PhunkyG

> Another alternative would be "Apple's shipped libpcap and tcpdump since Day One, or close to it, so we'll just assume we have it". If that's too risky, you could...