This file tries to help building Wireshark for Mac OS X (Wireshark does
not work on earlier versions of Mac OS).
You must have the developer tools (called Xcode) installed. Xcode 3 should
be available on the install DVD. See
You must have X11 and the X11 developer headers and libraries installed;
otherwise, you will not be able to build or install GTK+, and will only
be able to build TShark. The X11 and X11 SDK that come with Mac OS X
releases starting with Panther can be used to build and run Wireshark.
You must also have GLib and, if you want to build Wireshark as well as
TShark, GTK+. See
for information on how to install GLib, GTK+'s dependencies, GTK+, and
some additional optional support libraries from source.
If you are building from a Subversion tree, rather than from a source
distribution tarball, run the autogen.sh script. This should not be
necessary if you're building from a source distribution tarball, unless
you've added new source files to the Wireshark source.
Then run the configure script, and run make to build Wireshark.
If you upgrade the major release of Mac OS X on which you are building
Wireshark, we advise that, before you do any builds after the upgrade,
you do, in the build directory:
If you are building from a release tarball:
If you are building from SVN:
Then re-run the configure script and rebuild from scratch.
On Snow Leopard (10.6), if you are building on a machine with a 64-bit
processor (with the exception of the early Intel Core Duo and Intel Core
Solo machines, all Apple machines with Intel processors have 64-bit
processors), the C/C++/Objective-C compiler will build 64-bit by
This means that you will, by default, get a 64-bit version of Wireshark.
One consequence of this is that, if you built and installed any required
or optional libraries for Wireshark on an earlier release of Mac OS X,
those are probably 32-bit versions of the libraries, and you will need
to un-install them and rebuild them on Snow Leopard (10.6), to get 64-bit
Some required and optional libraries require special attention if you
install them by building from source code on Snow Leopard:
GLib - the GLib configuration script determines whether the system's
libiconv is GNU iconv or not by checking whether it has libiconv_open(),
and the compile will fail if that test doesn't correctly indicate
whether libiconv is GNU iconv. In Mac OS X, libiconv is GNU iconv, but
the 64-bit version doesn't have libiconv_open(); a workaround for this
is to replace all occurrences of "libiconv_open" with "iconv_open" in
the configure script before running the script.
libgcrypt - the libgcrypt configuration script attempts to determine
which flavor of assembler-language routines to use based on the platform
type determined by standard autoconf code. That code uses uname to
determine the processor type; however, in Mac OS X, uname always reports
"i386" as the processor type on Intel machines, even Intel machines with
64-bit processors, so it will attempt to assemble the 32-bit x86
assembler-language routines, which will fail. The workaround for this
is to run the configure script with the --disable-asm argument, so that
the assembler-language routines are not used.
PortAudio - when compiling on Mac OS X, the configure script for the
pa_stable_v19_20071207 version of PortAudio will cause certain
platform-dependent build environment #defines to be set in the
Makefile rules, and to cause a universal build to be done; those
#defines will be incorrect for all but one of the architectures for
which the build is being done, and that will cause a compile-time error
on Snow Leopard. The current snapshot version of PortAudio still
defines those values in the Makefile, but it appears to use them in ways
that don't cause build problems; its configure script also has a
"--disable-mac-universal" flag that can cause the build not to be done