Protocol Version Ver

Encryption 1 octet EAPOL header unverified

Which revision of 802.1X the sender implements.

Reading a capture

Commonly 1 or 2 in the wild even on current equipment, because a receiver must accept a version it does not recognise and carry on. Not a reliable indicator of anything.

Where it sits

EAPOL PDU > Protocol Version

Open in the explorer — Four-way handshake message 1
Open in the explorer — Four-way handshake message 2
Open in the explorer — Four-way handshake message 3
Open in the explorer — Four-way handshake message 4

Accuracy

Clause: IEEE 802.1X-2020 §11.3.1
Verified: Not verified against the standard. Treat this as a claim, not a fact.