Hi everyone, Tyler Franke here. Here’s an interesting issue I ran into the other day that you might want to be aware of:
Symptoms
When using WOL functionality in System Center Configuration Manager 2007 the port assignment and transmission method is not honored. Specifically, you'll likely notice that the WOL packets are sent to UDP port 12287 and that the destination address is an all broadcast (wire) address of 255.255.255.255.
- The following snippets demonstrate this behavior and is taken from a Netmon 3.4 capture and 3rd party WOL sniffer tool respectively:
Frame: Number = 3, Captured Frame Length = 144, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[FF-FF-FF-FF-FF-FF],SourceAddress:[00-11-5A-44-7B-03]
- Ipv4: Src = 192.168.1.10, Dest = 255.255.255.255, Next Protocol = UDP, Packet ID = 1983, Total IP Length = 130
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 130 (0x82)
Identification: 1983 (0x7BF)
+ FragmentFlags: 0 (0x0)
TimeToLive: 128 (0x80)
NextProtocol: UDP, 17(0x11)
Checksum: 28922 (0x70FA)
SourceAddress: 192.168.1.10
DestinationAddress: 255.255.255.255
+ Udp: SrcPort = 53117, DstPort = 12287, Length = 110
---------------------------Wake-On-LAN Magic Packet---------------------------
Time received:
UDP Header:
|-Source IP : 192.168.1.10
|-Destination IP : 255.255.255.255
|-Source Port : 53117
|-Destination Port : 12287
|-UDP Length : 110
|-UDP Checksum : 50613
MAC Address:
00 15 5D 42 7A 2B
Raw Data (102 bytes):
FF FF FF FF FF FF 00 15 5D 42 7A 2B 00 15 5D 42
7A 2B 00 15 5D 42 7A 2B 00 15 5D 42 7A 2B 00 15
5D 42 7A 2B 00 15 5D 42 7A 2B 00 15 5D 42 7A 2B
00 15 5D 42 7A 2B 00 15 5D 42 7A 2B 00 15 5D 42
7A 2B 00 15 5D 42 7A 2B 00 15 5D 42 7A 2B 00 15
5D 42 7A 2B 00 15 5D 42 7A 2B 00 15 5D 42 7A 2B
00 15 5D 42 7A 2B
Cause
This occurs if the third-party tools "SCCM Console Extensions" or "SCCM Right Click Tools" have been installed on the site server sending the WOL packets.
Resolution
In some cases it appears that the WOL settings defined in the site properties are still honored even if the third-party tools are installed, however in other situations and in testing the tools simply overwrite or take control and change the behavior, sending packets to UDP port 12287 and a broadcast destination (255.255.255.255) in lieu of what has been set in the site properties. With the tools installed this is easily reproduced by right clicking a collection and from the menu selecting "ConfigMgr Collection Tools" then "Wake on LAN".
With the tools installed it's important to ensure that you are testing WOL using an advertisement to identify whether or not the installed tools have overridden the site properties set for WOL.
More Information
The following represents a normal WOL packet transmission using subnet broadcast and unicast respectively.
- Normal subnet broadcast transmission of a WOL packet as sent by ConfigMgr:
Frame: Number = 3, Captured Frame Length = 144, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[FF-FF-FF-FF-FF-FF],SourceAddress:[00-15-5D-42-7A-36]
- Ipv4: Src = 192.168.1.10, Dest = 192.168.1.255, Next Protocol = UDP, Packet ID = 15355, Total IP Length = 130
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 130 (0x82)
Identification: 15355 (0x3BFB)
+ FragmentFlags: 0 (0x0)
TimeToLive: 128 (0x80)
NextProtocol: UDP, 17(0x11)
Checksum: 31254 (0x7A16)
SourceAddress: 192.168.1.10
DestinationAddress: 192.168.1.255
+ Udp: SrcPort = 54248, DstPort = Discard(9), Length = 110
---------------------------Wake-On-LAN Magic Packet---------------------------
Time received:
06/17/11 09:07:06
UDP Header:
|-Source IP : 192.168.1.10
|-Destination IP : 192.168.1.255
|-Source Port : 54248
|-Destination Port : 9
|-UDP Length : 110
|-UDP Checksum : 11705
MAC Address:
00 15 5D 42 7A 39
Raw Data (102 bytes):
FF FF FF FF FF FF 00 15 5D 42 7A 39 00 15 5D 42
7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15
5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39
00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42
7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15
5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39
00 15 5D 42 7A 39
- Normal unicast transmission of a WOL packet as sent by ConfigMgr:
Frame: Number = 155, Captured Frame Length = 144, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-15-5D-42-7A-39],SourceAddress:[00-15-5D-42-7A-36]
- Ipv4: Src = 192.168.1.10, Dest = 192.168.1.66, Next Protocol = UDP, Packet ID = 23977, Total IP Length = 130
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 130 (0x82)
Identification: 23977 (0x5DA9)
+ FragmentFlags: 0 (0x0)
TimeToLive: 128 (0x80)
NextProtocol: UDP, 17(0x11)
Checksum: 0 (0x0)
SourceAddress: 192.168.1.10
DestinationAddress: 192.168.1.66
+ Udp: SrcPort = 60028, DstPort = Discard(9), Length = 110
---------------------------Wake-On-LAN Magic Packet---------------------------
Time received:
06/17/11 09:53:37
UDP Header:
|-Source IP : 192.168.1.10
|-Destination IP : 192.168.1.66
|-Source Port : 60028
|-Destination Port : 9
|-UDP Length : 110
|-UDP Checksum : 6114
MAC Address:
00 15 5D 42 7A 39
Raw Data (102 bytes):
FF FF FF FF FF FF 00 15 5D 42 7A 39 00 15 5D 42
7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15
5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39
00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42
7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39 00 15
5D 42 7A 39 00 15 5D 42 7A 39 00 15 5D 42 7A 39
00 15 5D 42 7A 39
Hope this helps!
Tyler Franke | Senior Support Escalation Engineer
The App-V Team blog: http://blogs.technet.com/appv/
The WSUS Support Team blog: http://blogs.technet.com/sus/
The SCMDM Support Team blog: http://blogs.technet.com/mdm/
The ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
The SCOM 2007 Support Team blog: http://blogs.technet.com/operationsmgr/
The SCVMM Team blog: http://blogs.technet.com/scvmm/
The MED-V Team blog: http://blogs.technet.com/medv/
The DPM Team blog: http://blogs.technet.com/dpm/
The OOB Support Team blog: http://blogs.technet.com/oob/
The Opalis Team blog: http://blogs.technet.com/opalis
The Service Manager Team blog: http: http://blogs.technet.com/b/servicemanager
The AVIcode Team blog: http: http://blogs.technet.com/b/avicode
The System Center Essentials Team blog: http: http://blogs.technet.com/b/systemcenteressentials
The Server App-V Team blog: http: http://blogs.technet.com/b/serverappv
