Class Frame

EAPOL Key Frame - represents a complete EAPOL Key exchange message Used for WPA/WPA2/WPA3 4-way handshakes, group key handshakes, and Fast Transition (802.11r) operations.

Example

const frame = Frame.from(buffer);
console.log(`Message ${frame.messageNumber} of 4-way handshake`);
console.log(`Replay Counter: ${frame.replayCounter}`);
console.log(`Has MIC: ${frame.hasMic}`);

Constructors

`Protected`constructor

new Frame(options: FrameOptions): Frame
Parameters
- options: FrameOptions
Returns Frame

Accessors

descriptor

get descriptor(): Descriptor
Key Descriptor Type (identifies crypto suite: RC4, RSN, FT, etc.)

Returns Descriptor

encryptedKeyData

get encryptedKeyData(): Buffer
Encrypted Key Data (if isEncrypted flag is set)

Returns Buffer

error

get error(): ErrorKde | undefined
Error KDE - handshake error information

Returns ErrorKde | undefined

ft

get ft(): Partial<Ft> | undefined
Fast Transition Information Element (if present) - 802.11r FT params

Returns Partial<Ft> | undefined

gtk

get gtk(): GtkKde | undefined
GTK (Group Temporal Key) KDE - parsed group key for multicast/broadcast

Returns GtkKde | undefined

handshakeType

get handshakeType(): "unknown" | "four-way" | "group-key"
Identifies the type of key handshake
- 'four-way': Standard WPA/WPA2/WPA3 4-way handshake for PTK
- 'group-key': Group key handshake for GTK update
- 'unknown': Unable to determine type
Returns "unknown" | "four-way" | "group-key"

hasAck

get hasAck(): boolean
ACK flag - message is from authenticator (AP) to supplicant (STA)

Returns boolean

hasError

get hasError(): boolean
Error flag - indicates MIC failure or other error

Returns boolean

hasInstall

get hasInstall(): boolean
Install flag - indicates key should be installed

Returns boolean

hasMic

get hasMic(): boolean
MIC flag - MIC field is valid and should be checked

Returns boolean

ies

get ies(): Ie[]
Array of all parsed Information Elements (IEs)

Returns Ie[]

igtk

get igtk(): IgtkKde | undefined
IGTK (Integrity Group Temporal Key) KDE - parsed key for management frame protection

Returns IgtkKde | undefined

isEncrypted

get isEncrypted(): boolean
Encrypted Data flag - Key Data field is encrypted

Returns boolean

isMessage1

get isMessage1(): boolean
Message 1 of 4-way handshake AP → STA: ANonce, no MIC

Returns boolean

isMessage2

get isMessage2(): boolean
Message 2 of 4-way handshake STA → AP: SNonce, RSN IE, MIC (but not Secure)

Returns boolean

isMessage3

get isMessage3(): boolean
Message 3 of 4-way handshake AP → STA: ANonce, GTK, RSN IE, Install, MIC

Returns boolean

isMessage4

get isMessage4(): boolean
Message 4 of 4-way handshake STA → AP: MIC, Secure (confirms PTK installation)

Returns boolean

isPairwise

get isPairwise(): boolean
Key Type flag - true for pairwise (PTK), false for group (GTK)

Returns boolean

isRequest

get isRequest(): boolean
Request flag - supplicant requests new PTK/GTK

Returns boolean

isSecure

get isSecure(): boolean
Secure flag - indicates PTK installed and secure comms established

Returns boolean

isSmk

get isSmk(): boolean
SMK flag - Station-to-Station key message (TDLS)

Returns boolean

kdes

get kdes(): Kde[]
Array of all parsed Key Data Encapsulations (KDEs)

Returns Kde[]

keyId

get keyId(): Buffer
Key ID (8 bytes) - reserved field, usually zeros

Returns Buffer

keyIdKde

get keyIdKde(): KeyIdKde | undefined
Key ID KDE - generic key identifier

Returns KeyIdKde | undefined

keyInfo

get keyInfo(): KeyInfo
Key Information field - contains all key flags and properties

Returns KeyInfo

keyIv

get keyIv(): Buffer
Key IV (Initialization Vector) - 16 bytes, used for key encryption (mostly zeros in modern WPA)

Returns Buffer

keyLength

get keyLength(): number
Key Length (2 bytes) - length of pairwise key (16 for TKIP, 16/32 for AES)

Returns number

keyNonce

get keyNonce(): Buffer
Key Nonce (32 bytes) - ANonce (from AP) or SNonce (from STA)

Returns Buffer

keyRsc

get keyRsc(): Buffer
Key RSC (Receive Sequence Counter) - 8 bytes, used for replay detection

Returns Buffer

keyVersion

get keyVersion(): KeyVersion
Key Descriptor Version from KeyInfo (indicates MIC/encryption algorithm)

Returns KeyVersion

lifetime

get lifetime(): LifetimeKde | undefined
Lifetime KDE - key lifetime in seconds

Returns LifetimeKde | undefined

macAddr

get macAddr(): MacAddrKde | undefined
MAC Address KDE - peer MAC address (TDLS)

