diff --git a/core/net/mac/contikimac/contikimac-framer.c b/core/net/mac/contikimac/contikimac-framer.c
new file mode 100644
index 000000000..86121df5e
--- /dev/null
+++ b/core/net/mac/contikimac/contikimac-framer.c
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2014, Fraunhofer Heinrich-Hertz-Institut.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+/**
+ * \file
+ *         Creates and parses the ContikiMAC header.
+ * \author
+ *         Konrad Krentz <konrad.krentz@gmail.com>
+ */
+
+#include "net/mac/contikimac/contikimac-framer.h"
+#include "net/packetbuf.h"
+#include "net/netstack.h"
+#include <string.h>
+
+#define CONTIKIMAC_ID 0x00
+
+/* SHORTEST_PACKET_SIZE is the shortest packet that ContikiMAC
+   allows. Packets have to be a certain size to be able to be detected
+   by two consecutive CCA checks, and here is where we define this
+   shortest size.
+   Padded packets will have the wrong ipv6 checksum unless CONTIKIMAC_HEADER
+   is used (on both sides) and the receiver will ignore them.
+   With no header, reduce to transmit a proper multicast RPL DIS. */
+#ifdef CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE
+#define SHORTEST_PACKET_SIZE CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE
+#else /* CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE */
+#define SHORTEST_PACKET_SIZE 43
+#endif /* CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE */
+
+#ifdef CONTIKIMAC_FRAMER_CONF_DECORATED_FRAMER
+#define DECORATED_FRAMER CONTIKIMAC_FRAMER_CONF_DECORATED_FRAMER
+#else /* CONTIKIMAC_FRAMER_CONF_DECORATED_FRAMER */
+#define DECORATED_FRAMER framer_802154
+#endif /* CONTIKIMAC_FRAMER_CONF_DECORATED_FRAMER */
+
+extern const struct framer DECORATED_FRAMER;
+
+#define DEBUG 0
+#if DEBUG
+#include <stdio.h>
+#define PRINTF(...) printf(__VA_ARGS__)
+#else
+#define PRINTF(...)
+#endif
+
+/* 2-byte header for recovering padded packets.
+   Wireshark will not understand such packets at present. */
+struct hdr {
+  uint8_t id;
+  uint8_t len;
+};
+
+/*---------------------------------------------------------------------------*/
+static int
+create(void)
+{
+  struct hdr *chdr;
+  int hdr_len;
+  
+  if(packetbuf_hdralloc(sizeof(struct hdr)) == 0) {
+    PRINTF("contikimac-framer: too large header\n");
+    return FRAMER_FAILED;
+  }
+  chdr = packetbuf_hdrptr();
+  chdr->id = CONTIKIMAC_ID;
+  chdr->len = 0;
+  
+  hdr_len = DECORATED_FRAMER.create();
+  if(hdr_len < 0) {
+    PRINTF("contikimac-framer: decorated framer failed\n");
+    return FRAMER_FAILED;
+  }
+  
+  return hdr_len + sizeof(struct hdr);
+}
+/*---------------------------------------------------------------------------*/
+static void
+pad(void)
+{
+  int transmit_len;
+  uint8_t *ptr;
+  uint8_t zeroes_count;
+  
+  transmit_len = packetbuf_totlen();
+  if(transmit_len < SHORTEST_PACKET_SIZE) {
+    /* Padding required */
+    zeroes_count = SHORTEST_PACKET_SIZE - transmit_len;
+    ptr = packetbuf_dataptr();
+    memset(ptr + packetbuf_datalen(), 0, zeroes_count);
+    packetbuf_set_datalen(packetbuf_datalen() + zeroes_count);
