ZeroTrace Companion
Multiple Devices
Working with two or more ZeroTrace devices plugged in simultaneously.
You can plug in as many ZeroTrace devices as your machine has USB ports for. Companion handles them one at a time — the workspace shows the active device, and you can switch between them with one click in the picker.
The model
- One active connection at a time. Companion's main window shows whichever device you most recently picked.
- All detected devices stay in the picker — switching between them does not require unplugging anything.
- State is preserved per device. Switching from a HID device to an AirLeak workspace and back again brings you back to the HID dashboard you left.
Switching between devices
- Open the device picker (top-left, or
Ctrl+Shift+D). - Click another detected device.
- Companion disconnects from the current device, connects to the new one, and switches the workspace.
The disconnect-reconnect happens in under a second for most device types. The previous device remains physically connected and will show up immediately when you switch back.
Common multi-device patterns
HID + AirLeak side by side
A common setup: a ZeroTrace HID device for keystroke / scripting work, and an AirLeak for wireless reconnaissance. Plug both into the same machine, switch between them as needed.
| Use case | Switch to |
|---|---|
| Push a script to the HID | HID device → terminal |
| Watch BLE devices in the room | AirLeak → live workspace |
| Reset the HID after a test | HID device → quick action |
| Capture an alert pattern | AirLeak → sessions |
Two AirLeak devices for coverage
Two AirLeak devices in different physical locations give you wider coverage of a wireless environment. Companion handles them one at a time:
- Switch to AirLeak A → capture session A.
- Switch to AirLeak B → capture session B.
- Stop both sessions and review them in the sessions library.
The library merges the two sessions' device observations into the same known-device catalog — so devices seen by both AirLeaks deduplicate naturally.
For continuous parallel capture across two devices, run two Companion sessions on two machines (or a machine with one Companion and a second AirLeak running headless under a script). Single-Companion concurrency is one device at a time by design.
HID device + BLE Logger
Both are HID-style devices and both render in Companion's HID dashboard, but each is its own product. Switch between them with the picker; data does not cross over.
Disconnecting
Three ways:
| Method | What happens |
|---|---|
| Click Disconnect in the workspace | Closes the port cleanly; device stays in the picker as "available" |
| Pull the USB cable | Companion sees the broken pipe, surfaces a "device disconnected" banner, port disappears from picker on next re-scan |
| Switch to a different device in the picker | Old device disconnects; new device connects |
In all cases, any unsaved session data stays in memory until you explicitly discard or save it.
Performance notes
- Companion's CPU usage scales mostly with the active device's data rate. An idle HID device uses near-zero CPU; an AirLeak streaming live wireless data uses more.
- Switching between devices does not add background CPU load — the inactive device is simply not being read.
- The known-device library is shared across all AirLeak captures, but it is paged from disk so memory usage stays bounded even with millions of historical observations.
When you should not use Companion for multiple devices
Companion's one-active-device model fits investigative and management workflows. It is not ideal for:
- Continuous parallel capture across many AirLeak devices (run multiple machines instead).
- Headless / automated multi-device pipelines (use the device's own scripting interfaces directly).
- Production monitoring of many devices over time (this is a different application's job — Companion is for interactive investigation).
For the common interactive cases — one or two devices, switch between as you work — Companion is the right shape.