WPA in use but frame sent in clear

[solenopsis]

I have an Asus Eee which connects to a Linksys WRT54GL AP running OpenWRT WR 0.9. They are set up to use WPA2/PSK.

I was monitoring the wireless transmissions, and when I looked at the frames later I was surprised to see that around the time when the Eee was authenticating with the WRT54GL, the Eee sent an ARP request in clear to the WRT54GL.

Has anyone else seen similar behaviour? I would expect *all* frames to be encrypted!

[Wifi-Guru]

All frames can not be encrypted, 802.11 management frames can never be encrypted, but an ARP should be.

If the ARP is coming from the client, then it is probably a bug in that driver that is allowing non EAP based packets to cross the WLAN before the auth is complete.

Also if you have a secure and an unsecure on the SAME LAN connection, ARP's and other broadcasts will come out of BOTH AP's and unless you are watching the BSSID's and the sender / receiver address they can be hard to tell apart.

~K

~K

[legalrights]

I have an Asus Eee which connects to a Linksys WRT54GL AP running OpenWRT White Russian 0.9. They are set up to use WPA2/PSK.

I was monitoring the wireless transmissions, and when I looked at the frames later I was surprised to see that close to the time when the Eee was authenticating with the WRT54GL, the Eee sent an ARP request that was not encrypted.

Has anyone else seen similar behaviour? I would expect *all* frames to be encrypted!