+  }
+}
+/*---------------------------------------------------------------------------*/
+static int
+create_and_secure(void)
+{
+  struct hdr *chdr;
+  int hdr_len;
+  
+  hdr_len = create();
+  if(hdr_len < 0) {
+    return FRAMER_FAILED;
+  }
+  
+  packetbuf_compact();
+  if(!NETSTACK_LLSEC.on_frame_created()) {
+    PRINTF("contikimac-framer: securing failed\n");
+    return FRAMER_FAILED;
+  }
+  
+  chdr = (struct hdr *)(((uint8_t *) packetbuf_dataptr()) - sizeof(struct hdr));
+  chdr->len = packetbuf_datalen();
+  pad();
+  
+  return hdr_len;
+}
+/*---------------------------------------------------------------------------*/
+static int
+parse(void)
+{
+  int hdr_len;
+  struct hdr *chdr;
+  
+  hdr_len = DECORATED_FRAMER.parse();
+  if(hdr_len < 0) {
+    return FRAMER_FAILED;
+  }
+  
+  chdr = packetbuf_dataptr();
+  if(chdr->id != CONTIKIMAC_ID) {
+    PRINTF("contikimac-framer: CONTIKIMAC_ID is missing\n");
+    return FRAMER_FAILED;
+  }
+  
+  if(!packetbuf_hdrreduce(sizeof(struct hdr))) {
+    PRINTF("contikimac-framer: packetbuf_hdrreduce failed\n");
+    return FRAMER_FAILED;
+  }
+  
+  packetbuf_set_datalen(chdr->len);
+  chdr->len = 0;
+  
+  return hdr_len + sizeof(struct hdr);
+}
+/*---------------------------------------------------------------------------*/
+const struct framer contikimac_framer = {
+  create,
+  create_and_secure,
+  parse
+};
+/*---------------------------------------------------------------------------*/
diff --git a/core/net/mac/contikimac/contikimac-framer.h b/core/net/mac/contikimac/contikimac-framer.h
new file mode 100644
index 000000000..5bc84f67f
--- /dev/null
+++ b/core/net/mac/contikimac/contikimac-framer.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2014, Fraunhofer Heinrich-Hertz-Institut.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+/**
+ * \file
+ *         Creates and parses the ContikiMAC header.
+ * \author
+ *         Konrad Krentz <konrad.krentz@gmail.com>
+ */
+
+#ifndef CONTIKIMAC_FRAMER_H_
+#define CONTIKIMAC_FRAMER_H_
+
+#include "net/mac/framer.h"
+
+extern const struct framer contikimac_framer;
+
+#endif /* CONTIKIMAC_FRAMER_H_ */
diff --git a/core/net/mac/contikimac/contikimac.c b/core/net/mac/contikimac/contikimac.c
index f5fcbacda..e46f51bff 100644
--- a/core/net/mac/contikimac/contikimac.c
+++ b/core/net/mac/contikimac/contikimac.c
@@ -61,13 +61,6 @@
 #else /* CONTIKIMAC_CONF_WITH_PHASE_OPTIMIZATION */
 #define WITH_PHASE_OPTIMIZATION      1
 #endif /* CONTIKIMAC_CONF_WITH_PHASE_OPTIMIZATION */
-/* Two byte header added to allow recovery of padded short packets */
-/* Wireshark will not understand such packets at present */
-#ifdef CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER
-#define WITH_CONTIKIMAC_HEADER       CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER
-#else
-#define WITH_CONTIKIMAC_HEADER       1
-#endif
 /* More aggressive radio sleeping when channel is busy with other traffic */
 #ifndef WITH_FAST_SLEEP
 #define WITH_FAST_SLEEP              1
@@ -90,15 +83,6 @@
 #define WITH_PHASE_OPTIMIZATION 0
 #endif
 
