One analyst says the security acquisitions that went down last week - Juniper buying Funk Software, Citrix's purchase of Teros and Force10's MetaNetworks buy - highlight some of the most intriguing areas in network security technology: Layer 2 network-access control and application firewalls are hot spots.

Network-access control is the impetus behind Juniper's move, says Lawrence Orans, principal analyst with Gartner. "Juniper wants to go head-to-head with Cisco's [Network Admission Control]" technology, a switch-level security architecture announced in October. Cisco's NAC architecture uses client-side software to scan for dangerous machines and blocks network access at the switch port.

While Cisco and Juniper duke it out, some of the best technology for keeping bad guys off the LAN may still be in the hands of smaller vendors.

"There is no shortage of interesting start-ups in this area," Orans says. Nevis and ConSentry Networks are two examples: Nevis makes a LAN-enforcement switch with built-in security-monitoring capabilities; ConSentry's product is not a switch, but a devices that sits behind switches and allows a LAN switch to enforce network rules on traffic flows based on security-detection policies.

"ConSentry and Nevis have ASICs that do these security tasks," Orans says. "Cisco, with its NAC technology, has the preventative elements of network security. But they need to get elements of NAC that are more reactive. They spin a story around their IPS solution, but they don't have [IPS] at the switch level. That's what these kinds of ASICs are all about."

As for application firewalls, this is an emerging product category that is beginning to take off as such vendors as F5 integrate the technology into their Layer 4-7 switch gear. This was the reason Citrix's Netscaler group went after Teros.

"Application firewalls are focused on deep packet inspection, as opposed to a stateful firewall that just maintains the state of sessions that go through it." Orans says. Application firewalls look deeper into packets to make sure that applications are behaving in a certain way and can identity when something is amiss.

Consider SQL Slammer. "If you had the right [application firewall] in place when that hit, it might have recognized all those UDP packets hitting SQL servers" - which was Slammer's attack method. "This is something that would obviously be an anomaly, but not something regular firewalls look for."