You are here: Elements > Decoder Script Reference > FRAME_AFTER_DECODING

FRAME_AFTER_DECODING

FRAME_AFTER_DECODING references a Frame Transformer method that processes a frame after it has been decoded. Such methods are seldom used but serve a purpose when the decoder for one layer in a protocol stack needs to mess with the frame to prepare it for the decoder at the next layer.

A subtlety of these methods is that if FRAME_AFTER_DECODING replaces a frame, then any NEXT_PROTOCOL_SIZE and NEXT_PROTOCOL_OFFSET methods are ignored and the entire replaced frame is passed to the next layer. The big subtlety here is that the transformation methods don't always transform; for instance, a stripper routine that doesn't find a 0x7d in the frame won't do anything to that frame, and then the NEXT_PROTOCOL_SIZE and _OFFSET will be used for those frames.

In the IP example above, there may be padding at the end of the frame, so we strip off any bytes after the stated size. Alternately, the payload may be split over multiple frames, and if so, and this frame has the last discovered fragment, then we assemble all the fragments and send the assembled frame to the next layer instead of the physical frame.