-#if WITH_CONTIKIMAC_HEADER
-#define CONTIKIMAC_ID 0x00
-
-struct hdr {
-  uint8_t id;
-  uint8_t len;
-};
-#endif /* WITH_CONTIKIMAC_HEADER */
-
 /* CYCLE_TIME for channel cca checks, in rtimer ticks. */
 #ifdef CONTIKIMAC_CONF_CYCLE_TIME
 #define CYCLE_TIME (CONTIKIMAC_CONF_CYCLE_TIME)
@@ -211,21 +195,6 @@ static int we_are_receiving_burst = 0;
    to a neighbor for which we have a phase lock. */
 #define MAX_PHASE_STROBE_TIME              RTIMER_ARCH_SECOND / 60
 
-
-/* SHORTEST_PACKET_SIZE is the shortest packet that ContikiMAC
-   allows. Packets have to be a certain size to be able to be detected
-   by two consecutive CCA checks, and here is where we define this
-   shortest size.
-   Padded packets will have the wrong ipv6 checksum unless CONTIKIMAC_HEADER
-   is used (on both sides) and the receiver will ignore them.
-   With no header, reduce to transmit a proper multicast RPL DIS. */
-#ifdef CONTIKIMAC_CONF_SHORTEST_PACKET_SIZE
-#define SHORTEST_PACKET_SIZE  CONTIKIMAC_CONF_SHORTEST_PACKET_SIZE
-#else
-#define SHORTEST_PACKET_SIZE               43
-#endif
-
-
 #define ACK_LEN 3
 
 #include <stdio.h>
@@ -528,7 +497,7 @@ send_packet(mac_callback_t mac_callback, void *mac_callback_ptr,
   rtimer_clock_t encounter_time = 0;
   int strobes;
   uint8_t got_strobe_ack = 0;
-  int hdrlen, len;
+  int len;
   uint8_t is_broadcast = 0;
   uint8_t is_reliable = 0;
   uint8_t is_known_receiver = 0;
@@ -537,10 +506,7 @@ send_packet(mac_callback_t mac_callback, void *mac_callback_ptr,
   int ret;
   uint8_t contikimac_was_on;
   uint8_t seqno;
-#if WITH_CONTIKIMAC_HEADER
-  struct hdr *chdr;
-#endif /* WITH_CONTIKIMAC_HEADER */
-
+  
   /* Exit if RDC and radio were explicitly turned off */
    if(!contikimac_is_on && !contikimac_keep_radio_on) {
     PRINTF("contikimac: radio is turned off\n");
@@ -583,63 +549,17 @@ send_packet(mac_callback_t mac_callback, void *mac_callback_ptr,
   is_reliable = packetbuf_attr(PACKETBUF_ATTR_RELIABLE) ||
     packetbuf_attr(PACKETBUF_ATTR_ERELIABLE);
 
-  packetbuf_set_attr(PACKETBUF_ATTR_MAC_ACK, 1);
-
-#if WITH_CONTIKIMAC_HEADER
-  hdrlen = packetbuf_totlen();
-  if(packetbuf_hdralloc(sizeof(struct hdr)) == 0) {
-    /* Failed to allocate space for contikimac header */
-    PRINTF("contikimac: send failed, too large header\n");
-    return MAC_TX_ERR_FATAL;
-  }
-  chdr = packetbuf_hdrptr();
-  chdr->id = CONTIKIMAC_ID;
-  chdr->len = hdrlen;
-  
-  /* Create the MAC header for the data packet. */
-  hdrlen = NETSTACK_FRAMER.create();
-  if(hdrlen < 0) {
-    /* Failed to send */
-    PRINTF("contikimac: send failed, too large header\n");
-    packetbuf_hdr_remove(sizeof(struct hdr));
-    return MAC_TX_ERR_FATAL;
-  }
-  hdrlen += sizeof(struct hdr);
-#else
-  /* Create the MAC header for the data packet. */
-  hdrlen = NETSTACK_FRAMER.create();
-  if(hdrlen < 0) {
-    /* Failed to send */
-    PRINTF("contikimac: send failed, too large header\n");
-    return MAC_TX_ERR_FATAL;
-  }
-#endif
-  packetbuf_compact();
-  
-  if(!NETSTACK_LLSEC.on_frame_created()) {
-    return MAC_TX_ERR_FATAL;
-  }
-  
-  /* Make sure that the packet is longer or equal to the shortest
-     packet length. */
-  transmit_len = packetbuf_totlen();
-  if(transmit_len < SHORTEST_PACKET_SIZE) {
-    /* Pad with zeroes */
-    uint8_t *ptr;
-    ptr = packetbuf_dataptr();
-    memset(ptr + packetbuf_datalen(), 0, SHORTEST_PACKET_SIZE - packetbuf_totlen());
-
-    PRINTF("contikimac: shorter than shortest (%d)\n", packetbuf_totlen());
-    transmit_len = SHORTEST_PACKET_SIZE;
+  if(!packetbuf_attr(PACKETBUF_ATTR_IS_CREATED_AND_SECURED)) {
+    packetbuf_set_attr(PACKETBUF_ATTR_MAC_ACK, 1);
+    if(NETSTACK_FRAMER.create_and_secure() < 0) {
+      PRINTF("contikimac: framer failed\n");
+      return MAC_TX_ERR_FATAL;
+    }
   }
   
