MySQLProtocolParser parses MySQL events from tcpdump files. The packets come from TcpdumpParser. MySQLProtocolParse::parse_packet() should be first in the callback chain because it creates events for subsequent callbacks. So the sequence is: 1. mk-query-digest calls TcpdumpParser::parse_event($fh, ..., @callbacks) 2. TcpdumpParser::parse_event() extracts raw MySQL packets from $fh and passes them to the callbacks, the first of which is MySQLProtocolParser::parse_packet(). 3. MySQLProtocolParser::parse_packet() makes events from the packets and returns them to TcpdumpParser::parse_event(). 4. TcpdumpParser::parse_event() passes the newly created events to the subsequent callbacks. At times MySQLProtocolParser::parse_packet() will not return an event because it usually takes a few packets to create one event. In such cases, TcpdumpParser::parse_event() will not call the other callbacks.