ZeroTrace AirLeak
What AirLeak Sees
The full taxonomy of devices and events AirLeak can identify
A reference for what AirLeak captures and classifies. Every device class below is recognized by the firmware and rendered with its own icon and metadata in the desktop app.
Device classes
The classifier emits one of these labels per observed device, with a confidence score (0–100).
Apple ecosystem
| Class | What it identifies |
|---|---|
iphone | iPhone, idle or active |
ipad | iPad |
macbook | Mac laptop |
imac | Mac desktop |
apple_watch | Apple Watch (any series) |
apple_tv | Apple TV box |
homepod | HomePod / HomePod mini |
apple_vision_pro | Vision Pro |
airpods | AirPods (1st / 2nd / 3rd gen) |
airpods_pro / airpods_pro_2 | AirPods Pro |
airpods_max | AirPods Max |
| Beats family | BeatsX, Solo3, Solo Pro, Solo 4, Studio3, Studio Pro, Studio Pro 2, Powerbeats3, Powerbeats Pro, Beats Flex, Beats Pill |
airtag | AirTag |
findmy_accessory | Non-AirTag Find My-network accessory |
apple_device | Apple device, form factor not yet pinned |
Apple accessories (HID / pencils / cases)
Apple Pencil family, Magic Mouse / Magic Mouse 2 / Magic Mouse USB-C / Magic Mouse 2025, Magic Keyboard variants, Magic Trackpad family, Apple TV Remote, Vision Pro Battery, iPad Smart Folio, Apple Pencil Pro Charger.
Phones
| Class | What it identifies |
|---|---|
samsung_phone | Samsung Galaxy phones (Galaxy S, Note, Z, A series) |
pixel_phone | Google Pixel / Nexus |
android_phone | Generic Android phones — Xiaomi / Redmi / POCO, OnePlus, OPPO, Realme, vivo, Huawei, Honor, Asus ROG, Nothing Phone, Sony Xperia, Motorola, Tecno, Infinix |
PCs
| Class | What it identifies |
|---|---|
windows_pc | Windows desktop / laptop (Microsoft Continuity, Swift Pair, Find My Device) |
surface | Microsoft Surface device |
xbox | Xbox console |
linux_pc | Linux laptop with BlueZ-style advertisement |
Wearables
apple_watch, galaxy_watch, pixel_watch, Garmin watch family, Fitbit family, Polar, Suunto, Coros, Amazfit, Mi Band / Mi Watch, WHOOP, Oura ring, Withings, Eight Sleep, generic smart_watch.
Trackers / item finders
| Class | What it identifies |
|---|---|
airtag | Apple AirTag |
tile | Tile (Mate, Pro, Slim, Sticker) |
samsung_smarttag | Samsung SmartTag / SmartTag+ / SmartTag 2 (with separated / moving / owner-nearby state) |
google_tracker | Google Find My Network accessory |
chipolo | Chipolo |
pebblebee | Pebblebee tracker |
Audio
| Class | What it identifies |
|---|---|
airpods family | (above) |
headphones | Bose QC / QC Ultra / QC45, JBL, Sennheiser, Jabra Elite / Talk / Evolve, Sony WH / WF (incl. XM5 / XM6), Sony LinkBuds / ULT / Float, Galaxy Buds 3 / Live / FE, Pixel Buds Pro 2, Anker Soundcore, Marshall Major / Minor / Motif, Bowers & Wilkins, Master & Dynamic, AKG, Shure, Nothing Ear / CMF, OPPO Enco, Huawei FreeBuds, OnePlus / Realme / Xiaomi / Redmi Buds, Plantronics / Poly, Audio-Technica, Beats Pill / Solo 4 / Studio Pro 2 |
bluetooth_speaker | Bose, Sonos Roam / Move / Era, Beats Pill, Marshall Stockwell / Kilburn / Acton / Stanmore / Woburn, Echo Dot / Show / Studio / Pop / Hub, Nest Audio / Mini / Hub, Google Home |
Smart home / IoT
| Class | What it identifies |
|---|---|
iot_sensor | Generic IoT sensors (Tuya, Mijia, SwitchBot, Govee, Sonos, Amazon Sidewalk, …) — chip vendor and product brand recognized for hundreds of OEMs |
homekit_light | HomeKit-style smart bulbs: Yeelight, WyzeBulb, Sengled, GE Cync, TP-Link Tapo / Kasa, LIFX, Nanoleaf, Govee, Mi LED, Ledvance |
homekit_lock | Smart locks: Schlage, Yale, Kwikset, August, Level Lock, Aqara, Eve Lock |
homekit_other | Other HomeKit-class accessories |
matter_device | Matter-protocol devices |
Other
| Class | What it identifies |
|---|---|
printer | Bluetooth printers and label printers (HP, Canon, Brother, Epson, Lexmark, Xerox, Ricoh, Kyocera, OKI, Brother HL, Pantum, Star, Bixolon, Citizen, Polaroid, instax, Canon SELPHY, HP Sprocket) |
vehicle | Connected vehicles (Tesla, VW, BMW, MercedesMe, Honda, Toyota, GM OpenLink, FordPass, MyAudi, Volvo OnCall, Subaru, Hyundai Blue Link, Kia Connect, Lexus, JLR InControl, Polestar, Rivian, Lucid) |
fitness_device | Cycling / running / strength sensors and equipment (Garmin Edge, Wahoo TICKR / ELEMNT / KICKR, TACX, Zwift Hub, Concept2, Peloton, Stages, PowerTap, Stryd, Saris, 4iiii, Quarq, Power2Max) |