   transmit_len = packetbuf_totlen();
-
   NETSTACK_RADIO.prepare(packetbuf_hdrptr(), transmit_len);
-
-  /* Remove the MAC-layer header since it will be recreated next time around. */
-  packetbuf_hdr_remove(hdrlen);
-
+  
   if(!is_broadcast && !is_receiver_awake) {
 #if WITH_PHASE_OPTIMIZATION
     ret = phase_wait(packetbuf_addr(PACKETBUF_ADDR_RECEIVER),
@@ -863,33 +783,55 @@ qsend_packet(mac_callback_t sent, void *ptr)
 static void
 qsend_list(mac_callback_t sent, void *ptr, struct rdc_buf_list *buf_list)
 {
-  struct rdc_buf_list *curr = buf_list;
+  struct rdc_buf_list *curr;
   struct rdc_buf_list *next;
   int ret;
   int is_receiver_awake;
   
-  if(curr == NULL) {
+  if(buf_list == NULL) {
     return;
   }
   /* Do not send during reception of a burst */
   if(we_are_receiving_burst) {
     /* Prepare the packetbuf for callback */
-    queuebuf_to_packetbuf(curr->buf);
+    queuebuf_to_packetbuf(buf_list->buf);
     /* Return COLLISION so the MAC may try again later */
     mac_call_sent_callback(sent, ptr, MAC_TX_COLLISION, 1);
     return;
   }
+  
+  /* Create and secure frames in advance */
+  curr = buf_list;
+  do {
+    next = list_item_next(curr);
+    queuebuf_to_packetbuf(curr->buf);
+    if(!packetbuf_attr(PACKETBUF_ATTR_IS_CREATED_AND_SECURED)) {
+      /* create and secure this frame */
+      if(next != NULL) {
+        packetbuf_set_attr(PACKETBUF_ATTR_PENDING, 1);
+      }
+      packetbuf_set_attr(PACKETBUF_ATTR_MAC_ACK, 1);
+      if(NETSTACK_FRAMER.create_and_secure() < 0) {
+        PRINTF("contikimac: framer failed\n");
+        mac_call_sent_callback(sent, ptr, MAC_TX_ERR_FATAL, 1);
+        return;
+      }
+      
+      packetbuf_set_attr(PACKETBUF_ATTR_IS_CREATED_AND_SECURED, 1);
+      queuebuf_update_from_packetbuf(curr->buf);
+    }
+    curr = next;
+  } while(next != NULL);
+  
   /* The receiver needs to be awoken before we send */
   is_receiver_awake = 0;
+  curr = buf_list;
   do { /* A loop sending a burst of packets from buf_list */
     next = list_item_next(curr);
 
