Can I encapsulate IP inside EAPoL ?

Please be aware I am still doing the CCNP route so I don't know what EAPoL data looks like yet or how it works. I was more curious as to whether there are any attacks on port authentication? It seems like this is the only data that will traverse a switchport if it hasn't authenticated yet.