[Guy Harris <gharris@xxxxxxxxxxxx>]

> This kinda breaks in the case of multipacket protocols like TCP (and
> HTTP) - if you have a frame in the middle of a HTTP transaction, what
> can you do with it?

Given that Ethereal *currently* doesn't reassemble HTTP transactions and
other stuff on TCP connections, but processes each frame largely
independently (except for some request/response correlation necessary
for protocols such as ONC RPC-based prococols, and SMB transactions,
where the reply doesn't contain an indication of the type of request to
which it's a reply, and you have to find the matching request), that's
no worse than what we currently have.

We should eventually do better than that, though; that's why you'd want
to mark the entire connection as an HTTP connection, not just mark
individual frames.