ZeroTrace AirLeak Pro
What It Captures
The Wi-Fi networks, clients and Bluetooth devices AirLeak Pro identifies
AirLeak Pro captures on two fronts at once, Wi-Fi (2.4 GHz and 5 GHz) and Bluetooth LE, and merges both into one live view in the app.
Wi-Fi scanning runs on the Pro's dedicated dual-band radio; Bluetooth runs alongside it. You don't switch between them, both feed the same capture at the same time.
Wi-Fi: access points
For every network it hears, AirLeak Pro surfaces:
| Field | What it tells you |
|---|---|
| SSID | The network name (or a hidden marker when the network cloaks its name) |
| BSSID | The access point's MAC address |
| Band | 2.4 GHz or 5 GHz |
| Channel | The operating channel |
| Signal (RSSI) | How strong it was heard, in dBm |
| Security | Open, WEP, WPA, WPA2, WPA2-Enterprise, WPA3, or OWE (enhanced open) |
| Wi-Fi generation | Wi-Fi 4 (n), Wi-Fi 5 (ac), Wi-Fi 6/6E (ax), or Wi-Fi 7 (be) |
| Protected management frames | PMF required / capable |
| WPS | Whether Wi-Fi Protected Setup is advertised |
| Hidden | Whether the network hides its SSID |
| First / last seen | When it entered and was last heard |
Networks are de-duplicated as you move, one row per access point, updated as its signal changes, so a drive through a dense area produces a clean inventory rather than thousands of repeats.
Most modern routers run their fastest network on 5 GHz. A 2.4-GHz-only scanner misses those entirely. AirLeak Pro sees both bands, so your survey reflects what's actually deployed.
Wi-Fi: clients
Beyond access points, the Pro also picks up client devices that are actively looking for networks. When a phone or laptop probes for a remembered network by name, the Pro captures:
- The client's MAC address, flagged as randomized or real
- The network name it's searching for
- Signal strength and when it was seen
This is the surface that reveals which networks a device "remembers", useful for privacy audits and understanding a device's history. Devices using MAC randomization are clearly marked as such.
Bluetooth LE: devices
On the Bluetooth side, AirLeak Pro runs the full AirLeak device-intelligence stack. It listens to BLE advertisements and classifies each device into a specific type with a confidence score, and decodes rich per-device detail.
The recognized device classes and the per-device fields are the same as the standard AirLeak, covering the Apple ecosystem, phones, PCs, TVs, wearables, trackers, audio, smart-home/IoT, and more.
For the complete list of Bluetooth device classes, the fields captured per device, and the privacy signals detected, see the standard AirLeak's What AirLeak Sees, the Pro's Bluetooth capture is identical.
Highlights of the BLE side:
- Trackers, AirTag / Find My, Tile, Samsung SmartTag, Google Find My Network, with separated-from-owner state
- Apple Continuity, live device state (screen on/off, in-call, AirPods battery, OS hints)
- Privacy signals, AirDrop discoverable, unwanted-tracker flags, combined leakage score
- Cross-MAC tracking, follows a device across MAC rotation where its advertisement is fingerprintable
Location tagging
On a drive, observations are tagged with the location where each network or device was heard strongest, using your phone's GPS through the app, and exported as WiGLE-compatible CSV for mapping. Want the board to wardrive without a phone? An optional on-board GPS module lets it run standalone. See GPS.
Where a field hasn't been observed (for example, no name from a hidden network or a randomized client), the app shows an em-dash rather than guessing.