diff --git a/doc/main.conf b/doc/main.conf
index 6bec4049..0bb2f92d 100644
--- a/doc/main.conf
+++ b/doc/main.conf
@@ -6,6 +6,18 @@ mtu=1400
 
 [EAPoL]
 max_4way_handshake_time=5
+#
+# Enable/Disable sending EAPoL packets over NL80211.  Enabled by default if
+# kernel support is available.  Doing so sends all EAPoL traffic over directly
+# to the supplicant process (iwd) instead of putting these on the Ethernet
+# device.  Since only the supplicant can usually make sense / decrypt these
+# packets, enabling this option can save some CPU cycles on your system and
+# avoids certain long-standing race conditions.
+#
+# Note, iwmon cannot currently spy on unicast packets sent over netlink, so
+# if you need to capture EAPoL packets (e.g. for debugging) then this option
+# should be set to False.
+ControlPortOverNL80211=True
 
 [Scan]
 #