wireshark/README.macos

$Id: README.macos,v 1.9 2004/07/03 21:46:59 tuexen Exp $

This file tries to help building Ethereal for Mac OS X (Ethereal does
not work on earlier versions of Mac OS).

In order to build Ethereal, you must have X11 and the X11 developer
headers and libraries installed; otherwise, you will not be able to
build or install GTK+, and will only be able to build Tethereal.  The
X11 and X11 SDK that come with Mac OS X 10.3[.x] are sufficient to build
and run Ethereal.

The changes to enable libwiretap and libethereal being built as shared
libraries have broken shared gtk1 builds on Mac OS X.  The GLib 1.x and
GTK+ 1.x release tarballs were built with an older version of libtool
that didn't support shared libraries on Mac OS X, so you can't build and
install them as shared libraries, but the shared-library build of
Ethereal requires GLib and GTK+, on Mac OS X, to be shared libraries. 
The alternative to build Ethereal as one big statically linked binary
isn't working either (and may never have worked on this OS).

The way out of this situation is to use gtk2 and associated libraries
which is known to work in this constellation:

        GLib 2.4.0
        Pango 1.4.0
        GTK+ 2.4.0
        ATK 1.6.0

and the corresponding dependencies, which you can download from the
"dependencies" subdirectory of the GTK+ download directory on the GTK+
FTP site:

	pkg-config
	jpegsrc
	libpng
	tiff

as well as GNU gettext, which isn't included in the directory of
dependencies on the GTK+ FTP site.

NOTE: you must set the PKG_CONFIG_PATH environment variable to include
"/usr/X11R6/lib/pkgconfig" (unless you've already set it, set it to
"/usr/X11R6/lib/pkgconfig") before running the Pango configuration
script, so that it can be configured to use the version of fontconfig
that comes with Mac OS X's X11. This is also needed for the GTK+
configuration.

NOTE: you must install the pkg-config dependency first; unless it is
installed, you cannot configure GLib or GTK+.  After that, you must
install GNU gettext; only after both of those have been built and
installed will you be able to configure GLib.  After configuring and
installing GLib, configure, build, and install Pango, ATK, jpegsrc,
libpng, tiff, and GTK+, in order.  (The exact order might not be
important, but you must configure, build, and install Pango and ATK
before configuring GTK+ and, if you want GTK+ to be able to use the
capabilities from the other libraries, you must configure, build, and
install them before configuring GTK+.)

You will need to do "make install-lib" for the JPEG library to install
its libraries - "make install" does not suffice.  You will also have to
do "sudo ranlib /usr/lib/libjpeg.a" after "make install-lib".

For libpng, use scripts/makefile.darwin, not scripts/makefile.macosx.

Finally run the configure script. By default it will use
the Glib2 and GTK+2 libraries. If you run Ethereal's configure script
with the "--disable-gtk2" argument it'll try to configure with GLib
1.2[.x] and GTK+ 1.2[.x], in which case:

	if they're not installed, the configure script will fail;

	if they are installed, the configure script will configure
	Ethereal to build with them.

Another problem are compile errors in the wiretap directory like the
following:
pcap-util.c: In function `get_interface_list_findalldevs':
pcap-util.c:195: error: `pcap_if_t' undeclared (first use in this function)

On first sight, it would appear that Mac OS X 10.x ships with a weird
version of libpcap that includes pcap_findalldevs, but no definition for
pcap_if_t.

As it turns out, this isn't true for Mac OS X 10.3 through 10.3.2; they
ships with an 0.6[.x]-derived libpcap that doesn't include
"pcap_findalldevs()".  The problem in those releases is caused by a
Security Update - it updates the libpcap dylib to 0.8.1, but doesn't
update the header files (or the man page - and also doesn't update the
tcpdump man page to 3.8.1).

In addition, the Software Update to 10.3.3 and later will update the
libpcap dylib but not the header files.  If systems come pre-installed
with 10.3.3, they might have the correct header files (and man pages).

As a workaround, install pcap.h and pcap-bpf.h from
tcpdump.org's libpcap 0.8.1 in "/usr/include".