     /* Prepare the packetbuf */
     queuebuf_to_packetbuf(curr->buf);
-    if(next != NULL) {
-      packetbuf_set_attr(PACKETBUF_ATTR_PENDING, 1);
-    }
-
+    
     /* Send the current packet */
     ret = send_packet(sent, ptr, curr, is_receiver_awake);
     if(ret != MAC_TX_DEFERRED) {
@@ -906,7 +848,7 @@ qsend_list(mac_callback_t sent, void *ptr, struct rdc_buf_list *buf_list)
       /* The transmission failed, we stop the burst */
       next = NULL;
     }
-  } while(next != NULL);
+  } while((next != NULL) && packetbuf_attr(PACKETBUF_ATTR_PENDING));
 }
 /*---------------------------------------------------------------------------*/
 /* Timer callback triggered when receiving a burst, after having
@@ -930,18 +872,6 @@ input_packet(void)
   /*  printf("cycle_start 0x%02x 0x%02x\n", cycle_start, cycle_start % CYCLE_TIME);*/
 
   if(packetbuf_totlen() > 0 && NETSTACK_FRAMER.parse() >= 0) {
-
-#if WITH_CONTIKIMAC_HEADER
-    struct hdr *chdr;
-    chdr = packetbuf_dataptr();
-    if(chdr->id != CONTIKIMAC_ID) {
-      PRINTF("contikimac: failed to parse hdr (%u)\n", packetbuf_totlen());
-      return;
-    }
-    packetbuf_hdrreduce(sizeof(struct hdr));
-    packetbuf_set_datalen(chdr->len);
-#endif /* WITH_CONTIKIMAC_HEADER */
-
     if(packetbuf_datalen() > 0 &&
        packetbuf_totlen() > 0 &&
        (linkaddr_cmp(packetbuf_addr(PACKETBUF_ADDR_RECEIVER),
@@ -952,6 +882,8 @@ input_packet(void)
          broadcast address. */
 
       /* If FRAME_PENDING is set, we are receiving a packets in a burst */
+      /* TODO To prevent denial-of-sleep attacks, the transceiver should
+         be disabled upon receipt of an unauthentic frame. */
       we_are_receiving_burst = packetbuf_attr(PACKETBUF_ATTR_PENDING);
       if(we_are_receiving_burst) {
         on();
diff --git a/core/net/mac/framer-802154.c b/core/net/mac/framer-802154.c
index 87bfc602a..f1da770a7 100644
--- a/core/net/mac/framer-802154.c
+++ b/core/net/mac/framer-802154.c
@@ -273,5 +273,9 @@ parse(void)
 }
 /*---------------------------------------------------------------------------*/
 const struct framer framer_802154 = {
-  hdr_length, create, parse
+  hdr_length,
+  create,
+  framer_canonical_create_and_secure,
+  parse
 };
+/*---------------------------------------------------------------------------*/
diff --git a/core/net/mac/framer-nullmac.c b/core/net/mac/framer-nullmac.c
index bec94eba5..6d53e3f8d 100644
--- a/core/net/mac/framer-nullmac.c
+++ b/core/net/mac/framer-nullmac.c
@@ -97,5 +97,8 @@ parse(void)
 }
 /*---------------------------------------------------------------------------*/
 const struct framer framer_nullmac = {
-  hdr_length, create, parse
+  hdr_length,
+  create,
+  framer_canonical_create_and_secure,
+  parse
 };
diff --git a/core/net/mac/framer.c b/core/net/mac/framer.c
new file mode 100644
index 000000000..fa7e9b4c1
--- /dev/null
+++ b/core/net/mac/framer.c
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2014, Fraunhofer Heinrich-Hertz-Institut.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include "net/mac/framer.h"
+#include "net/packetbuf.h"
+#include "net/netstack.h"
+
+/*---------------------------------------------------------------------------*/
+int
+framer_canonical_create_and_secure(void)
+{
+  int hdr_len;
+  
+  hdr_len = NETSTACK_FRAMER.create();
+  if(hdr_len >= 0) {
+    packetbuf_compact();
+    if(!NETSTACK_LLSEC.on_frame_created()) {
+      return FRAMER_FAILED;
+    }
+  }
+  return hdr_len;
+}
+/*---------------------------------------------------------------------------*/
\ No newline at end of file
diff --git a/core/net/mac/framer.h b/core/net/mac/framer.h
index 5ed419292..ce99aad1f 100644
--- a/core/net/mac/framer.h
+++ b/core/net/mac/framer.h
@@ -47,8 +47,13 @@ struct framer {
 
   int (* length)(void);
   int (* create)(void);
+  
+  /** Creates the frame and calls LLSEC.on_frame_created() */
+  int (* create_and_secure)(void);
   int (* parse)(void);
 
