ZeroTrace AirLeak
Single Device View
Reading every detail AirLeak knows about one device
Tap any row in the Live list and AirLeak opens that device's detail page, everything the unit has learned about that device, organized into compact sections.
What you'll find on the page
The page is laid out top-to-bottom with the most important info first:
- Header card, icon, friendly name, MAC, class badge, score gauge
- KPI strip, first-seen, observation count, best signal
- Live signal, RSSI history plus current/avg/best/worst/TX/distance/rate
- Identifiers, fingerprint, OS major, BLE flags, appearance, vendor, company ID
- Optional sections, only appear when applicable (Battery, Apple state, Find My)
- Service UUIDs, collapsible chip list
- Why this class?, breakdown of how the device got its class
The header card
Three things to glance at:
- Icon + name, class icon plus the device's friendly name (or
Unknown <class>fallback) - Class badge, the classifier's verdict with confidence:
iPhone (94)means 94 % confident - Score gauge, visual indicator of the leakage score
The KPI strip
Three numbers always visible:
- First seen, relative time since first observation
- Observation count, total events
- Best RSSI, strongest signal ever observed
A 2-hour-old device with 1247 observations and a best RSSI of -54 has been close, repeatedly. A 5-second-old device with 2 observations and a best RSSI of -91 just walked past once at the edge of range.
Live signal section
A small chart of the last 60 RSSI samples, about 60 seconds of history at typical capture rates. Watch this while moving the device or yourself: you'll see signal fluctuation, walls attenuating, and approach / depart patterns.
Six numbers below the chart:
| Metric | Description |
|---|---|
| Cur | Current RSSI |
| Avg | Average over last 60 samples |
| Best | Strongest RSSI ever seen |
| Worst | Weakest RSSI ever seen |
| TX | Device's transmit power (when broadcast) |
| Rate | Observations per second over the last minute |
| Distance | Estimated meters, from RSSI + TX |
Distance is approximate, RSSI is noisy and surroundings affect it. Treat ±50 % as the typical confidence.
Identifiers
Every stable identifier extracted for this device:
- Fingerprint, a stable hash combining payload-stable BLE fields (used for tracking across MAC rotation)
- OS major, for Apple devices that broadcast it (iOS 17, iOS 18)
- BLE flags, discoverability flags
- Appearance, GAP appearance code with interpretation (
1344 (Phone)) - Vendor, manufacturer name from MAC OUI
- Company ID, Bluetooth SIG company identifier
Empty fields are hidden, only what AirLeak has actually observed shows up.
Optional sections (only when relevant)
Battery (AirPods, Beats, AirTags, wearables)
For AirPods you'll see:
Left: 80% ⚡ (charging)
Right: 80%
Case: 75%
For AirTags: a battery-level class. For headphones with a battery service: a single percentage.
Find My (for trackers / Find My accessories)
- Separated-from-owner state
- Unwanted-tracking-protection (UTP) flag
- Public-key prefix
- Battery level
Apple state (for iPhones / iPads / Macs)
- Last action:
screen_on - Lock state
- OS major version
- Handoff sequence number
The action is one of the most engaging things to watch, you can see when someone's nearby Apple device changes state in real time.
Service UUIDs
A collapsible chip list of every service the device has advertised. Each chip shows the UUID with a well-known short-name when matched (0x180F (Battery), 0xFD9F (Tile), 0xFEE7 (Tuya)).
Why this class?
The classifier's audit trail. Every signal that voted for the current classification, with score contributions:
apple_continuity_nearby_info ×4 +40
name_contains_iphone +15
apple_continuity_airdrop +5
service_uuid_match +5
ios_version_bonus +5
─────────────────────────────────
Total 70
If the classification ever surprises you, this section explains why. It's the most useful debugging view in the app.
Real-time updates
While the page is open and the device is being observed:
- The RSSI history updates with new samples
- The Apple action / lock state updates as the device broadcasts
- Battery values update as the device reports
- The leakage score and Why-class breakdown update as new signals accumulate
The page reflects the live capture stream, no manual refresh needed.
Open Live, tap your own iPhone, then walk around the room. Watch the RSSI history and the Apple action change in real time. Within a few minutes you'll have a strong intuition for what every signal means.