Wake-on-LAN (WoL) is an Ethernet or Token Ring computer networking standard that allows a computer to be turned on or awakened from sleep mode by a network message. The message is usually sent to the target computer by a program executed on a device connected to the same local area network (LAN). It is also possible to initiate the message from another network by using subnet directed broadcasts or a WoL gateway service. It is based upon AMD's Magic Packet Technology, which was co-developed by AMD and Hewlett-Packard, following its proposal as a standard in 1995. The standard saw quick adoption thereafter through IBM, Intel and others.
If the computer being awakened is communicating via Wi-Fi, a supplementary standard called Wake on Wireless LAN (WoWLAN) must be employed. The WoL and WoWLAN standards are often supplemented by vendors to provide protocol-transparent on-demand services, for example in the Apple Bonjour wake-on-demand (Sleep Proxy) feature.
History The basis for the Wake-on-LAN industry standard mechanism today was created around 1994 by AMD in cooperation with Hewlett-Packard, who co-developed AMD's Magic Packet Technology and brought forth their following proposal for it in November 1995 in an AMD white paper. It enabled a remote network device to be woken up through the underlying “power management circuitry”, by sending it a standard Ethernet frame, which “contains a specific data pattern detected by the Ethernet-controller on the receiving end”.
AMD implemented the WoL mechanism in their AMD PCnet II-Family of Ethernet controllers before. The term “Magic Packet” is a AMD trademark.
Wake-on-LAN saw wide adoption starting in October 1996, when IBM formed the Advanced Manageability Alliance (AMA) with Intel. In April 1997, this alliance adopted the Wake-on-LAN technology.
Contrary to most networking protocols, no formal Request for Comments (RFC) documents have been created for Wake-on-LAN, but nevertheless it remains a standard that is widely used in the industry.
Principle of operation Ethernet connections, including home and work networks, wireless data networks, and the Internet itself, are based on frames sent between computers. WoL is implemented using a specially designed frame called a magic packet, which is commonly sent to all computers in a network, among them the computer to be awakened. The magic packet contains the MAC address of the destination computer. This is an identifying number, built into each network interface controller (NIC), that enables the NIC to be uniquely recognized and addressed on a network. In computers capable of Wake-on-LAN, the NIC(s) listen to incoming packets, even when the rest of the system is powered down. If a magic packet arrives and is addressed to the device's MAC address, the NIC signals the computer's power supply or motherboard to awaken. This has the same effect as pressing the power button.
The magic packet is broadcast on the data link layer to all attached devices on a given network, using the network broadcast address; the IP address (which relates to the internet layer) is not used. Because Wake-on-LAN is built upon broadcast messaging, it can generally only be used within a subnet. Wake-on-LAN can, however, operate across any network in practice, given appropriate configuration and hardware, including remote wake-up across the Internet.
In order for Wake-on-LAN to work, parts of the network interface need to stay on. This consumes a small amount of standby power. To further reduce power consumption, the link speed is usually reduced to the lowest possible speed (e.g. a Gigabit Ethernet NIC maintains only a 10 Mbit/s link). Disabling Wake-on-LAN, when not needed, can slightly reduce power consumption on computers that are switched off but still plugged into a power socket. The power drain becomes a consideration on battery-powered devices such as laptops as this can deplete the battery even when the device is completely shut down.
Magic packet Magic Packet Protocol FrameFrame SpecificationsTotal Payload Size102 Bytes (Octets)Data Link LayerLayer 2 (OSI Model) broadcast frameCommon TransportUDP Ports 7 or 9 (Encapsulation)Network DestinationLimited Broadcast (255.255.255.255)Structural CompositionSync Prefix6 Bytes of continuous hex 0xFFTarget Block96 Bytes (Target MAC repeated 16 times)Optional Security Tail0, 4, or 6 Bytes password (SecureOn)Operational ContextHardware RequirementsNIC supporting Standby Power (5VSB)ACPI Power StatesS3 (Suspend), S4 (Hibernate), or S5 (Soft Off) The magic packet is a frame that is most often sent as a broadcast and that contains anywhere within its payload 6 bytes of all 255 (FF FF FF FF FF FF in hexadecimal), followed by sixteen repetitions of the target computer's 48-bit MAC address, for a total of 102 bytes.
Since the magic packet is only scanned for the string above, and not actually parsed by a full protocol stack, it could be sent as payload of any network- and transport-layer protocol, although it is typically sent as a UDP datagram to port 0 (reserved port number), 7 (Echo Protocol) or 9 (Discard Protocol), or directly over Ethernet using EtherType 0x0842. A connection-oriented transport-layer protocol like TCP is less suited for this task as it requires establishing an active connection before sending user data.
