diff --git a/monitor/nlmon.c b/monitor/nlmon.c
index 229e18fd..58387603 100644
--- a/monitor/nlmon.c
+++ b/monitor/nlmon.c
@@ -4735,7 +4735,7 @@ void nlmon_print_pae(struct nlmon *nlmon, const struct timeval *tv,
 	if (!ek)
 		return;
 
-	switch (ek->protocol_version) {
+	switch (ek->header.protocol_version) {
 	case 0x01:
 		str = "802.11X-2001";
 		break;
@@ -4747,9 +4747,9 @@ void nlmon_print_pae(struct nlmon *nlmon, const struct timeval *tv,
 		break;
 	}
 
-	print_attr(1, "Version: %u (%s)", ek->protocol_version, str);
+	print_attr(1, "Version: %u (%s)", ek->header.protocol_version, str);
 
-	switch (ek->packet_type) {
+	switch (ek->header.packet_type) {
 	case 0x00:
 		str = "Packet";
 		break;
@@ -4767,8 +4767,8 @@ void nlmon_print_pae(struct nlmon *nlmon, const struct timeval *tv,
 		break;
 	}
 
-	print_attr(1, "Type: %u (%s)", ek->packet_type, str);
-	print_attr(1, "Length: %d", L_BE16_TO_CPU(ek->packet_len));
+	print_attr(1, "Type: %u (%s)", ek->header.packet_type, str);
+	print_attr(1, "Length: %d", L_BE16_TO_CPU(ek->header.packet_len));
 	print_attr(1, "Descriptor Type: %u", ek->descriptor_type);
 	print_attr(1, "Key MIC: %s", ek->key_mic ? "true" : "false");
 	print_attr(1, "Secure: %s", ek->secure ? "true" : "false");
diff --git a/src/eapol.c b/src/eapol.c
index f24671bc..deaf729f 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -202,11 +202,12 @@ const struct eapol_key *eapol_key_validate(const uint8_t *frame, size_t len)
 
 	ek = (const struct eapol_key *) frame;
 
-	if (ek->protocol_version != EAPOL_PROTOCOL_VERSION_2001 &&
-			ek->protocol_version != EAPOL_PROTOCOL_VERSION_2004)
+	if (ek->header.protocol_version != EAPOL_PROTOCOL_VERSION_2001 &&
+			ek->header.protocol_version !=
+			EAPOL_PROTOCOL_VERSION_2004)
 		return NULL;
 
-	if (ek->packet_type != 3)
+	if (ek->header.packet_type != 3)
 		return NULL;
 
 	switch (ek->descriptor_type) {
@@ -501,9 +502,9 @@ static struct eapol_key *eapol_create_common(
 
 	memset(out_frame, 0, to_alloc + extra_len);
 
-	out_frame->protocol_version = protocol;
-	out_frame->packet_type = 0x3;
-	out_frame->packet_len = L_CPU_TO_BE16(to_alloc + extra_len - 4);
+	out_frame->header.protocol_version = protocol;
+	out_frame->header.packet_type = 0x3;
+	out_frame->header.packet_len = L_CPU_TO_BE16(to_alloc + extra_len - 4);
 	out_frame->descriptor_type = is_wpa ? EAPOL_DESCRIPTOR_TYPE_WPA :
 		EAPOL_DESCRIPTOR_TYPE_80211;
 	out_frame->key_descriptor_version = version;
@@ -813,7 +814,8 @@ static void eapol_handle_ptk_1_of_4(uint32_t ifindex, struct eapol_sm *sm,
 	}
 
 	memcpy(step2->key_mic_data, mic, sizeof(mic));
-	tx_packet(ifindex, sm->aa, sm->spa, step2, user_data);
+	tx_packet(ifindex, sm->aa, sm->spa,
+			(struct eapol_frame *) step2, user_data);
 	l_free(step2);
 
 	l_timeout_remove(sm->timeout);
@@ -1139,7 +1141,8 @@ static void eapol_handle_ptk_3_of_4(uint32_t ifindex,
 		goto fail;
 
 	memcpy(step4->key_mic_data, mic, sizeof(mic));
-	tx_packet(ifindex, sm->aa, sm->spa, step4, user_data);
+	tx_packet(ifindex, sm->aa, sm->spa,
+			(struct eapol_frame *) step4, user_data);
 
 	sm->ptk_complete = true;
 
@@ -1218,7 +1221,8 @@ static void eapol_handle_gtk_1_of_2(uint32_t ifindex,
 		goto done;
 
 	memcpy(step2->key_mic_data, mic, sizeof(mic));
-	tx_packet(ifindex, sm->aa, sm->spa, step2, user_data);
+	tx_packet(ifindex, sm->aa, sm->spa,
+			(struct eapol_frame *) step2, user_data);
 
 	if (install_gtk) {
 		uint32_t cipher =
@@ -1432,7 +1436,7 @@ struct l_io *eapol_open_pae(uint32_t index)
  * This function expects an fd to be passed as user_data
  */
 static int eapol_write(uint32_t ifindex, const uint8_t *aa, const uint8_t *spa,
-			const struct eapol_key *ek, void *user_data)
+			const struct eapol_frame *ef, void *user_data)
 {
 	int fd = L_PTR_TO_INT(user_data);
 	size_t frame_size;
@@ -1446,9 +1450,10 @@ static int eapol_write(uint32_t ifindex, const uint8_t *aa, const uint8_t *spa,
 	sll.sll_halen = ETH_ALEN;
 	memcpy(sll.sll_addr, aa, ETH_ALEN);
 
