be used to overcome this limitation. SDB may require changes to intermediate router configuration. Subnet directed broadcasts are treated like unicast network packets until processed by the final (local) router. This router then broadcasts the packet using layer 2 broadcast. This technique allows a broadcast to be initiated on a remote network but requires all intervening routers to forward the SDB. When preparing a network to forward SDB packets, care must be taken to filter packets so that only desired (e.g. WoL) SDB packets are permittedotherwise the network may become a participant in DDoS attacks such as the Smurf attack. Troubleshooting magic packets Wake-on-LAN can be a difficult technology to implement, because it requires appropriate BIOS/UEFI, network card and, sometimes, operating system and router support to function reliably. In some cases, hardware may wake from one low power state but not from others. This means that due to hardware issues the computer may be waking up from the "soft off state" (S5) but doesn't wake from sleep or hibernation or vice versa. Also, it is not always clear what kind of magic packet a NIC expects to see. In that case, software tools like a packet analyzer can help with Wake-on-LAN troubleshooting as they allow confirming (while the PC is still on) that the magic packet is indeed visible to a particular computer's NIC. The same magic packet can then be used to find out if the computer powers up from an offline state. This allows networking issues to be isolated from other hardware issues. In some cases they also confirm that the packet was destined for a specific PC or sent to a broadcast address and they can additionally show the packet's internals. Starting with Windows Vista, the operating system logs all wake sources in the "System" event log. The Event Viewer and the powercfg.exe /lastwake command can retrieve them. Security considerations Unauthorized access Magic packets are sent via the data link or OSI-2 layer, which can be used or abused by anyone on the same LAN, unless the L2 LAN equipment is capable of (and configured for) filtering such traffic to match site-wide security requirements. Firewalls may be used to prevent clients among the public WAN from accessing the broadcast addresses of inside LAN segments, or routers may be configured to ignore subnet-directed broadcasts (see above). Certain NICs support a security feature called "SecureOn". It allows users to