The reason it makes sense NOT to jump into deep packet inspection (or, as you ask, starting at L1), is that starting at an app layer you have a holistic view of *every* possible link in the chain. If ...

According to the OSI Model, the session layer is where connections are established, managed, and torn down. For connection-oriented network protocols, understanding how the session layer works, and ...