First of all realize when talking about an IDS we are talking about a passive device. With a passive device they commonly log/alert and nothing else. On the other hand if this device was an IPS that is where the active "shunning" blocking or whatever else it was built to do happens.
Much like anti-virus technologies there are two types of network sensing technologies signature based (e.g. Snort), and heuristic based (e.g. Fireye kinda!).
As for detecting anomalous activity at layer 2 it is uncommon for the IDS/IPS to usually take care of this. This however does not mean that something on the network else could monitor this instead. That something is usually a NAC (Network Access Control) solution (e.g. FreeNAC) and it is possible there is a suite of tools that may run together with the IPC/IDS and does this but as a different part of a product (see palo alto).
With all that said at the internet touch points there are many ways to passively finger print a device based of its traffic. In fact Nessus actually does this very good, and additionally, if you have ever played with pOf you have already done this yourself. Things like web requests, smb connection attempts, and other bits of traffic help those systems pull together quite a bit of information passively.
See this Nessus page explaining more.