Frame Transformers

Sometimes data is not in a form that is convenient for a decoder to work with. It could be encrypted for example. The protocol analyzer therefore allows you to provide a method that each frame is fed through to prepare it for the decoder. Such a method is called a Frame Transformer.

Typical uses for Frame Transformers are:

• To remove escape characters or undo byte stuffing
• To decrypt encrypted data
• To decompress compressed data
• To clean up the data so that it is in suitable condition for CRC/checksum verification

In practice, a Frame Transformer can do any job you find necessary or useful. You could even write a Frame Transformer to make one protocol (which you do not have a decoder for) look like another (which you do have a decoder for).

Note that when decoding a protocol stack, a frame could be fed through multiple transformers; each layer may have its own reasons for transforming the data. Most commonly, however, data-link layers use Frame Transformers.

A Frame Transformer is a method that performs transformations on a frame before or after it is decoded. Most commonly, Frame Transformers are used for such purposes as decrypting data that has been encrypted, decompressing data that has been compressed, undoing byte stuffing, and generally reverting data from a form that it was put in for transmission purposes. You may, however, use Frame Transformers for any purpose you see fit. Here are a couple of examples of how Frame Transformers are used in creative ways:

• The decoder for Van Jacobson Uncompressed headers (vju.dec) changes one byte so that the frame then looks like an IP frame.
• The decoder for Van Jacobson Compressed headers (vjc.dec) throws away the first several bytes and replaces them with a 40-byte constructed TCP/IP header.

Captured data is normally framed (i.e. passed through a Frame Recognizer) exactly once. Frame transformation, on the other hand, is done every time a frame is decoded. Indeed, it is quite possible for a frame to be transformed several times as it is passed through various decoders.

The term "Frame Transformer" may be a little misleading. When you write a Frame Transformer, the data that you have to work with is strictly the data in your own protocol layer. A Frame Transformer cannot "see" any data beyond the boundaries of that layer ‐ indeed no method can. Nevertheless, while the view of it is restricted, the entire frame is actually kept through the full decoding process. It is therefore appropriate to say that a transformer does affect the frame as a whole.