How to configure Wake On Pattern Match?

[nexusN]

Hi,

Having a home server with MS RDP and FTP, I usually keeps it sleep while I'm not on it, simply by setting it to sleep after 10 mins of idle, this worked well.

To wake it, I tried a setting called Wake On Pattern Match.
This is good that I can easily start it up just by trying to access it on port 21 or 3389 without sending a magic packet.

However, as many people may have encountered, the server will now start up unexpectedly even I am not using it.
How can I tweak the setting for that "pattern"?
Thanks.

 

[seepy83]

I've never used it, but looking at documentation real quick it doesn't look like you can tweak it.

Taken from http://msdn.microsoft.com/en-us/windows/hardware/gg463242.aspx#EAE:

It will register the following packet patterns at miniport initialization:
Directed Layer Two packet
Address resolution protocol (ARP) broadcast for station IP address (frames with DIX header)
NetBIOS over TCP/IP broadcast for station's assigned computername (frames with DIX header)

I would suspect that the ARP and NetBIOS broadcasts are pretty common occurrences. You could use wireshark (or some other packet analyzer) to see what other computers and/or devices you have on your network that are trying to contact the sleeping machine and waking it up. You might be able to do something on those computers to stop them from looking for the server.

 

[nexusN]

I've never used it, but looking at documentation real quick it doesn't look like you can tweak it.

Taken from http://msdn.microsoft.com/en-us/windows/hardware/gg463242.aspx#EAE:


I would suspect that the ARP and NetBIOS broadcasts are pretty common occurrences. You could use wireshark (or some other packet analyzer) to see what other computers and/or devices you have on your network that are trying to contact the sleeping machine and waking it up. You might be able to do something on those computers to stop them from looking for the server.

Ya, I have been looking for options on configuring but've got no luck.
Though this option may impose some false positive with no tweaking available, it is useful for getting my server sleep and wake without using magic packet, which would be much more convenient.

Thanks for the advice, it would be better to observe the packet which actually woke the server.

Luckily, the server is behind a pfsense firewall, I may also make use of it to restrict the possible spamming access to the server.

 

[spidey07]

There is always tons of scans on port 21 on the Internet.

 

[nexusN]

There is always tons of scans on port 21 on the Internet.

Maybe altering the port is a solution.:\
Just now I set to log on pfsense port 21 nd 3389, see if there are really that a lot of troubles

 

[seepy83]

Like I said earlier, I've never set this up...but from what I read, it doesn't looks like it cares what port a connection is attempting to connect on. It's just monitoring for any connection attempt or any ARP/NetBIOS broadcast for that machine.