[Guy Harris <guy@xxxxxxxxxxxx>]

On Sun, Jan 25, 2004 at 05:43:52PM -0800, mmmgrrrl wrote:
>          However, I'm curious about why ethereal indicates that the group
>          key eapol sent from my AP to my pc is MALFORMED. 

It does so because it interprets a WPA key as 802.11 tagged parameters,
which means they have to be in the form

	1-byte tag number
	1-byte tag length
	N-byte tag value, where N is the tag length

and, with that interpretation of the data in the key, that's a tag
number of 0x89, which is 137, and a tag length of 0xD4, which is 212,
but there aren't 212 bytes of data in the packet.

Either

	1) that WPA key *shouldn't* be interpreted as 802.11 tagged
	   parameters;

	2) some tagged parameters don't start with a 1-byte tag number
	   and 1-byte tag length;

	3) that data isn't a WPA key (perhaps the offset in the packet
	   is wrong when it dissects the WPA key).