[Renato Accornero <renato.accornero@xxxxxxxxx>]

Hello,
       we are working with a CAP file wich contains beacons sent by AP, probe request, probe response, authentication, association messages and the 4 handshake EAPOL messages. We are using WPA2. The problem is that we are not able to find detailed references about the field Frame Body in the MAC frames. Wireshark expands correctly and expanded contents vary if we have a beacon, we have association messages, we have EAPOL messages etc. So, Wireshark developers know where to find information we search. In the handshake, four EAPOL messages are involved. At their beginning, there are the following fields:
-Version : 1
-Type : key (3)
-Length 95
-Descriptor Type : EAPOL WPA KEY (254)

 We found some documentation, but only the case descriptor type==1 was discussed.
Can you help us?

Thank you in advance,
Renato