Returns MacAddrKde | undefined

mdid

get mdid(): Buffer
Mobility Domain ID (2 bytes) - shorthand accessor

Returns Buffer

messageNumber

get messageNumber(): 2 | 1 | 3 | 4 | undefined
Returns which message number (1-4) this frame represents in the 4-way handshake, or undefined if not part of 4-way handshake

Returns 2 | 1 | 3 | 4 | undefined

mic

get mic(): Buffer
MIC (Message Integrity Code) - 16 bytes, authenticates the frame

Returns Buffer

mobilityDomain

get mobilityDomain(): MobilityDomain | undefined
Mobility Domain IE (if present) - identifies FT roaming domain

Returns MobilityDomain | undefined

multibandGtk

get multibandGtk(): MultibandGtkKde | undefined
Multiband GTK KDE - group key for multi-band operation

Returns MultibandGtkKde | undefined

multibandKeyId

get multibandKeyId(): MultibandKeyIdKde | undefined
Multiband Key ID KDE - key identifier for multi-band operation

Returns MultibandKeyIdKde | undefined

nonce

get nonce(): NonceKde | undefined
Nonce KDE - additional nonce value

Returns NonceKde | undefined

pmkid

get pmkid(): PmkidKde | undefined
PMKID KDE - Pairwise Master Key Identifier for fast roaming

Returns PmkidKde | undefined

replayCounter

get replayCounter(): bigint
Replay Counter (8 bytes) - monotonically increasing counter for replay protection

Returns bigint

rsn

get rsn(): Rsn | undefined
RSN Information Element (if present) - WPA2/WPA3 security params

Returns Rsn | undefined

smk

get smk(): SmkKde | undefined
SMK KDE - Station-to-Station Master Key (TDLS)

Returns SmkKde | undefined

type

get type(): Type
EAPOL frame type (typically 0x03 for EAPOL-Key)

Returns Type

version

get version(): Version
EAPOL protocol version (0x01, 0x02, or 0x03)

Returns Version

wpa

get wpa(): Wpa | undefined
WPA Information Element (if present) - legacy WPA/TKIP params

Returns Wpa | undefined

zeroedFrame

get zeroedFrame(): Buffer
Copy of frame with MIC field zeroed out Used for MIC calculation/verification

Returns Buffer

Methods

isValidKeyDescriptorVersion

isValidKeyDescriptorVersion(): boolean
Returns boolean

validate

validate(): { errors: string[]; valid: boolean }
Validates the EAPOL Key Frame structure and content

Performs comprehensive validation including:
- EAPOL version and descriptor version compatibility
- Key Information flag consistency (per 802.11 spec)
- Message-specific requirements (Messages 1-4)
- Replay counter validation
- IE/KDE structure validation (RSN, WPA, IGTK, GTK, etc.)
- Nonce and MIC presence requirements
Returns { errors: string[]; valid: boolean }
Object containing validation status and list of errors
Example
```
const frame = Frame.from(buffer);
const result = frame.validate();

if (!result.valid) {
  console.error('Frame validation failed:');
  result.errors.forEach(err => console.error(`  - ${err}`));
}
```

`Static`from

from(
blob: string | Buffer<ArrayBufferLike>,
bufferEncoding?: BufferEncoding,
): Frame
Parses an EAPOL Key Frame from a buffer or hex string

This method handles complete EAPOL frames including
- EAPOL header (version, type, length)
- Key descriptor fields
- Key Information flags
- Nonces and MIC
- Key Data (RSN IE, WPA IE, KDEs, etc.)
The parser is resilient and will scan up to 512 bytes to find the EAPOL header if it's not at the start of the buffer (e.g., if preceded by 802.11 headers).
Parameters
- blob: string | Buffer<ArrayBufferLike>
  Buffer or hex string containing the EAPOL frame
- OptionalbufferEncoding: BufferEncoding
  Optional encoding if blob is a string (default: 'hex')
Returns Frame
Parsed Frame object
Throws
Error if blob does not contain a valid EAPOL Key Frame
Example
```
// From hex string
const frame = Frame.from('0203005f...', 'hex');

// From buffer
const frame = Frame.from(buffer);

// Check message type
if (frame.isMessage1) {
  console.log('ANonce:', frame.keyNonce.toString('hex'));
}
```

`Protected` `Static`parse_error_kde

parse_error_kde(body: Buffer): ErrorKde | undefined
Protected
Extract Error from KDE body
Parameters
- body: Buffer
Returns ErrorKde | undefined

`Protected` `Static`parse_ft_sub_elements

parse_ft_sub_elements(
    body: Buffer,
): {
    aNonce: Buffer;
    elements: Ie[];
    mic: Buffer;
    micControl: number;
    sNonce: Buffer;
}
Protected
Parses FT sub-elements
Parameters
- body: Buffer
Returns {
    aNonce: Buffer;
    elements: Ie[];
    mic: Buffer;
    micControl: number;
    sNonce: Buffer;
}

`Protected` `Static`parse_gtk_kde

parse_gtk_kde(body: Buffer): GtkKde | undefined
Protected
Extract GTK from KDE body
Parameters
- body: Buffer
Returns GtkKde | undefined

