ZeroTrace AirLeak Pro
Ops Suite Overview
The AirLeak Pro authorized-assessment toolset — what it is for, how it is organized, licensing, and how to run and read an operation.
Ops Suite
The Ops Suite contains active tools that transmit and interact with networks and devices. They are intended for security assessments you are authorized to perform, on infrastructure you own or have explicit written permission to test. Using them against networks or devices you do not have permission to test may be illegal. You are responsible for operating within the law and your engagement's scope. See Safety & legal.
Everything else in AirLeak Pro is passive — it only listens. The Ops Suite is the opposite: a set of active assessment tools, split across the Wi-Fi radio and the Bluetooth radio, for sanctioned engagements where a tester needs to measure how a network or device behaves under realistic conditions, not just observe it.
This documentation describes what each tool is for and what results it gives the tester. It is a feature reference, not a how-to for causing harm.
How it is organized
The tools are grouped by radio. Each group has its own page:
Portal, packet capture, beacon flood, deauthentication, handshake/PMKID capture, and drone Remote ID.
iBeacon, BLE spoofing, all eleven advertisement-spam modes, and GATT clone / relay.
Direction-finding — home in on a specific transmitter by signal.
The operating model
One operation at a time. AirLeak Pro runs a single active operation at a time, on either radio. Starting one stops any other that is running. This keeps the radios and results predictable, and keeps a session deliberate — you always know exactly what the device is doing, and so does anyone watching the app.
Start, watch, stop. You start an operation from the Ops screen in the ZeroTrace app, choosing the tool and the options it takes (covered on the Wi-Fi ops and Bluetooth ops pages). The app shows the operation running live, with its own counters, for example a captive portal's connected-client count, a capture's frame count, a flood's messages-per-second rate. Stopping is always one tap away, and the device also stops automatically if you disconnect.
Read the result. Each Ops tool reports back what it accomplished — a client count, a frame count, a captured handshake, a direction. The point of an assessment tool is the evidence it produces for your report: whether a protection held, whether a network was resilient, whether a device could be distinguished from a genuine one. Where a tool produces a file (a capture, a portal log), it is written to the microSD card alongside your survey logs and pulled off through the app.
The Ops Suite is a licensed capability. An unlicensed device still does all the passive survey work covered in Wi-Fi capture and Bluetooth capture; the active tools on this page and the two Ops reference pages require activation. See Licensing & activation.
Use what an operation reports to recommend fixes — enable protected-management-frames, strengthen a password, tune a detection system, harden a pairing flow. The value of an authorized assessment is the finding, not the outage.