I have a special case, which I cant really understand.
Notebook with Intel 8260ac module. Driverpackage is 18.30
At each association with any Access-Point (initial connection or roaming) I see many frames with following information:
Receiver Address (RA) = Client MAC
Destination Address (DA) = Client MAC
Transmitter Address (TA) = Client MAC
STA adress = Client MAC
BSSID = Client MAC
Type = Data 0x0020
ToDS = 1, FromDS = 0
Frame length: 8 times 210 byte, followed by single 4050 and single 850 byte
Frames are captured on that channel, the clients then connects to. I tested all channels and I can see these frames than on each channel in 2,4 and 5 GHz (ETSI domain). Frames are transmitted right before Authentication/Association with the AP and during 802.1x authentication.
Any ideas? missbehavior?