ZeroTrace AirLeak Pro
Wi-Fi Capture
The complete reference for what AirLeak Pro's dual-band Wi-Fi radio decodes — bands, channels, security, PMF/WPS, hidden networks, generation, and client discovery.
Wi-Fi capture
AirLeak Pro's dedicated Wi-Fi radio listens across both bands, 2.4 GHz and 5 GHz, and builds a live table of the networks and devices around you. It is passive: it hears what access points and devices already broadcast, and decodes that broadcast in full — down to the same information elements a professional site-survey tool reads.
Bands and channels
All channels are covered. Channels 1, 6 and 11, the non-overlapping "hot" channels almost every network actually uses, get the most attention; the remaining channels (2–5, 7–10, 12, 13) are still swept, just less often, since the vast majority of real traffic sits on the big three.
For every access point it hears, AirLeak Pro reports the network name (SSID), band and channel, and signal strength — your sense of distance to the AP from where you're standing. The live table holds thousands of networks at once, so a large venue or a long wardrive doesn't overflow it; entries that stop being heard eventually age out.
Security type
AirLeak Pro parses each network's security information element and labels it plainly, covering every type of network you'll encounter in the field:
| Security type | What it means |
|---|---|
| Open | No protection at all. |
| WEP | Legacy, long-broken encryption — still worth flagging when found. |
| WPA-Personal / WPA2-Personal | A shared password protects the network. |
| WPA2-Enterprise | Individual logins (802.1X), typically corporate networks. |
| WPA/WPA2 mixed | The AP accepts either, usually a transition state worth noting. |
| WPA3-SAE (WPA3-Personal) | The current-generation personal standard. |
| WPA2/WPA3 mixed | Transitional networks supporting both. |
| OWE ("Enhanced Open") | Encrypts the link without requiring a shared password — common on public Wi-Fi. |
| WAPI | The Chinese national encryption standard, recognized where present. |
It also reads two extra protection flags out of the same security element:
- Protected Management Frames (PMF) — reported as required, capable, or absent, telling you whether a network resists forced-disconnect attacks.
- WPS — detected, and further flagged if it's locked (too many failed attempts) or has an active registrar currently pairing a device.
Hidden networks
A network that broadcasts no name (a zero-length or non-printable SSID) still gives itself away by every other signal it sends. AirLeak Pro flags it as hidden, and keeps a sticky "was hidden" marker even after a name is later heard — so you know a network was deliberately concealed even if it later reveals itself to a connecting client.
Wi-Fi generation
AirLeak Pro reads the capability elements each network advertises and works out its generation directly, rather than guessing from channel or vendor:
| Elements seen | Generation reported |
|---|---|
| HT (802.11n) | Wi-Fi 4 |
| VHT (802.11ac) | Wi-Fi 5 |
| HE (802.11ax) | Wi-Fi 6 |
| EHT (802.11be) | Wi-Fi 7 |
Client devices and probes
Wi-Fi is a two-way street, so AirLeak Pro also decodes probe requests from nearby client devices, phones, laptops and the like, as they look for networks to join. For each probe it shows the client's address and the network name it's asking for, and flags whether the client is using a randomized (private) MAC address — the privacy feature modern phones use so they can't be tracked by their Wi-Fi address between locations.
Because AirLeak Pro sees both the networks and the devices probing for them, it can flag an access point that answers to any network name a client asks for — a "wildcard responder," the classic behavior of a lookalike or lure network set up to catch devices auto-connecting to remembered names.
Everything on this page happens on the dedicated Wi-Fi radio, while the main processor independently runs Bluetooth capture. Neither slows the other down.