Wireshark-dev: Re: [Wireshark-dev] PIM dissector

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 6 Apr 2013 11:31:11 -0700
On Apr 6, 2013, at 7:17 AM, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

> As this part of the PIM message isn't intended for the PIM entities themselves,
> but uses the PIM protocol to carry the message across, the carried payload (IPv4
> or IPv6 in this case) will be put onto a section of the destination network.
> Therefore this is an independent part of the PIM message. IMHO, it should go in
> the main tree.

Yeah, as with other tunneling protocols, it's transporting packets towards an ultimate receiver; whether the protocol layers atop the payload happen to include a network-layer protocol doesn't matter here.

> As an example of such a payload which should not be on the main tree look at
> ICMP. There the header is part of the message and not destined other than the
> receiving ICMP entity.

Exactly.  ICMP isn't expecting the receiver of the ICMP packet to deliver it to a local IP stack as an incoming packet or to strip the ICMP header off and send the payload on, it's expecting the receiver to possibly look at the header and deliver an error notification to whoever sent the packet.