pcapLume Press Kit
All material on this page may be used in editorial coverage of pcapLume. For anything else, ask us.
This press kit is available in 15 languages:
EnglishDeutschEspañolFrançaisItalianoPortuguês (Brasil)TürkçeРусскийالعربيةעבריתहिन्दी日本語한국어简体中文繁體中文
About pcapLume
pcapLume is a local PCAP forensics engine for macOS, built for network forensic analysts, incident responders, and security researchers. It carves files downloaded over unencrypted HTTP, maps Layer-2 MAC addresses to hardware vendors from the IEEE OUI list, downloaded once and then kept on the Mac, and checks payloads against five built-in signatures and timing and entropy heuristics — with a hash-chained Chain of Custody Log that records the ingestion checksum and every report it produces.
pcapLume is built by ProfWorkBench, LLC in New York and distributed exclusively through the Mac App Store as a free download with paid unlocks in-app. Analysis runs on the Mac and keeps working with the network cable unplugged. By default, pcapLume is allowed to contact outside enrichment services. With Pro, it automatically looks up the country of the public addresses in Top Talkers, and if you save your own abuse.ch key it automatically sends the SHA-256 of each carved file to MalwareBazaar; the rest run only when you ask. The app names each one, and one switch in Settings blocks every lookup pcapLume makes itself. The capture file is never uploaded, and payload data is never transmitted in any mode.
Approved boilerplate
pcapLume — Your capture. Analyzed on your Mac.
pcapLume is a local PCAP forensics engine for macOS that turns captured network traffic into documented findings and PDF reports. It carves files downloaded over unencrypted HTTP, maps hardware on the wire to its vendor with the IEEE OUI list, downloaded once and then kept on the Mac, and flags requests for files named payload or payload.bin, periodic C2 beaconing and high-entropy payloads with five built-in signatures and timing and entropy heuristics — all on the Mac, without uploading the capture file. pcapLume is available on the Mac App Store as a free download; Pro capability unlocks in-app. pcapLume is localized in 15 languages.
Fact sheet
| Product | pcapLume |
|---|---|
| Developer | ProfWorkBench, LLC |
| Platform | macOS 14+ (Sonoma) |
| Pricing | Free download · Genesis Partner License $999.99 once · Pro (Annual) $199.99/year (in-app purchase) |
| Languages | 15 — English, Deutsch, Español, Français, Italiano, Português (Brasil), Türkçe, Русский, العربية, עברית, हिन्दी, 日本語, 한국어, 简体中文, 繁體中文 |
| Privacy | On-device analysis · capture file never uploaded · outside lookups allowed by default (with Pro, Top Talkers addresses go to geojs.io automatically; MalwareBazaar receives carved-file SHA-256 values automatically only with your own abuse.ch key), each named in the app · one switch in Settings blocks every lookup pcapLume makes itself |
| Launched | June 2026, on the Mac App Store |
| Links | pcaplume.com · Mac App Store · profworkbench.com |
Brand assets
Assets may be used unmodified in editorial coverage of pcapLume. Please don't recolor, distort, or recompose the app icon.
Press contact
For interviews, review questions, and anything not covered here, reach ProfWorkBench via the support channel.