 };
 
+int framer_canonical_create_and_secure(void);
+
 #endif /* FRAMER_H_ */
diff --git a/core/net/mac/nullrdc.c b/core/net/mac/nullrdc.c
index 17f803701..7f92495e8 100644
--- a/core/net/mac/nullrdc.c
+++ b/core/net/mac/nullrdc.c
@@ -120,7 +120,7 @@ send_one_packet(mac_callback_t sent, void *ptr)
   packetbuf_set_attr(PACKETBUF_ATTR_MAC_ACK, 1);
 #endif /* NULLRDC_802154_AUTOACK || NULLRDC_802154_AUTOACK_HW */
 
-  if((NETSTACK_FRAMER.create() < 0) || !NETSTACK_LLSEC.on_frame_created()) {
+  if(NETSTACK_FRAMER.create_and_secure() < 0) {
     /* Failed to allocate space for headers */
     PRINTF("nullrdc: send failed, too large header\n");
     ret = MAC_TX_ERR_FATAL;
diff --git a/core/net/mac/phase.c b/core/net/mac/phase.c
index 9176061b7..ff20ae978 100644
--- a/core/net/mac/phase.c
+++ b/core/net/mac/phase.c
@@ -217,6 +217,7 @@ phase_wait(const linkaddr_t *neighbor, rtimer_clock_t cycle_time,
       p = memb_alloc(&queued_packets_memb);
       if(p != NULL) {
         if(buf_list == NULL) {
+          packetbuf_set_attr(PACKETBUF_ATTR_IS_CREATED_AND_SECURED, 1);
           p->q = queuebuf_new_from_packetbuf();
         }
         p->mac_callback = mac_callback;
diff --git a/core/net/packetbuf.h b/core/net/packetbuf.h
index 00d9fdefd..17abc5709 100644
--- a/core/net/packetbuf.h
+++ b/core/net/packetbuf.h
@@ -348,7 +348,8 @@ enum {
   PACKETBUF_ATTR_MAX_MAC_TRANSMISSIONS,
   PACKETBUF_ATTR_MAC_SEQNO,
   PACKETBUF_ATTR_MAC_ACK,
-
+  PACKETBUF_ATTR_IS_CREATED_AND_SECURED,
+  
   /* Scope 1 attributes: used between two neighbors only. */
   PACKETBUF_ATTR_RELIABLE,
   PACKETBUF_ATTR_PACKET_ID,
diff --git a/core/net/queuebuf.c b/core/net/queuebuf.c
index 8cb8708b3..8e5cb06f7 100644
--- a/core/net/queuebuf.c
+++ b/core/net/queuebuf.c
@@ -405,6 +405,19 @@ queuebuf_update_attr_from_packetbuf(struct queuebuf *buf)
 }
 /*---------------------------------------------------------------------------*/
 void
+queuebuf_update_from_packetbuf(struct queuebuf *buf)
+{
+  struct queuebuf_data *buframptr = queuebuf_load_to_ram(buf);
+  packetbuf_attr_copyto(buframptr->attrs, buframptr->addrs);
+  buframptr->len = packetbuf_copyto(buframptr->data);
+#if WITH_SWAP
+  if(buf->location == IN_CFS) {
+    queuebuf_flush_tmpdata();
+  }
+#endif
+}
+/*---------------------------------------------------------------------------*/
+void
 queuebuf_free(struct queuebuf *buf)
 {
   if(memb_inmemb(&bufmem, buf)) {
diff --git a/core/net/queuebuf.h b/core/net/queuebuf.h
index a1727342d..94fdb2105 100644
--- a/core/net/queuebuf.h
+++ b/core/net/queuebuf.h
@@ -96,6 +96,7 @@ struct queuebuf *queuebuf_new_from_packetbuf_debug(const char *file, int line);
 struct queuebuf *queuebuf_new_from_packetbuf(void);
 #endif /* QUEUEBUF_DEBUG */
 void queuebuf_update_attr_from_packetbuf(struct queuebuf *b);
+void queuebuf_update_from_packetbuf(struct queuebuf *b);
 
