From what layer of OSI can Suricata handle?

Help
1

Greetings all,

I am new to Suricata and studying about networks.

I am using Suricata v7.0.0 in Ubuntu.

I have a question, if I were to my test custom rule in Suricata, can I send a test packet from Data Link Layer (Layer 2)? Will it be able to detect the packets or I should always start with Layer 3? Thanks

2

The most common use case is layer 7… But you can match on layer 3/4… I am not sure about layer 2. Could you post a more precise example ?