ZeroTrace AirLeak
Device Intelligence
How ZeroTrace AirLeak identifies the Bluetooth-LE devices, ecosystems and beacons around you.
Device intelligence
A raw Bluetooth scan is just a list of addresses and numbers. AirLeak's job is to turn that into something you can actually read: this is an AirPods case, that is a Samsung SmartTag with its owner, those three are environmental sensors. It does that with a dedicated decoder for each ecosystem's advertising format, run against every advertisement AirLeak hears.
What it recognizes, by ecosystem
What it detects: Apple's Continuity protocol family, everything an iPhone, iPad, AirPods case or Find My accessory broadcasts over BLE.
What it identifies: Find My accessories and AirTags; AirPods, including case-lid open/closed and battery state; the "Nearby" continuity signals iOS devices constantly emit; other Apple accessory advertisements.
Privacy-relevant fields surfaced: Find My owner vs. separated state; AirPods lid and charge state; whether a nearby Apple device is showing itself as unlocked or on a call, a field Apple's Nearby signal exposes and AirLeak reads directly.
Naming, not guessing
For each device it hears, AirLeak layers up what it knows, the manufacturer that owns the signal, the kind of accessory it is, and any state the device chooses to broadcast, into a single readable identity in the app. Where a device advertises live state (an AirPods lid opening, a SmartTag that has been separated from its owner), AirLeak surfaces that too, so the entry is not just a name but a small live status.
Anything that does not match a known ecosystem or beacon format still gets a best-effort generic label built from what the advertisement contains, a manufacturer looked up from its Bluetooth company ID, a device type from its GATT appearance value, rather than being dropped or shown as a bare address.
Handling privacy addresses
Most current phones and many accessories rotate the Bluetooth address they broadcast every few minutes, on purpose, so they cannot be trailed by that address. AirLeak is built around this. Instead of trusting the address alone, it recognizes a device by the pattern of how it advertises, and stitches together the rotating addresses that clearly belong to the same device, cross-checking the device's private resolvable address where the protocol allows it. The practical result: a phone that changes its address every fifteen minutes shows up as one device you can follow over time, not a crowd of momentary strangers.
Identification is a best-effort reading of public signals. Well-known devices are named confidently; unusual or deliberately anonymous ones may show only what can be told for sure (for example, "a Find My tracker" without an owner). AirLeak never fabricates an identity it cannot support from the broadcast.
For how AirLeak specifically singles out item trackers, and why that gets special treatment, see Tracker detection.