-	frame_size = sizeof(struct eapol_key) + L_BE16_TO_CPU(ek->key_data_len);
+	frame_size = sizeof(struct eapol_header) +
+			L_BE16_TO_CPU(ef->header.packet_len);
 
-	r = sendto(fd, ek, frame_size, 0,
+	r = sendto(fd, ef, frame_size, 0,
 			(struct sockaddr *) &sll, sizeof(sll));
 	if (r < 0) {
 		l_error("EAPoL write socket: %s", strerror(errno));
diff --git a/src/eapol.h b/src/eapol.h
index d96b4855..c9bf3c05 100644
--- a/src/eapol.h
+++ b/src/eapol.h
@@ -49,10 +49,19 @@ enum eapol_key_descriptor_version {
 
 struct eapol_sm;
 
-struct eapol_key {
+struct eapol_header {
 	uint8_t protocol_version;
 	uint8_t packet_type;
 	__be16 packet_len;
+} __attribute__ ((packed));
+
+struct eapol_frame {
+	struct eapol_header header;
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+struct eapol_key {
+	struct eapol_header header;
 	uint8_t descriptor_type;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
 	bool key_mic:1;
@@ -96,7 +105,8 @@ struct eapol_key {
 } __attribute__ ((packed));
 
 typedef int (*eapol_tx_packet_func_t)(uint32_t ifindex, const uint8_t *aa,
-				const uint8_t *spa, const struct eapol_key *ek,
+				const uint8_t *spa,
+				const struct eapol_frame *ef,
 				void *user_data);
 typedef bool (*eapol_get_nonce_func_t)(uint8_t nonce[]);
 typedef void (*eapol_install_tk_func_t)(uint32_t ifindex, const uint8_t *aa,
diff --git a/unit/test-eapol.c b/unit/test-eapol.c
index 455f7be6..64675c63 100644
--- a/unit/test-eapol.c
+++ b/unit/test-eapol.c
@@ -1177,9 +1177,9 @@ static void eapol_key_test(const void *data)
 	packet = eapol_key_validate(test->frame, test->frame_len);
 	assert(packet);
 
-	assert(packet->protocol_version == test->protocol_version);
-	assert(packet->packet_type == 0x03);
-	assert(L_BE16_TO_CPU(packet->packet_len) == test->packet_len);
+	assert(packet->header.protocol_version == test->protocol_version);
+	assert(packet->header.packet_type == 0x03);
+	assert(L_BE16_TO_CPU(packet->header.packet_len) == test->packet_len);
 	assert(packet->descriptor_type == test->descriptor_type);
 	assert(packet->key_descriptor_version == test->key_descriptor_version);
 	assert(packet->key_type == test->key_type);
@@ -1640,9 +1640,9 @@ static void eapol_wpa_handshake_test(const void *data)
 
 static int verify_step2(uint32_t ifindex, const uint8_t *aa_addr,
 			const uint8_t *sta_addr,
-			const struct eapol_key *ek,
-			void *user_data)
+			const struct eapol_frame *ef, void *user_data)
 {
+	const struct eapol_key *ek = (const struct eapol_key *) ef;
 	size_t ek_len = sizeof(struct eapol_key) +
 				L_BE16_TO_CPU(ek->key_data_len);
 
@@ -1659,9 +1659,9 @@ static int verify_step2(uint32_t ifindex, const uint8_t *aa_addr,
 
 static int verify_step4(uint32_t ifindex, const uint8_t *aa_addr,
 			const uint8_t *sta_addr,
-			const struct eapol_key *ek,
-			void *user_data)
+			const struct eapol_frame *ef, void *user_data)
 {
+	const struct eapol_key *ek = (const struct eapol_key *) ef;
 	size_t ek_len = sizeof(struct eapol_key) +
 				L_BE16_TO_CPU(ek->key_data_len);
 
@@ -1678,9 +1678,9 @@ static int verify_step4(uint32_t ifindex, const uint8_t *aa_addr,
 
 static int verify_step2_gtk(uint32_t ifindex, const uint8_t *aa_addr,
 				const uint8_t *sta_addr,
-				const struct eapol_key *ek,
-				void *user_data)
+				const struct eapol_frame *ef, void *user_data)
 {
+	const struct eapol_key *ek = (const struct eapol_key *) ef;
 	size_t ek_len = sizeof(struct eapol_key) +
 				L_BE16_TO_CPU(ek->key_data_len);