Sorted it out myself.
Still don't know why this failed with the default though.
gcc xscan.c snoop.c -o xscan -lX11
which means its trying to link in with libX11.a
So I locate the file:
Then I check /etc/ld.so.conf
OK so the directory is there (2nd line), so why isn't ld finding it?
As stated in my previous post I had already run ldconfig but it had no effect.
Changing the Makefile to:
gcc xscan.c snoop.c -o xscan -L /usr/X11R6/lib/ -lX11
Incidentally this is OK as I work in my companies security team and we are authorised to go poking around our own servers for vulnerabilities. ;>