I once set up a bridging firewall (using LEAF Bering) for a friend's business to control traffic invisibly (this wasn't for any nefarious purposes -- he really

I once set up a bridging firewall (using LEAF Bering) for a friend's business to control traffic invisibly (this wasn't for any nefarious purposes -- he really needed a firewall that didn't take up an IP number on his public network.) Configuring it was a pain in the ass (you couldn't telnet/ssh into it because it had no IP number) but it worked very well and didn't show up in pings, traceroutes, or much of anything else. You can do a lot at the frame layer.