All layers of TCP/IP have their own security threats and vulnerabilities. Unfortunately, if the lower layer is hacked, communications are compromised without the other layers being aware of the problem. Everything at Layer 3 and higher is encapsulated into some type of Layer 2 frame. If an attacker can interrupt, copy, redirect, or confuse the Layer 2 forwarding, they can also disrupt the functions of the upper-layer protocols:
For example, an internal attacker who is connected to the network using some port-scanning tools to scan the open ports can gain access to the switch through which they can start accessing the upper-layer devices.
Port scanning is a reconnaissance mechanism that attackers use to scan the ports that are active.