`Protected` `Static`parse_igtk_kde

parse_igtk_kde(body: Buffer): IgtkKde | undefined
Protected
Extract IGTK from KDE body
Parameters
- body: Buffer
Returns IgtkKde | undefined

`Protected` `Static`parse_key_id_kde

parse_key_id_kde(body: Buffer): KeyIdKde | undefined
Protected
Extract Key ID from KDE body
Parameters
- body: Buffer
Returns KeyIdKde | undefined

`Protected` `Static`parse_lifetime_kde

parse_lifetime_kde(body: Buffer): LifetimeKde | undefined
Protected
Extract Lifetime from KDE body
Parameters
- body: Buffer
Returns LifetimeKde | undefined

`Protected` `Static`parse_mac_addr_kde

parse_mac_addr_kde(body: Buffer): MacAddrKde | undefined
Protected
Extract MAC Address from KDE body
Parameters
- body: Buffer
Returns MacAddrKde | undefined

`Protected` `Static`parse_multiband_gtk_kde

parse_multiband_gtk_kde(body: Buffer): MultibandGtkKde | undefined
Protected
Extract Multiband GTK from KDE body
Parameters
- body: Buffer
Returns MultibandGtkKde | undefined

`Protected` `Static`parse_multiband_key_id_kde

parse_multiband_key_id_kde(body: Buffer): MultibandKeyIdKde | undefined
Protected
Extract Multiband Key ID from KDE body
Parameters
- body: Buffer
Returns MultibandKeyIdKde | undefined

`Protected` `Static`parse_nonce_kde

parse_nonce_kde(body: Buffer): NonceKde | undefined
Protected
Extract Nonce from KDE body
Parameters
- body: Buffer
Returns NonceKde | undefined

`Protected` `Static`parse_pmkid_kde

parse_pmkid_kde(body: Buffer): PmkidKde | undefined
Protected
Extract PMKID from KDE body
Parameters
- body: Buffer
Returns PmkidKde | undefined

`Protected` `Static`parse_rsn_capabilities

parse_rsn_capabilities(capabilities: number): RsnCapabilities
Protected
Parses out the RSN capabilities
Parameters
- capabilities: number
Returns RsnCapabilities

`Protected` `Static`parse_rsn_sub_elements

parse_rsn_sub_elements(body: Buffer): Rsn
Protected
Parses RSN sub-elements
Parameters
- body: Buffer
Returns Rsn

`Protected` `Static`parse_smk_kde

parse_smk_kde(body: Buffer): SmkKde | undefined
Protected
Extract SMK from KDE body
Parameters
- body: Buffer
Returns SmkKde | undefined

`Protected` `Static`parse_wpa_sub_elements

parse_wpa_sub_elements(body: Buffer): Wpa
Protected
Parses WPA sub-elements (legacy WPA/TKIP with Microsoft OUI)
Parameters
- body: Buffer
Returns Wpa

Class Frame

Example

Index

Constructors

Accessors

Methods

Constructors

Protectedconstructor

Parameters

Returns Frame

Accessors

descriptor

Returns Descriptor

encryptedKeyData

Returns Buffer

error

Returns ErrorKde | undefined

ft

Returns Partial<Ft> | undefined

gtk

Returns GtkKde | undefined

handshakeType

Returns "unknown" | "four-way" | "group-key"

hasAck

Returns boolean

hasError

Returns boolean

hasInstall

Returns boolean

hasMic

Returns boolean

ies

Returns Ie[]

igtk

Returns IgtkKde | undefined

isEncrypted

Returns boolean

isMessage1

Returns boolean

isMessage2

Returns boolean

isMessage3

Returns boolean

isMessage4

Returns boolean

isPairwise

Returns boolean

isRequest

Returns boolean

isSecure

Returns boolean

isSmk

Returns boolean

kdes

Returns Kde[]

keyId

Returns Buffer

keyIdKde

Returns KeyIdKde | undefined

keyInfo

Returns KeyInfo

keyIv

Returns Buffer

keyLength

Returns number

keyNonce

Returns Buffer

keyRsc

Returns Buffer

keyVersion

Returns KeyVersion

lifetime

Returns LifetimeKde | undefined

macAddr

Returns MacAddrKde | undefined

mdid

Returns Buffer

messageNumber

Returns 2 | 1 | 3 | 4 | undefined

mic

`Protected`constructor

`Static`from

`Protected` `Static`parse_error_kde

`Protected` `Static`parse_ft_sub_elements

Returns {
aNonce: Buffer;
elements: Ie[];
mic: Buffer;
micControl: number;
sNonce: Buffer;
}

`Protected` `Static`parse_gtk_kde

`Protected` `Static`parse_igtk_kde

`Protected` `Static`parse_key_id_kde

`Protected` `Static`parse_lifetime_kde

`Protected` `Static`parse_mac_addr_kde

`Protected` `Static`parse_multiband_gtk_kde

`Protected` `Static`parse_multiband_key_id_kde

`Protected` `Static`parse_nonce_kde

`Protected` `Static`parse_pmkid_kde

`Protected` `Static`parse_rsn_capabilities