 void queuebuf_to_packetbuf(struct queuebuf *b);
 void queuebuf_free(struct queuebuf *b);
diff --git a/examples/ipv6/slip-radio/no-framer.c b/examples/ipv6/slip-radio/no-framer.c
index b6ca7d06a..e3aed93b7 100644
--- a/examples/ipv6/slip-radio/no-framer.c
+++ b/examples/ipv6/slip-radio/no-framer.c
@@ -123,5 +123,8 @@ parse(void)
 }
 /*---------------------------------------------------------------------------*/
 const struct framer no_framer = {
-  hdr_length, create, parse
+  hdr_length,
+  create,
+  framer_canonical_create_and_secure,
+  parse
 };
diff --git a/platform/avr-atmega128rfa1/contiki-conf.h b/platform/avr-atmega128rfa1/contiki-conf.h
index e8324b1a4..bb08df5a3 100644
--- a/platform/avr-atmega128rfa1/contiki-conf.h
+++ b/platform/avr-atmega128rfa1/contiki-conf.h
@@ -237,10 +237,8 @@ typedef unsigned short uip_stats_t;
 #define NETSTACK_CONF_RDC         contikimac_driver
 /* Default is two CCA separated by 500 usec */
 #define NETSTACK_CONF_RDC_CHANNEL_CHECK_RATE   8
-/* Wireshark won't decode with the header, but padded packets will fail ipv6 checksum */
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 /* So without the header this needed for RPL mesh to form */
-#define CONTIKIMAC_CONF_SHORTEST_PACKET_SIZE   43-18  //multicast RPL DIS length
+#define CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE   43-18  //multicast RPL DIS length
 /* Not tested much yet */
 #define WITH_PHASE_OPTIMIZATION                0
 #define CONTIKIMAC_CONF_COMPOWER               1
diff --git a/platform/avr-raven/contiki-conf.h b/platform/avr-raven/contiki-conf.h
index cff7988d7..c6ef38eba 100644
--- a/platform/avr-raven/contiki-conf.h
+++ b/platform/avr-raven/contiki-conf.h
@@ -253,10 +253,8 @@ typedef unsigned short uip_stats_t;
 #define NETSTACK_CONF_RDC         contikimac_driver
 /* Default is two CCA separated by 500 usec */
 #define NETSTACK_CONF_RDC_CHANNEL_CHECK_RATE   8
-/* Wireshark won't decode with the header, but padded packets will fail ipv6 checksum */
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 /* So without the header this needed for RPL mesh to form */
-#define CONTIKIMAC_CONF_SHORTEST_PACKET_SIZE   43-18  //multicast RPL DIS length
+#define CONTIKIMAC_FRAMER_CONF_SHORTEST_PACKET_SIZE   43-18  //multicast RPL DIS length
 /* Not tested much yet */
 #define WITH_PHASE_OPTIMIZATION                0
 #define CONTIKIMAC_CONF_COMPOWER               1
diff --git a/platform/cc2538dk/contiki-conf.h b/platform/cc2538dk/contiki-conf.h
index ecab2ecb8..141a62ce2 100644
--- a/platform/cc2538dk/contiki-conf.h
+++ b/platform/cc2538dk/contiki-conf.h
@@ -308,7 +308,6 @@ typedef uint32_t rtimer_clock_t;
 #define NULLRDC_802154_AUTOACK_HW               1
 
