Encapsulation layer limits and inspection behavior

When managing encapsulated traffic, it is important to understand the processing limits of the system’s two primary inspection engines, Lina and Snort.

• LINA: Supports decoding up to 2 layers of encapsulation.

• Snort: Supports decoding up to 255 layers of encapsulation (with a default limit of 40).