On Thu, Jan 05, 2017 at 06:08:32AM -0800, Ben Greear wrote: > I do not see any further EAPOL messages in the capture that I did. You are not looking carefully enough.. Based on the frame lengths, the frames 86 and 88 are most likely EAPOL-Key messages 1/2 and 2/2 from the group message exchange. They were encrypted here, so if you want to take a look at the payload, you'd need to decrypt the capture log first. > When is the group key handshake supposed to happen? Immediately after the initial 4-way handshake. (And then whenever the AP decides to rekey GTK.) -- Jouni Malinen PGP id EFC895FA _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
