Link Layer Functionality
A version of this page is also available for
4/8/2010
Link layer functionality is divided between the network interface card/driver combination and the low-level protocol stack driver. The network card/driver combination filters are based on the destination media access control (MAC) address of each frame.
Normally, the hardware filters out all incoming frames except those containing one of the following destination addresses:
- The address of the adapter
- The all-ones broadcast address (FF-FF-FF-FF-FF-FF)
- Multicast addresses that a protocol driver on this host has registered an interest in, using an NDIS primitive
Because this first filtering decision is made by the hardware, the NIC discards any frames that do not meet the filter criteria without incurring any CPU processing. All frames (including broadcasts) that pass the hardware filter are then passed up to the NIC driver through a hardware interrupt. The NIC driver is software that runs on the device, so any frames that make it this far require some CPU time to process. The NIC driver brings the frame into system memory from the interface card. Then the frame is indicated (passed) up to the appropriate bound transport driver(s).
Most NICs have the ability to be placed into promiscuous mode. When placed in this mode, the NIC does not perform any address filtering on frames that appear on the media. Instead, it indicates every frame that passes the cyclic redundancy check (CRC) up to the appropriate bound transport driver. Link layer functionality is used by some protocol analysis software, such as Microsoft Network Monitor.
Frames are indicated up to all bound transport drivers, in the order that they are bound.
As a packet traverses a network or series of networks, the source MAC address is always that of the NIC that placed it on the media, and the destination MAC address is that of the NIC that is intended to pull it off the media. This means that in a routed network, the source and destination MAC address change with each hop through a network-layer device (router).