wpa_supplicant & winpcap & windows 2000

Jouni Malinen jkmaline at cc.hut.fi
Mon Nov 21 22:42:59 EST 2005

On Sun, Nov 20, 2005 at 06:56:13PM -0700, engage wrote:

> Attached is a 30 second capture using ethereal:

Thanks! This is getting somewhat confusing.. This capture file shows a
successfully completed WPA authentication and even successful DHCP
handshake after that. There is couple of extra EAPOL-Key frames after
the normal WPA pairwise and group handshakes, but it looks like AP is
just ignoring them and connection works after this..

However, the debug log from wpa_supplicant showed a quite a bit
different behavior. The different sizes for EAPOL-Key frames are likely
caused by them actually being different frames (msg 3/4 and group key
msg 1/2); not retransmission of msg 3/4 like I originally thought. In
other words, supplicant is not sending out msg 4/4 since 3/4 failed
validation. However, AP is assuming that the msg 4/4 was just dropped
and continues to group key handshake.

I don't know what would explain this different behavior, though. Have
you ever noticed network working in this configuration? Would it be
possible to get a debug log from wpa_supplicant and a matching Ethereal
capture log from the same attempt (and maybe just leave it running for
couple of minutes so that there are more than one failure)?

Jouni Malinen                                            PGP id EFC895FA

More information about the HostAP mailing list