EAPOL Packets after successful authentication and 4 way handshake
j at w1.fi
Sat Mar 3 00:46:17 EST 2007
On Fri, Mar 02, 2007 at 10:31:05PM +0530, ramprasad.rajendran at wipro.com wrote:
> I've observed very rarely, that I receive EAPOL packets seconds after a
> 4 way handshake is through.
> Is this ok ? What sort of packets can they be ?
How did you observe the packets? With a sniffer? Could you please send a
dump of such frames? What software was used in the AP/Authenticator and
It's difficult to say what these frames were without seeing the capture
log. Anyway, if 4-way handshake is completed, all data frames (including
EAPOL packets) should be sent encrypted. EAPOL packets can be sent after
this for things like rekeying, but still, they would be encrypted and
not very easily identifiable in capture logs.
Jouni Malinen PGP id EFC895FA
More information about the HostAP