Wake On LAN

[hemi0539]

I need help, and i've searched over the internet and forums in the past few days, no luck. I have a PC with Vista x86 that i use as a file server and run TVersity on it for my uPNP for my xbox on my home network. For years i've always left it on 24 hours a day, but now i moved it downstairs in my closet and i can hear it now, i would like for it to sleep if there is no network activity.

What i want it to do is go to sleep after x minutes and if another pc on my network accesses a file off that share drive or the xbox kicks on via upnp, i want the computer to wake up. Below is what i have set up:

BIOS set to S3, Realtek 8169 NIC shows "allow this device to wake up this computer", but no other Wake on Lan in the advanced settings of the NIC. I read somewhere to disable the mouse and keyboard wake on sleep.

My issue is after i put it to sleep, it wakes up in about 30 seconds. I ran wireshark with nothing running (that i know of) and get ARP broadcast(s) & UDP, i have u-verse and wondering if IGMP snooping and/ or mulitcast is waking up the pc abruptly.

Is there anyway to tell what is waking up the pc from the lan? I checked the event viewer and didnt find anything, it just shows it woke up. I tried a WOL Sniffer, but the program crashed when its launched.

Since i just use this PC for file sharing and sharing media (via uPNP), would it be possible to block all traffic except for "Internal LAN" traffic? and if so, then how can i do it?

I've tried FreeNAS as an alternate, but i couldnt get it to sleep and the uPNP software is flaky.

I know i can just live with the noise of the fans, but i think i've gotten pretty close to figure out what make the WOL come on and how to prevent it.

Thanks,

 

[Slammer]

I don't know a whole lot about this, but I can help a little. Is it turning back on after the exact same time period every time? If it's pretty close to the same time interval every time, it's probably some bug in the program rather than someone accessing it.

Download Malwarebytes ( Malwarebytes : Free anti-malware, anti-virus and spyware removal download ) let it update, and run a full scan. That program should pick and malware that may be on your computer causing problems. It's a little unlikely, but best to cover all our bases anyway.

As for only allowing internet LAN, can you just turn off your wireless card on the computer? (I'm assuming that's what you mean; correct me if I'm wrong )

 

[hemi0539]

Well after it goes to sleep, it wakes up randomly between 5 seconds and i had it up to about 30 seconds before it woke backup. It would be great if something in the system can log what traffic across that interface is causing it to wake up.

I tried that Malware program and it didn't find anything. But earlier today, i have a similar computer in my office that has Win 7 with the same Realtek Gigabit adapter and it also woke up a few seconds after it went to sleep.

For my network, i have 2 laptops via WiFi, 2 hard wired desktop computers (both gigabit), and 7 Uverse STB's via Ethernet.

My feeling is that something across the network is waking up the computer in question (tower pc with hard wired ethernet...), i did see some broadcast chatter when i ran Wireshark, (who has 192.168.x.x.., etc) and i turned off promiscuous mode as that really ran alot of chatter in a few seconds.

What i was thinking if there was a way to prevent that NIC to see that chatter, and/ or block HTTP traffic (in the event something is trying to update)?

I'm not sure if this is the intentions of putting a PC to sleep and using the NIC to wake up the PC. I did some reading today on WOL and found about a Magic Packet used to wake it up, but i would like any device on my network that accesses to wake it up from sleep without initiating the Magic Packet. I also read somewhere that Win XP Media Ctr did this pretty good.

 

[Slammer]

Ok, I'm not as familiar with networking as I'd like to be, so I may be a bit under-qualified to really help here. But if you think you're getting traffic on the network that's waking your computer, can you disconnect the rest of your devices from your network and see if it still happens? If you think it's activity coming directly from the internet, whatever firewall you're using should have the ability to block specific ports. Have it block port 80 to stop the majority of http connections. (it may stop all of them this way, but I vaguely remember reading somewhere that sometimes http can come through other ports, so not entirely sure there; either way, blocking port 80 will likely solve your problems if http is what's causing problems)

Let me know if this stuff I'm saying is even relevant