On Apr 28, 2025, at 12:00 PM, Omer Shapira via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:
> Darwin PEBs (DPEBs) do not contain any timing information, and does not pretend to reflect the scheduler state machine. Rather, the DPEBs only contain the description of processes, and the order in which DPEBs appear in pcapng is dictated by the order of the “first appearance” of a particular process in the EPB.
>
> In other words, the Darwin tcpdump will only inject a DPEB when it sees a packet, which is associated with a process that has not been observed before.
I.e., they're misnamed - they're not Darwin Packet Event Blocks, they're Darwin Packet *Information* Blocks or Darwin Packet *Description* blocks or something such as that.