Your frame-based site contains an outer frame
http://outer.example.com/
which contains an inner frame containing a page from:
http://inner.example.com/
with the snippet installed on inner.example.com, and the "source" URL parameters are on outer.example.com.
The sourced landings on outer.example.com are not being tracked at all.
The way that JavaScript and browsers work is that code JavaScript on one domain name (such a the URL in the browser, the page information, etc.) is not accessible from another domain name for security reasons.
It prevents someone from creating a web site which has an outer frame (yours) and an inner frame of a bank (theirs) and letting your outer frame access the details on the bank's pages.
Trust us, it's a good thing.
The reverse is also true - the snippet code on "inner.example.com" can not access the URL in the browser window of "outer.example.com" and therefore can not determine if the page contains our crcat, crsource, or crkw parameters.
To circumvent this security issue, you can take a few actions to remedy this, in order of least to most difficult:
If you have any further questions, contact us.