Deep packets inspection to detect WOL I want to listen for WOL (Wake-On-LAN) packets. As WOL packets can be UDP/TCP/whatever (yes, even TCP, but probably useless), I have to check every incomming packets for the WOL specific pattern. This can't be done directly with netfilter because the pattern is 6xFF + 16xtarget-MAC-address (so we have 96 variable bytes). The tools I found can detect lots of protocols, but none are able to detect WOL. Do you know a simple way to inspect every packets and run a script when a specific pattern is detected?

With `ngrep`, you can do this:


ngrep '\xff{6}(.{6})\1{15}'


That matches 0xff 6 times, followed by any 6 bytes, followed by those same 6 bytes repeated 15 more times. I confirmed that matches a packet generated by `wakeonlan`.

`ngrep` has options that are useful for scripting (e.g., `-W single` to have a single line per matched packet, `-l` to defeat buffering, `-t` for timestamps, `-q` to silence other output).