Skip to content

ZeroTrace Mobile

AirLeak

When a ZeroTrace AirLeak unit is paired, ZeroTrace Mobile becomes a passive Bluetooth LE recon suite, the live scanner, device detail, capture modes, and what it sees.

Pair a ZeroTrace AirLeak unit and ZeroTrace Mobile becomes a passive Bluetooth LE recon suite. The external hardware does the radio work; the app is the screen and the brain. AirLeak is BLE-only, and the mobile app over Bluetooth is its only control surface, there is no web UI or serial console.

Mobile is the primary way to drive AirLeak

The desktop app no longer manages AirLeak units, AirLeak runs from ZeroTrace Mobile. For the capture hardware, firmware, and what the radio can see at the protocol level, see ZeroTrace AirLeak. For community wardriving maps and leaderboards on the web, see the ZeroTrace Dashboard.

AirLeak tabs

TabWhat it does
LiveThe streaming scanner, every BLE device the unit hears, with filters, sort, and severity.
TraceNetThe AirLeak view of the TraceNet mesh.
HuntFox Hunt, the direction finder.
DriveDrive, the live wardrive map.
InsightsExposure analysis of a session.
ModesThe capture mode picker (see below).
SettingsAirLeak device settings.
AboutRead-only device identity and diagnostics.

History and session sharing live in Sessions.

Live scanner

The Live scanner is the heartbeat of AirLeak: a list that streams every Bluetooth LE device the unit hears, updating live as the world moves around you, with a running count and a real-time event rate so you can feel how busy the air is.

What makes it more than a raw dump is the triage built in. Every device carries a 0–100 severity score so the genuinely concerning ones rise to the top.

Options
Filterstrackers, leaks, Apple, Android, audio, named, close, Find My, severe
Sort bylast seen, signal, distance, severity, observation count
Per devicename, MAC (with a randomized-address flag), signal, distance, protocols, severity

Device detail

Tap a device and the scanner gathers everything it has pieced together into one place. It is the screen that turns "some device" into "an AirTag in Find My mode, about three metres away, leaking nothing."

Shows
Identityname, MAC, vendor, class, Apple model and even an iOS-version hint where the adverts give it away
Signalsa live RSSI sparkline, an estimated distance, TX power, and observation count
Privacytracker / Find My / leak flags and the exact advertised protocols

Capture modes

AirLeak is not one-size-fits-all; you choose how the radio behaves. The Modes tab offers:

ModeBehaviour
MonitorStreams everything live for analysis at a desk or on foot. This is the working mode you spend the most time in.
WardriveRuns the scanner flat-out and feeds it straight to the Drive map for covering ground.
SetupParks the radio while you pair or configure.

A fourth mode, Recon, logs silently in the background with no live UI, for a quiet long-haul deployment. Recon is a background state rather than a Modes-tab card, you enable continuous background scanning from the AirLeak device settings ("Always recon").

What it detects

Across Bluetooth LE, the scanner recognises far more than "a device is here." All of it passively, without ever connecting to anything.

  • Devices: phones, laptops, watches, AirPods (down to per-bud battery), AirTags and the wider Find My network, Tile and Samsung SmartTag trackers, beacons, and the pairing chatter of Fast Pair and Swift Pair.
  • Per device: the address and whether it is randomised for privacy, signal strength and an estimated distance, vendor and class, a severity score, and how long it has been around.
  • Identity leaks: which devices are broadcasting identifiers or advertising data that leaks who or what they are.
Passive only

AirLeak is a passive listener. It decodes what devices broadcast on their own, it does not connect to, probe, or interfere with anything.

Related