76 20 48 61 6d 62 75 72 67 00 20 6e 4f
01f0   2b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0200   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0210   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0220   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0230   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0240   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0250   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0260   ff ff ff ff ff ff ff ff ff ff 47 40 12 15 00 4f
0270   f0 41 04 6e fb 01 01 04 6e ff 00 01 4f e3 87 e4
0280   1c 18 30 00 02 00 00 20 26 4d 24 65 6e 67 1f 4c
0290   69 76 65 3a 20 57 65 72 64 65 72 20 42 72 65 6d
02a0   65 6e 20 76 20 57 6f 6c 66 73 62 75 72 67 00 7b
02b0   ba e0 e7 ff ff ff ff ff ff ff ff ff ff ff ff ff
02c0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
02d0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
02e0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
02f0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0300   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0310   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0320   ff ff ff ff ff ff 47 1f ff 10 ff ff ff ff ff ff
0330   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0340   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0350   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0360   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0370   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0380   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0390   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
03a0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
03b0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
03c0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
03d0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
03e0   ff ff 47 40 12 16 00 4f f0 2f 04 6f dd 00 01 04
03f0   6f ff 00 01 4f ca b7 e4 1c 17 00 00 00 15 00 80
0400   14 4d 12 65 6e 67 0d 4d 6f 74 6f 47 50 3a 20 49
0410   43 59 4d 49 00 81 93 dc 61 ff ff ff ff ff ff ff
0420   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0430   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0440   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0450   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0460   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0470   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0480   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0490   ff ff ff ff ff ff ff ff ff ff ff ff ff ff 47 40
04a0   12 17 00 4f f0 37 04 6f dd 01 01 04 6f ff 00 01
04b0   4f ca 41 e4 1c 17 15 00 00 15 00 20 1c 4d 1a 65
04c0   6e 67 15 42 54 20 53 70 6f 72 74 20 47 6f 61 6c
04d0   73 20 52 65 6c 6f 61 64 00 9a 07 13 89 ff ff ff
04e0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
04f0   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0500   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0510   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0520   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0530   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0540   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0550   ff ff ff ff ff ff ff ff ff ff
'''

arr = hex_dump.split('\n')

pkt = bytes()
for a in arr:
    arr1 = a.split()
    hex_str = "".join(arr1[1:])
    pkt += bytes.fromhex(hex_str)

cs.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
cs.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)

for i in range(1000):
    print(i)
    cs.sendto(pkt[42:], ('192.168.1.255', 5802))
    time.sleep(0.01)
  • 1
    what NIC and drivers are you using? – Albin Oct 5 '18 at 20:27
  • I have added the NIC information to the question – strubbly Oct 6 '18 at 6:50
1

Some hint might be found in the Microsoft Support article
Unwanted wake-up events may occur when you enable the Wake On LAN feature in Windows 7 or in Windows Vista.

It seems like the magic packet is not the only message which is being listened to when Wake On Lan is enabled.

By default, Windows 7 and Windows Vista listen for the following packets when you enable WOL:

  • A directed packet to the MAC address of the network adapter
  • A NetBIOS name resolution broadcast for the local computer name
  • An Address Resolution Protocol (ARP) packet for the IPv4 address of the network adapter
  • An IPv6 Neighbor Discovery packet for the network adapter's solicited-node multicast address

There are two places where I have found references to limiting Wake On Lan events.

In Control Panel > Network and Internet > Network Connections, right-click your adapter and choose Properties and then click Configure. In the Advanced tab there are two properties that are both Enabled by default : Wake on magic packet and Wake on pattern match. Disabling the second one may help.

enter image description here

In the Power Management tab. Make sure you tick the two checkboxes next to Allow this device to wake the computer and Only allow a magic packet to wake the computer.

image

Turning off IPv6 on your local network might also limit the number of unintended wake events.

  • I definitely have both those settings pages already set as you suggest. – strubbly Oct 5 '18 at 11:10
  • Not sure what you mean by turn off IPv6 "on the local network". It is off on the router but some devices are still using it. – strubbly Oct 5 '18 at 11:13
  • If it's off on the router then it will not pass on any IPv6 messages, so that's ok. I must admit I'm astonished that your computer is still being waked up by other messages, even though your settings are supposed to disable it. What are the models of your computer, motherboard and network adapter? – harrymc Oct 5 '18 at 11:38
  • I'm astonished too :-) The PC is an Asus P8Z77-V LX which has a Realtek GbE chip. Latest Windows 10. – strubbly Oct 5 '18 at 13:40
  • 1
    What does powercfg –lastwake say? Try also to run powercfg -energy while the computer is idle and post the result. – harrymc Oct 5 '18 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.