I'm also trying to find the exact same solution: Air Marshal report of multiple rogue SSIDs/other SSIDs/spoofs/malicious transmissions/packet floods, for the entire organization, separated by threat type, for example. But the only available API exclusive to the Air Marshal function doesn't have all the information we need. Have you managed to find anything that can generate this Air Marshal report? ... View more

Hey @bkoch ,   User cmr is absolutely correct in regards to the reasoning behind why one would use L3 roaming or not. To expand on that, L3 roaming causes a bit of overhead and latency, but not nearly as much overhead and latency as if you were to not be using it in a situation where different SSIDs were mapped to different subnets. Without L3 roaming turned on, clients would be given new IP addresses whenever they roam, which will cause many disruptions on the client end (think dropped calls, packet loss, etc) in an environment where different APs are assigning IP addresses out of different pools for the same SSIDs.    With L3 roaming, whatever AP your client initially connects to will be its designated “anchor AP”. All subsequent roams will tunnel traffic back to this anchor AP so the client device can keep it’s original IP address. This is less jarring than getting a brand-new IP, but it still introduces an additional layer of processing power and latency.   If L3 roaming isn’t needed (which it doesn’t appear to be in your case), it is highly recommended that you disable this feature. ... View more