I want to listen for WOL (Wake-On-LAN) packets.As WOL packets can be UDP/TCP/whatever (yes, even TCP, but probably useless), I have to check every incomming packets for the WOL specific pattern.This can't be done directly with netfilter because the pattern is 6xFF + 16xtarget-MAC-address (so we have 96 variable bytes).The tools I found can detect lots of protocols, but none are able to detect WOL.Do you know a simple way to inspect every packets and run a script when a specific pattern is detected?
Deep packets inspection to detect WOL
wake on lan
With ngrep, you can do this:ngrep '\xff{6}(.{6})\1{15}'That matches 0xff 6 times, followed by any 6 bytes, followed by those same 6 bytes repeated 15 more times. I confirmed that matches a packet generated by wakeonlan.ngrep has options that are useful for scripting (e.g., -W single to have a single line per matched packet, -l to defeat buffering, -t for timestamps, -q to silence other output).