hid_device | Bluetooth keyboards / mice / gamepads (Logitech MX, Razer, Corsair, ROG, Glorious, Keychron, Cherry KW, RealForce) |
flipper_zero | Flipper Zero |
beacon | iBeacon / Eddystone retail beacons with no other class match |
Fallbacks
When no specific class can be determined, the classifier emits a less specific label:
apple_device— has Apple manufacturer ID but ambiguous subtypemicrosoft_device— has Microsoft manufacturer ID, ambiguous CDP typewifi_ap_consumer/wifi_ap_enterprise/wifi_ap_isp_router/wifi_ap_mobile_hotspot— for WiFi APsunknown— no signals matched
What gets captured per device
For every device, AirLeak surfaces the following fields whenever they're broadcast:
| Field | Description |
|---|---|
| Friendly name | The device's BLE local name or WiFi SSID |
| MAC / BSSID | Current address |
| Vendor | OUI lookup or BLE company ID lookup |
| Class + confidence | Classifier verdict |
| RSSI | Current and best-seen signal strength |
| TX power | Device's transmit power (when broadcast) |
| Distance estimate | Computed from RSSI + TX |
| Advertising interval | BLE advertising rate |
| OS major version | iOS major (when broadcast) |
| Apple action / lock state | Live state: screen on / off, in call, locked / unlocked |
| Battery levels | AirPods L / R / case, AirTag battery class, headphone battery |
| Find My state | Owner-nearby vs separated, unwanted-tracking-protection flag |
| Service UUID list | Every service the device advertises |
| Appearance code | GAP appearance (phone, watch, headset, etc.) |
| Probed SSIDs | Every SSID a probing client has asked for |
| Linked MACs | When fingerprinting merges multiple MACs into one identity |
WiFi network details
For every WiFi network observed, AirLeak captures:
| Field | Description |
|---|---|
| SSID | Network name (or hidden) |
| BSSID | Access point MAC |
| Channel | 1–13 (2.4 GHz) |
| Generation | WiFi 4 / 5 / 6 / 7 (when advertised) |
| Encryption | OPEN / WEP / WPA-Personal / WPA2-Personal / WPA2/3-Mixed / WPA3-Personal / WPA2-Enterprise / WPA3-Enterprise-192 / OWE |
| AKM suite | PSK / SAE / 802.1X / FT-PSK / FT-SAE / OWE / etc. |
| Group + pairwise ciphers | TKIP / CCMP-128 / CCMP-256 / GCMP-128 / GCMP-256 |
| MFP | Required / capable / off |
| Country | Country code IE |
| BSS load | Associated station count + channel utilization |
| 802.11r / 802.11k | Fast-roaming / radio-measurement support flags |
| WPS | WPS-PIN / WPS-PBC availability |
| Beacon interval | Beacon period in TU |
Privacy-leak signals
These signals are tracked per-device and feed both the alert engine and the device's leakage assessment:
| Signal | What it indicates |
|---|---|
| AirDrop discoverable | The device's AirDrop is set to "Everyone" — phone-number / Apple ID hash is broadcast |
| Find My separated | Find My beacon's full-offline bit is set — accessory is away from owner |
| Corporate SSID in probe | A probe-request for a corporate-naming-pattern SSID |
| PII SSID in probe | A probe-request for a personally-named SSID (Sarah's iPhone, Mom's Hotspot) |
| Hotel / airport / coffee SSID | A probe-request for a known travel / cafe network |
| MAC randomization | Locally-administered or RPA address (privacy mode) |
| Unlocked during call | Device's screen unlocked while audio / call active |
| Multi-hour follower | Same identity observed across ≥3 hour windows |
| Unwanted-tracking-protect | Find My frame's UTP bit set |
| Open network nearby | Unencrypted WiFi network observed |
| Deauthentication burst | 5+ deauth frames in 10 s targeting one client |
Event types
The desktop categorizes every captured event into one of these types:
- WiFi probe-request
- WiFi beacon
- WiFi probe-response
- WiFi association request
- WiFi reassociation request
- WiFi deauthentication
- BLE device seen (generic advertisement)
- BLE Apple Continuity (any subtype)
- BLE Find My
- BLE Tile
- BLE Samsung SmartTag
- BLE Google Find My Network (FMDN)
- BLE Eddystone
- BLE Microsoft Swift Pair
- BLE Google Fast Pair
Each event flows live to the desktop with full payload — channel, RSSI, decoded fields, timestamps.
When a field is shown but its underlying capability is unavailable (e.g. "Vendor —" on a randomized MAC) the desktop renders an em-dash instead of guessing.