I was looking at making the PIM dissector more filterable and noticed that it has been labelled a "tunnelling protocol" (per revision 827), so that subsequent layers (ie IPv4/IPv6) are branched from within the PIM dissector and not on the "main" tree. Is this (still) standard practice? Taking the sample capture from the wiki, it just looks "visually off" to have the IP and subsequent layers come off of the "PIM options tree". Perhaps at least a new tree under the PIM dissector should be used instead of "options"? I personally don't see anything wrong with just putting the IP and subsequent layers on the main tree (and that code has remained but been #if 0ed out since revision 827).
Michael