This is sample of a traceroute to google.com:
TraceRoute from Network-Tools.com to 126.96.36.199 [google.com] Hop (ms) (ms) (ms) IP Address Host name 1 0 0 0 188.8.131.52 - 2 Timed out Timed out Timed out - 3 1 1 1 184.108.40.206 google-level3-3x10g.dallas.level3.net 4 1 1 1 220.127.116.11 - 5 1 1 1 18.104.22.168 - 6 1 1 1 22.214.171.124 dfw25s12-in-f14.1e100.net Trace complete
It obvious there should be some layer two and layer one (physical layer tapping devices) network devices in between that we cannot trace or identify, but they have an important impact on the result.
These layer 2 & 1 network devices have many roles, including security. There are many Agencies or Organizations that capture data on the physical layer or Data link layer like the PRISM surveillance program.
I am looking for theory or practical way to find a way to identify layer 2 devices in order to prove or identify data capturing.