A firewall requires deep packet inspection to evaluate which layer?

Deep packet inspection (DPI) analyzes the actual content of network packets at the application layer (Layer 7), going beyond IP headers and port numbers to inspect the payload data. This allows a firewall to identify specific applications, detect malware signatures, enforce content policies, and recognize application-layer attacks such as SQL injection or cross-site scripting that are invisible to stateful packet filtering.

The Internet layer (Layer 3) is evaluated by standard packet filtering using IP addresses and routing information, which does not require deep packet inspection.

The link layer (Layer 2) is processed by switches and basic network hardware using MAC addresses, not by DPI-capable firewalls.

The transport layer (Layer 4) is handled by stateful firewalls using TCP/UDP port numbers and connection state tables, which is a less sophisticated inspection method than DPI.