> AP-no-delay-client-HW-crypt.cap.gz > same as above, only cleint using HW crypto > You can e.g. find the "corrupted" looking frames with the wireshark filter > "(wlan.fc.type_subtype == 0x0028) && !(llc.dsap == 0xaa)" For everyone else - make sure to set "ignore protected bit - with IV" in wireshark. > Each capture here only has exactly one, the very first packet using the > new key. Yeah. Note that this packet is really quickly after the EAPOL 4/4 (1.5ms) so perhaps the key wasn't installed yet or something? Hmm, then again, it should be before we send the confirmation? But I don't know. The tracing would definitely tell me what's going on. Btw, if you do record such tracing, it helps if you compile wpa_supplicant with CONFIG_DEBUG_LINUX_TRACING and start it with the -T argument to record all of its debugging into the trace file as well. johannes
