Cannot sniff WakeMeOnLan.exe WOL Packets with Wireshark

Written by James McDonald

January 13, 2022

I am using a Windows 10 PC on my LAN that I am trying to send a WOL magic packet using WakeMeOnLan.exe . I wanted to check with Wireshark whether the packets were being sent but using a capture filter or wol on the correct interface returned nothing

The problem

WakeMeOnLan sends non-standard WOL packets. Normally a WOL packet should be UDP port 9 but the WakeMeOnLAN packets are shown in the capture as

Protocol : “? KNXnet/IP”

Info: “? Unknown Service Family.”

WakeMeOnLAN is sending a UDP packet to port 40000

Working Capture Filters with WakeMeOnLAN defaults

Capture broadcasts to ethernet

eth.addr == ff:ff:ff:ff:ff:ff

Capture packets sent to the specific device using its MAC Address

eth.addr == 00:11:33:43:96:9F

To get Wireshark to see WOL Protocol change to port 9

In the WakeMeOnLAN gui, right click on a device and choose “Change wake up settings for the selected items” enter port 9

Wireshark then displays the packet as WOL

WakeMeOnLAN Command line

# wakemeonlan.exe /wakeup <ETHERNET_MAC_ADDRESS>
wakemeonlan.exe /wakeup  00:11:33:42:9B:9E


Submit a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

The reCAPTCHA verification period has expired. Please reload the page.

You May Also Like…

Meraki Open Source Licenses

Until today I assumed that Meraki was built in-house with only closed source software. But having a look at the...


If you have Veeam backup failing with the Updating BCD failed with Cannot update SafeBoot flag and SentinelOne is...