May 12 20:26:25 wireguard python3[321848]: 2026-05-12 20:26:25,985 [ERROR] Failed to load watchlist: Expecting value: line 1 column 1 (char 0)

May 13 01:07:34 wireguard python3[321848]: 2026-05-13 01:07:34,366 [INFO] Shutting down wgctl-monitor

May 13 01:07:34 wireguard systemd[1]: Stopping wgctl-monitor.service - wgctl WireGuard Monitor Daemon...

May 13 01:07:34 wireguard systemd[1]: wgctl-monitor.service: Deactivated successfully.

May 13 01:07:34 wireguard systemd[1]: Stopped wgctl-monitor.service - wgctl WireGuard Monitor Daemon.

May 13 01:07:34 wireguard systemd[1]: wgctl-monitor.service: Consumed 2h 26min 17.579s CPU time.

May 13 01:07:34 wireguard systemd[1]: Started wgctl-monitor.service - wgctl WireGuard Monitor Daemon.

May 13 01:07:34 wireguard python3[943857]: 2026-05-13 01:07:34,655 [INFO] wgctl-monitor starting on interface eth0 port 51820

May 13 01:07:34 wireguard python3[943857]: 2026-05-13 01:07:34,655 [INFO] Watchlist loaded, starting packet capture...



 by kernel

root@wireguard:~# head -30 /etc/wireguard/.wgctl/daemon/wgctl-monitor.py | grep -i "interface\|port\|eth0\|51820"

import json

import logging

import os

import signal

import sys

import time

from datetime import datetime, timezone

from pathlib import Path

from scapy.all import IP, UDP, sniff

WG_INTERFACE   = os.environ.get("WG_INTERFACE", "eth0")

WG_PORT        = int(os.environ.get("WG_PORT", "51820"))



tcpdump -i eth0 -n port 51820 -c 5

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes

01:10:28.109998 IP 10.0.0.102.51820 > 148.69.193.47.15832: UDP, length 148

01:10:28.446972 IP 148.69.193.47.15832 > 10.0.0.102.51820: UDP, length 32

01:10:28.454855 IP 148.69.193.47.15832 > 10.0.0.102.51820: UDP, length 92

01:10:28.455014 IP 10.0.0.102.51820 > 148.69.193.47.15832: UDP, length 32

01:10:31.636211 IP 148.69.51.160.26606 > 10.0.0.102.51820: UDP, length 32

5 packets captured

5 packets received by filter