Wireshark · Ethereal-dev: Re: [Ethereal-dev] 0.10.2 build failure on Mac OS X: this is really weird ...

[Ian Schorr <ethereal@xxxxxxxxxxxxx>]

This security patch is included with 10.3.3 and the libpcap files definitely
aren't included in the release.

Since this problem will likely effect any new and existing users trying to
build on OS X 10.3.3 and this isn't likely to change in the near future,
should something be added to the README.macosx and/or the FAQ?

Ian

Guy Harris wrote:

> Okay ... sorry to response to my own post, but the issue seems to be
> that 0.10.2 assumes you have pcap_if_t if you have pcap_findalldevs, a
> sane assumption from my reading of the libpcap-0.8.1 headers.  However,
> OS X 10.3.2 ships with a weird version of libpcap that includes
> pcap_findalldevs, but no definition for pcap_if_t.

No, 10.3.2 doesn't do that; it ships with an 0.6[.x]-derived libpcap that
doesn't include "pcap_findalldevs()".

It's a problem with the latest Security Update - it updates the libpcap
dylib to 0.8.1, but doesn't update the header files (or the man page - and
also doesn't update the tcpdump man page to 3.8.1).

> Does anybody have a favorite workaround?

Install, in "/usr/include", pcap.h, pcap-bpf.h, and pcap-stdinc.h from
libpcap 0.8.1.