["Guy Harris" <gharris@xxxxxxxxx>]

Ian Schorr said:
> Okay, finally getting around to testing this:
>
> Copying the various 0.8.1 libpcap header files mentioned below into
> /usr/local.include (it's not trying to include /usr/include for me for
> some reason), I now get these errors:
>
> ld: Undefined symbols:
> _pcap_lib_version
> _pcap_datalink_val_to_name
> _pcap_findalldevs
> _pcap_freealldevs
> _pcap_list_datalinks
> _pcap_set_datalink
> _pcap_datalink_name_to_val
> make[2]: *** [tethereal] Error 1
>
> Any ideas why?

Probably because it's also not trying to link "/usr/lib" - if you have the
security update or 10.3.3, you have a libpcap with all those routines.

Do you have *two* versions of libpcap installed - one in "/usr" (the one
that comes with OS X) and one in "/usr/local/{include,lib}"?  If so, you
want to make sure that the header files in "/usr/local/include" match the
headers in "/usr/local/lib" - i.e., if you copied the 0.8.1 headers to
"/usr/local/include", you'd better have 0.8.1's library installed in
"/usr/local/lib".