$Id: README.macos,v 1.4 2004/03/21 22:55:59 guy Exp $
This file tries to help building Ethereal for Mac OS X (Ethereal does
not work on earlier versions of Mac OS).
The changes to enable libwiretap and libethereal being built as shared
libraries have broken shared gtk1 builds on Mac OS X. The GLib 1.x and
GTK+ 1.x release tarballs were built with an older version of libtool
that didn't support shared libraries on Mac OS X, so you can't build and
install them as shared libraries, but the shared-library build of
Ethereal requires GLib and GTK+, on Mac OS X, to be shared libraries.
The alternative to build Ethereal as one big statically linked binary
isn't working either (and may never have worked on this OS).
The way out of this situation is to use gtk2 and associated libraries
which is known to work in this constellation:
and the corresponding dependencies. In case you also have gtk1 installed,
you will need to run configure with the "--enable-gtk2" argument.
Another problem are compile errors in the wiretap directory like the
pcap-util.c: In function `get_interface_list_findalldevs':
pcap-util.c:195: error: `pcap_if_t' undeclared (first use in this function)
On first sight, it would appear that Mac OS X 10.x ships with a weird
version of libpcap that includes pcap_findalldevs, but no definition for
As it turns out, this isn't true for Mac OS X 10.3 through 10.3.2; they
ships with an 0.6[.x]-derived libpcap that doesn't include
"pcap_findalldevs()". The problem in those releases is caused by a
Security Update - it updates the libpcap dylib to 0.8.1, but doesn't
update the header files (or the man page - and also doesn't update the
tcpdump man page to 3.8.1).
In addition, the Software Update to 10.3.3 and later will update the
libpcap dylib but not the header files. If systems come pre-installed
with 10.3.3, they might have the correct header files (and man pages).
As a workaround, install pcap.h, pcap-bpf.h and pcap-stdinc.h from
tcpdump.org's libpcap 0.8.1 in "/usr/include".