I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is still investigating on the same layer where the attacks are occuring ?

Thanks in advance, ken

  • What do you mean, "L2 has more insight"? Who said that L2 is more preferable than L3? There's a ton of assumptions here that needs to be sorted out. – schroeder May 13 '14 at 19:25
  • I'm not familiar with any IDS/IPS specific meaning to 'layer 2' or 'layer 3'. I suppose you could point to IDS/IPS that can't consider layer 2 information when triggering events or haven't done a good job of recognizing layer 2 evasions, but I've never heard that problem described that way. – Jeff K Feb 24 '17 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.