You might be thinking in reverse here....if I recall from the books (being old & feeble as I am)...
Layer 4 creates data SEGMENTS and passes it to layer three...
Layer 3 breaks it up and puts it into protocol PACKETS (high-level addressing) then passes it to layer two....
Layer 2 encapsulates the packets into FRAMES (low-level / MAC adressing) and passes it to layer one
Layer 1 encodes the frames using the proper signalling and sends it down the media.....
Other than Token Ring and maybe FDDI, you don't see/hear much about straight bridges these days. DEC, ACSYS, Synoptics (Bay, Nortel), Allied Telesys, and a mess of others all made and sold a sh*tload of bridges in their time. I'm not talking about switches (which are realy just multi-port bridges)...I'm talking regular old traditional bridges.
The "inside" data of the segment/packet never really gets changed in "normal" handling. As the data decends the stack, the next layer of formatting/addressing is added around the outside of the information ("stuffing into another envelope").
As the data ascends the stack on the receiving system, each layer peels off a layer of information, looks at the instructions (addresses/protocols/ports) and send the information to the next appropriate process in the next-higher layer ("Removes the envelope from the bigger envelope").
If I'm correct in the above information, then only a layer two device (of the appropriate protocol) can look into the frame. You wouldn't be able to look into an Ethernet frame with a protocol analyzer set up for Frame-Relay...even though they're both layer-two critters.
Analyzers (like a "Sniffer") look at each layer as it's peeled off and presents the decode layer-by-layer.
Routers can see the Layer-three information, because the packets have been addressed to the routers in Layer-two (MAC), which is discovered through the ARP (IP-->MAC addressing).
So, my guess would be that no device looks into the frame, without actually passing the frame (or a copy of it) up the stack according to its corresponding protocol (so that each layer can pass its "instructions" to that layer's processes).
There are, of course, some exceptions given the occasional proprietary "features" of some products. For example, Cisco's Multi-Layer Switching (MLS). With MLS active between a router-switch pair, the first packet of a stream is sent to the router for examination and evaluation. The router makes whatever decision regarding the forwarding of the packet, and ultimately that information is sent and stored in a cache in the switch. When the next packet of that session comes along, the switch compares it to the cached information; if it knows about this particular packet's sesion (a cache Hit), then it switches the packet without further intervention from the router (and all subsequent packets of this specific session/stream).
So there ya go. That's the way I remember it...hopefully it's pretty close to target.
Edit: Spidey got his post in a few milliseconds ahead of me, it seems.....damn he's quick...
FWIW
Scott