 /* Configure ContikiMAC for when it's selected */
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER  0
 #define CONTIKIMAC_CONF_WITH_PHASE_OPTIMIZATION 0
 #define WITH_FAST_SLEEP                         1
 
diff --git a/platform/exp5438/contiki-conf.h b/platform/exp5438/contiki-conf.h
index c03fccfdb..29901103a 100644
--- a/platform/exp5438/contiki-conf.h
+++ b/platform/exp5438/contiki-conf.h
@@ -44,7 +44,6 @@
    larger than a specified size, if no ContikiMAC header should be
    used. */
 #define SICSLOWPAN_CONF_COMPRESSION_THRESHOLD 63
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 
 #define CXMAC_CONF_ANNOUNCEMENTS         0
 #define XMAC_CONF_ANNOUNCEMENTS          0
diff --git a/platform/mbxxx/contiki-conf.h b/platform/mbxxx/contiki-conf.h
index c732fe8ac..e724450ac 100644
--- a/platform/mbxxx/contiki-conf.h
+++ b/platform/mbxxx/contiki-conf.h
@@ -125,7 +125,6 @@
    larger than a specified size, if no ContikiMAC header should be
    used. */
 #define SICSLOWPAN_CONF_COMPRESSION_THRESHOLD			63
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER			0
 
 #define UIP_CONF_UDP                				1
 
diff --git a/platform/seedeye/contiki-conf.h b/platform/seedeye/contiki-conf.h
index 9b04cbbc8..f0cce7acb 100644
--- a/platform/seedeye/contiki-conf.h
+++ b/platform/seedeye/contiki-conf.h
@@ -87,8 +87,6 @@ typedef uint32_t rtimer_clock_t;
 
 #define RDC_CONF_HARDWARE_CSMA                  1
 
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER  0
-
 #ifdef WITH_UIP6
 #define UIP_CONF_ROUTER                         1
 #ifndef UIP_CONF_IPV6_RPL
diff --git a/platform/sky/contiki-conf.h b/platform/sky/contiki-conf.h
index fa0e16a20..c99645898 100644
--- a/platform/sky/contiki-conf.h
+++ b/platform/sky/contiki-conf.h
@@ -48,7 +48,6 @@
    larger than a specified size, if no ContikiMAC header should be
    used. */
 #define SICSLOWPAN_CONF_COMPRESSION_THRESHOLD 63
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 
 #define CXMAC_CONF_ANNOUNCEMENTS         0
 #define XMAC_CONF_ANNOUNCEMENTS          0
diff --git a/platform/wismote/contiki-conf.h b/platform/wismote/contiki-conf.h
index 12b2396de..d37f8f3e6 100644
--- a/platform/wismote/contiki-conf.h
+++ b/platform/wismote/contiki-conf.h
@@ -42,7 +42,6 @@
    larger than a specified size, if no ContikiMAC header should be
    used. */
 #define SICSLOWPAN_CONF_COMPRESSION_THRESHOLD 63
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 
 #define CXMAC_CONF_ANNOUNCEMENTS         0
 #define XMAC_CONF_ANNOUNCEMENTS          0
diff --git a/platform/z1/contiki-conf.h b/platform/z1/contiki-conf.h
index c69ff7e40..4445b53f5 100644
--- a/platform/z1/contiki-conf.h
+++ b/platform/z1/contiki-conf.h
@@ -51,7 +51,6 @@
    larger than a specified size, if no ContikiMAC header should be
    used. */
 #define SICSLOWPAN_CONF_COMPRESSION_THRESHOLD 63
-#define CONTIKIMAC_CONF_WITH_CONTIKIMAC_HEADER 0
 
 #define CC2420_CONF_AUTOACK              1
 #define NETSTACK_RDC_CHANNEL_CHECK_RATE  8