EAPOL Packets after successful authentication and 4 way handshake

[Jouni Malinen]

On Fri, Mar 02, 2007 at 10:31:05PM +0530, ramprasad.rajendran at wipro.com wrote:

> I've observed very rarely, that I receive EAPOL packets seconds after a
> 4 way handshake is through.
> Is this ok ? What sort of packets can they be ?

How did you observe the packets? With a sniffer? Could you please send a
dump of such frames? What software was used in the AP/Authenticator and
client/Supplicant?

It's difficult to say what these frames were without seeing the capture
log. Anyway, if 4-way handshake is completed, all data frames (including
EAPOL packets) should be sent encrypted. EAPOL packets can be sent after
this for things like rekeying, but still, they would be encrypted and
not very easily identifiable in capture logs.

-- 
Jouni Malinen                                            PGP id EFC895FA