Something from gcc manpage: "It makes a difference where in the command you write this option; the linker searches and processes libraries and object files in the order they are specified. Thus, foo.o -lz bar.o searches library z after file foo.o but before bar.o. If bar.o refers to functions in z, those functions may not be loaded."
"The linker handles an archive file by scanning through it for members which define symbols that have so far been referenced but not defined." So -lpcap should be used after pcap symbols are referenced (after network.c, scan.c or something like this). If it works with the following I will push it into repository. $(CC) -o $(PROG) $(OBJS) $(LDFLAGS)