Windows 2000 TCP/IP

Link Layer Functionality

Link layer functionality is divided between the network adapter/driver combination and the low-level protocol stack driver. For LAN media, the network adapter/driver combination filters are based on the destination MAC address of each frame.

Normally, the LAN hardware filters out all incoming frames except those containing one of the following destination addresses:

The unicast MAC address of the adapter.
The broadcast address (for Ethernet, the broadcast address is 0xFF-FF-FF-FF-FF-FF).
Multicast addresses that are registered with the hardware by a protocol driver.

If the frame contains one of these addresses as the destination MAC address, the frame is checked for bit level integrity through a checksum calculation.

All frames that pass the destination address and checksum tests are then passed up to the network adapter driver through a hardware interrupt. The network adapter driver is software that runs on the computer, so any frames that make it this far require some CPU time to process. The network adapter driver brings the frame into system memory from the interface card. Then the frame is passed up to the appropriate bound transport drivers in the order that they are bound. The NDIS 5.0 specification provides more detail on this process.

As a packet traverses a network or series of networks, the source MAC address is always that of the network adapter that placed it on the media, and the destination MAC address is that of the network adapter that is intended to pull it off the media. This means that in a routed network, the source and destination MAC address change with each hop through a network-layer device (a router or layer 3 switch).