Your capture.
Analyzed on your Mac.
pcapLume is a local PCAP forensics engine for macOS — packet diagnostics, Layer-2 hardware vendor mapping, and file carving from unencrypted HTTP downloads. Your capture file is never uploaded.
Three instruments.
One integrity record.
Analysis runs against local databases and compiled rules — it keeps working with the network cable unplugged. Only the outside lookups need a connection.
Offline Packet Forensic Reassembly
Carves and reassembles files — JPEGs, PDFs, ZIPs, EXEs and HTML pages — downloaded over unencrypted HTTP in the capture. With Pro, preview images and PDFs in the app before export.
OUI Hardware & IoT Fingerprinting
Maps Layer-2 MAC addresses to hardware vendors using the IEEE OUI list, which you download once in Settings (with Zero Telemetry off); lookups then run on your Mac with no further network access. The packet inspector shows the vendor registered to each packet's source and destination MAC address.
Built-in Payload Signature Scanner
Checks decoded payloads against five built-in signatures, plus timing and entropy heuristics, as the capture is analyzed — flagging requests for files named payload or payload.bin (the app's Metasploit signature), periodic C2 beaconing, and high-entropy payloads before you open a single frame.
A glassmorphic workbench for hostile traffic.
Real screens from pcapLume 27.0 analyzing a sample evidence capture.
The numbers from a single session.
Built for the chain of custody.
On the record from the ingestion checksum to the exported dossier.
⬡Evidence File Integrity Profile
Computes the capture file's SHA-256 — with MD5 and SHA-1 for cross-tool comparison — before the first frame is decoded, and prints all three in the Integrity Record (Pro).
∿Behavioral Timing Anomaly Engine
Detects robotic C2 beacon signatures — timing variance under 5% across 15+ consecutive packets — alongside Shannon entropy anomalies in payload streams.
⧉In-App Media & Payload Previewer
Integrated previews for recovered images, code segments, and multi-page PDFs — rendered through sandboxed view representables, never an external app.
⎙Pro PDF Reports
Generates multi-page forensic dossiers, an Integrity Record for the capture file, and a hash-chained Chain of Custody Log.
◐System, Light or Dark Appearance
Every dashboard, chart and card follows your choice of System, Light or Dark appearance.
Your evidence is none of our business.
Turn on Zero Telemetry in Settings ▸ Security Matrix and pcapLume blocks every outbound lookup it makes itself, falling back to local-only databases. Payload data is never transmitted — in any mode. Try the switch.
The Zero Telemetry switch is off by default. While it is off, two lookups run without a click: with Pro, GeoJS receives the public addresses in Top Talkers; and if you have saved your own abuse.ch key, MalwareBazaar receives the SHA-256 of files carved from a capture (abuse.ch can link each hash to that account). The other four run only when you ask, and so does one service not listed here, the IEEE vendor list. Turn the switch on and all of them stop. None ever receives a captured payload. Apple's App Store is contacted for prices and licenses whether the switch is on or off. One more path sits outside the switch: an IP address shown as a link opens whois.domaintools.com in your browser, which passes that address to DomainTools.
Fund independent forensic engineering.
No seat audits, no usage meters, no data harvested to subsidize the price.
Genesis Partner License
A permanent license for generous early backers funding our independent forensic engineering.
- Every current and future Pro capability, forever
- Threat-feed and signature matches by name and severity, in the app and in every report
- Never renews — suits teams and agencies that cannot carry a subscription
Pro (Annual)
Full access to pcapLume Pro — renewed annually, cancel anytime.
- Full packet and flow lists, threat details and carved files
- Integrity Record & hash-chained custody-log PDFs
- Geolocation of public addresses, and Shodan and Censys lookups with your own keys
- All updates while subscribed
The wire never lies.
pcapLume shows you what it carried.
pcapLume is available now for macOS 14+.