A standard magic packet has the following basic limitations: Requires destination computer MAC address (also may require a SecureOn password) Does not provide a delivery confirmation May not work outside of the local area network Requires hardware support for Wake-on-LAN in the destination computer Most 802.11 wireless interfaces do not maintain a link in low-power states and cannot receive a magic packet
The Wake-on-LAN implementation is designed to be simple and to be quickly processed by the circuitry present on the network interface controller using minimal power. Because Wake-on-LAN operates below the IP protocol layer, IP addresses and DNS names are meaningless and so the MAC address is required.
Subnet directed broadcasts A principal limitation of standard broadcast Wake-on-LAN is that broadcast packets are generally not routed. This prevents the technique being used in larger networks or over the Internet. Subnet-directed broadcasts (SDBs) may be used to overcome this limitation. SDB may require changes to the intermediate router configuration. SDBs are treated like unicast network packets until processed by the final (local) router. This router then broadcasts the packet using a layer-2 broadcast. This technique allows a broadcast to be initiated on a remote network but requires all intervening routers to forward the SDB. When preparing a network to forward SDB packets, care must be taken to filter packets so that only desired (e.g. WoL) SDB packets are permittedotherwise the network may become a participant in DDoS attacks such as the Smurf attack.
Troubleshooting magic packets Wake-on-LAN can be a difficult technology to implement because it requires appropriate BIOS/UEFI, network interface hardware and, sometimes, operating system and router support to function reliably. In some cases, hardware may wake from one low-power state but not from others. This means that due to hardware issues the computer may be wakeable from its soft off state (S5) but doesn't wake from sleep or hibernation or vice versa.
Security considerations
Unauthorized access Magic packets are sent via the data link or OSI-2 layer, which can be used or abused by anyone on the same LAN, unless the L2 LAN equipment is capable of and configured for filtering such traffic to match site-wide security requirements.
Firewalls may be used to prevent clients among the public WAN from accessing the broadcast addresses of inside LAN segments, or routers may be configured to ignore subnet-directed broadcasts.
Certain NICs support a security feature called "SecureOn". It allows users to store within the NIC a hexadecimal password of 6 bytes. Clients append this password to the magic packet. The NIC wakes the system only if the MAC address and password are correct.wol(1) - Linux man page This security measure significantly decreases the risk of successful brute force attacks, by increasing the search space by 48 bits (6 bytes), up to 296 combinations if the MAC address is entirely unknown. However, any network eavesdropping will expose the cleartext password.
Abuse of the Wake-on-LAN feature only allows computers to be switched on; it does not in itself bypass password and other forms of security, and is unable to power off the machine once on. However, many client computers attempt booting from a PXE server when powered up by WoL. Therefore, a combination of DHCP and PXE servers on the network can sometimes be used to start a computer with an attacker's boot image, bypassing any security of the installed operating system and granting access to unprotected, local disks over the network.
Interactions with network access control The use of Wake-on-LAN technology on enterprise networks can sometimes conflict with network access control solutions such as 802.1X MAC-based authentication, which may prevent magic packet delivery if a machine's WoL hardware has not been designed to maintain a live authentication session while in a sleep state.
Security Some PCs include technology built into the chipset to improve security for Wake-on-LAN. For example, Intel AMT (a component of Intel vPro technology). AMT uses TLS encryption to secure an out-of-band communication tunnel to an AMT-based PC for remote management commands such as Wake-on-LAN.
AMT secures the communication tunnel with Advanced Encryption Standard (AES) 128-bit encryption and RSA keys with modulus lengths of 2,048 bits. Because the encrypted communication is out-of-band, the PC's hardware and firmware receive the magic packet before network traffic reaches the software stack for the operating system (OS). Since the encrypted communication occurs below the OS level, it is less vulnerable to attacks by viruses, worms, and other threats that typically target the OS level.
IT shops using Wake-on-LAN through the Intel AMT implementation can wake an AMT PC over network environments that require TLS-based security, such as IEEE 802.1X, Cisco Self Defending Network (SDN), and Microsoft Network Access Protection (NAP) environments. The Intel implementation also works for Wireless networks.
Hardware requirements Wake-on-LAN support is implemented on the motherboard of a computer and in the network interface controller. It is consequently not dependent on the operating system running on the computer. In order to get Wake-on-LAN to work, enabling this feature on the network interface card or on-board silicon is sometimes required. Details of how to do this depend upon the operating system and the device driver.
Wake-on-LAN usually needs to be enabled in the Power Management section of a PC motherboard's BIOS/UEFI setup utility, although on some systems, such as Apple computers, it is enabled by default. On older systems the BIOS/UEFI setting may be referred to as WoL; on newer systems supporting PCI version 2.2, it may be referred to as PME (Power Management Events, which include WoL). It may also be necessary to configure the computer to reserve standby power for the network card when the system is shut down.
With older motherboards, if the network interface is a plug-in card rather than being integrated into the motherboard there may be a header onboard connected to the network card via a special three-pin cable the card. Systems supporting the PCI 2.2 standard and with a PCI 2.2 compliant network adapter card do not usually require a cable as the required standby power is relayed through the PCI bus. The power supply must meet ATX 2.01 specifications.