> I'm thinking of adding a logical view. This would be a global toggle
> (probably in the menu), which would act as a flag for certain
> dissectors to coalesce actual data packets together before handing them
> off to the sub dissector.
>
> I'm thinking primarily for fragmented TCP and UDP but I'm certain there
> are other protocols which could use this.
>
> It would give us the two main modes of usage.
>
> physical: an actual look at the packets as on the wire
> logical: packet level information for debugging protocol problems.
Well, I'd actually like the data to be coalesced even when viewing
individual packets, e.g.:
in all but the first frame in a multi-frame NFS READDIR reply
there might be a "Continuation from frame N" tree item after the
IP header (for fragmented UDP) or the IP and TCP headers (for
NFS-over-TCP) and before the directory entries, and in all but
the last frame there might be a "Continued in frame N" tree item
at the end;
only the fields that contain at least one byte from a given
frame would show up in the protocol tree for that frame (the
first and last fields might span two packets - presumably if you
clicked on them, the part that's in this frame would be
highlighted).
The logical view you describe, however, would also be useful; in that
view, you might well have one line in the summary display per
higher-level packet, e.g. one per NFS request or reply, which would not
only mean you might have one line in the summary display that referred
to more than one frame, you might have more than one line in the summary
display referring to the same frame if there's more than one request or
reply per packet (which could happen with ONC-RPC-over-TCP or with SMB -
I have an SMB capture in which that happened).
