Meraki MR34 Cloud Managed AP MR34-HW Hoja De Datos

Air Marshal

Real-Time Wireless Intrusion 
Prevention System (WIPS)  
and Forensics

Meraki’s cloud managed wireless access points (APs) come 
equipped with Air Marshal, a built-in wireless intrusion detection 
and prevention system (WIDS/WIPS) for threat detection and attack 
remediation. APs configured in Air Marshal mode will scan their 
environment in real-time and take preemptive action based on 
intuitive user-defined preferences. Air Marshal triggers alarms and 
automatically contains malicious rogue APs. Intuitive cloud based 
management with flexible remediation policies makes Air Marshal 
ideal for security-conscious distributed networks.  

•  Security policy enforcement at the network edge 
•  Real-time scanning across channels on 2.4GHz and 5GHz bands
•  Attack signatures continually updated from cloud
•  Granular detection, attack and remediation policies
•  Policy-driven real-time alarms via e-mail and SMS
•  Works with all Meraki MR-series access points
•  Included with the Meraki Enterprise license at no additional cost

With Meraki’s Air Marshal, you can deploy a state-of-the-art real-time 
scanning system without requiring any additional software, hardware 
or licenses. By default, all APs will opportunistically monitor their 
surroundings. With a simple click, an AP is marked as an Air Marshal, 
converting it to a dedicated WIPS scanner.

Deploy and manage multiple sites from a single-pane of glass, 
eliminating the need for large IT teams and on-site truck rolls for 
any security troubleshooting or WIPS-related events. Air Marshal 
seamlessly scales to thousands of sites.

Air Marshal comes equipped with an intelligent cloud-based 
heuristics engine, designed to detect and advise on the most 
sophisticated attacks. APs will monitor management frames and 
inspect wireless traffic such as probe requests and disassociation 
packets to identify deviation from normal behavior. Attack profiles 
are organized into categories such as rogue SSIDs, AP spoofs, and 
packet floods, facilitating rapid classification and response by a 
network administrator.

Gain unparalleled insights into your wired and wireless infrastructure, 
identifying wired rogues on your LAN, interfering SSIDs, and 
malicious clients sending packet floods or attempting to hack your 
wireless network.

Meraki’s cloud-based management includes the ability to configure 
auto-containment policies, facilitating pre-emptive action against 
rogue devices. For example, Air Marshal can be configured to  
auto-contain APs spoofing your network’s SSID, ensuring your 
employees and customers are not lured into connecting to a 
malicious rogue device.

Built-in forensics tools enable thorough analysis following Air 
Marshal’s initial threat assessments. Live tools including over-the-
web packet capture enable administrators to run packet scans 
across one or more APs, while historic event logs give granular 
information on client associations, RADIUS authentications, roaming 
events, and much more - with all historic data stored in perpetuity.

Administrators may be immediately notified of potential wireless 
threats with highly customizable real time alerts. Alerts may be 
enabled for a variety of threat categories, and are delivered via email 
or SMS.

Datasheet |