ZeroTrace Companion
Devices View
Aggregated table of every device the current session has seen — Wi-Fi and BLE — sortable, filterable, exportable.
The devices view is the static-snapshot version of the live view's table. It shows every device the current session has observed, deduplicated and aggregated.
Use the devices view when you want to review what was captured without the visual noise of constant updates.
Two tabs
The devices view splits Wi-Fi and BLE into separate tabs:
| Tab | What it shows |
|---|---|
| Wi-Fi | Wi-Fi stations and access points observed in the session |
| BLE | BLE devices, including AirTags and Apple Continuity / Find My devices |
The split mirrors the underlying protocols — they have different fingerprinting properties and different per-device columns.
Wi-Fi columns
| Column | What it shows |
|---|---|
| MAC | Address, with randomisation indicator |
| Vendor | OUI-derived |
| Role | Station / Access point / Probe-only |
| Wi-Fi generation | 802.11 b/g/n/ac/ax/be derived from observed capabilities |
| Best RSSI | Strongest signal seen |
| Channel | Most-recent channel |
| SSIDs probed | List of network names the station has asked for (probe requests) |
| Encryption | When AP-class — open / WEP / WPA / WPA2 / WPA3 |
| Observations | Total event count |
| First seen / Last seen | Session-relative timestamps |
For probe-emitting stations, the SSIDs probed column is the highest-signal column. It tells you which networks the device "remembers" being connected to — often a real-name list of that user's home, work, gym, etc.
BLE columns
| Column | What it shows |
|---|---|
| MAC | Address |
| Vendor | OUI-derived |
| Best RSSI | Strongest signal |
| Apple model | Apple Continuity model type when detectable |
| BLE name | Friendly name when advertised |
| Class label | Behavioural classification (phone, AirTag, headphones, fitness device, etc.) |
| Class confidence | Numeric confidence in the classification |
| Observations | Total event count |
| First seen / Last seen | Session-relative timestamps |
Apple Continuity is the most informative BLE field — Apple devices broadcast model identifiers that distinguish AirPods from iPhones from MacBooks, even when no name is set.
The Apple model column survives MAC randomisation because Apple changes the MAC much more often than the model changes. A device that shows "iPhone 14 Pro" across many MACs in a short timespan is the same physical iPhone.
Sorting and filtering
Both tabs support:
- Click any column header to sort.
- Filter chips — vendor, channel, encryption, RSSI range, class label, randomisation status.
- Search box — partial-match across MAC, name, SSIDs probed.
Filters are session-scoped — they affect only the current view, not the underlying capture.
Pin a device
Right-click any row → Pin to live view. Pinned devices appear in a permanent panel on the live view, regardless of filters. Useful for:
- Watching for the return of a specific device.
- Tracking a known target's movement during the session.
- Marking devices for later follow-up.
Unpin from the same right-click menu.
Per-device detail
Click a row to open the per-device detail drawer:
- Full event history for this device in the session.
- RSSI over time — chart of signal strength.
- Channel pattern — when (if ever) the device switched channels.
- Probe requests — for Wi-Fi stations, the full list with timestamps.
- Apple Continuity payloads — decoded for Apple BLE devices.
- Library identity — if the device is matched to a known-device library entry, the link is here.
Export
Top-right of each tab:
- CSV — table-shaped, suitable for spreadsheet review.
- JSON — structured per-device, perfect for scripting.
Export respects the current filters. Apply filters first to export a subset.