Logical Link Control (LLC)

Introduction to the LLC Sublayer

In networking, the Data Link Layer (Layer 2) provides functions for a single link. Its lower part, the MAC sublayer, handles MAC addressing and access to the medium used by Ethernet or Wi-Fi. Signal encoding and transmission are provided by the physical layer. Above it, the Network Layer uses logical addresses and selects routes between networks.

The Logical Link Control (LLC) sublayer sits between the MAC sublayer and the Network Layer. Defined by the IEEE 802.2 standard, it provides a common interface and services independent of details of the underlying technology. Whether data uses Ethernet, Wi-Fi, or Token Ring, the Network Layer can use the same LLC service model. This abstraction was especially useful in the 1980s and 1990s, when several LAN technologies coexisted. The standard describes the LLC interface, data-unit format, and three service types: unacknowledged connectionless, connection-oriented, and acknowledged connectionless.

LLC Functions

LLC provides a set of logical-link services that are independent of the medium. The selected operating mode determines the service features. Not every mode provides flow control and error recovery.

• Multiplexing Network Protocols:

  LLC allows multiple Network Layer protocols, including IPv4, IPv6, and legacy Novell IPX, to coexist on the same physical network. Service access point identifiers select the protocol stack that should receive an incoming data unit. DSAP and SSAP values, together with the optional SNAP extension, identify the protocol when the frame format requires it.

• Flow Control (Optional):

  In modes that support this feature, LLC can manage the transmission rate between devices to limit overload at a slower receiver. It can signal the sender to pause transmission. This feature is not present in every mode and does not replace congestion control in higher layers.

• Error Control (Optional):

  Selected LLC modes use sequence numbers and acknowledgments. This supports ordering, detection of missing or damaged frames, and retransmission requests. Sequence numbers and a sliding window belong to connection-oriented service mechanisms.

• Media Independence:

  The LLC service interface is common to Ethernet, Wi-Fi (802.11), and Token Ring (802.5). The Network Layer communicates with LLC, which passes data to the MAC sublayer used by the technology. Frame-format details and medium access remain responsibilities of MAC.

The LLC Header (IEEE 802.2)

When an Ethernet or Wi-Fi frame uses LLC, the LLC header appears between the MAC header and Network Layer data. It contains fields used to select the service and operating mode. In the classic header, DSAP and SSAP are one byte each, while the Control field is one or two bytes.

The standard LLC header consists of three fields:

Three LLC Service Types

The LLC standard defines three modes of operation. An application or protocol selects the service that fits its requirements through the value in the Control field of the LLC frame.

1. Type 1: Unacknowledged Connectionless Service

   This is a basic, lightweight datagram service without acknowledgments.

   • How it works: Frames are sent to the destination without establishing a prior connection and without expecting any acknowledgment of receipt.
   • No Reliability: There is no flow control, retransmission, or acknowledgment of lost or damaged frames. LLC passes the frame to the MAC sublayer; detecting and recovering from the problem is left to higher-layer protocols such as TCP. Type 1 has no LLC-level recovery procedure.
   • Use Case: For TCP/IP traffic using LLC, this is a typical connectionless mode on LANs. Establishing a Layer 2 connection would be unnecessary when TCP provides a connection-oriented service at Layer 4. The mode is also used for broadcast and multicast traffic, where acknowledgments would be impractical. RFC 1042 describes Type 1 with LLC/SNAP for IP datagrams on IEEE 802 networks.
2. Type 2: Connection-Oriented Service

   This is a connection-oriented service with numbering, acknowledgments, and retransmission, similar in those respects to HDLC or TCP mechanisms at the link layer.

   • How it works: Before data is exchanged, a logical connection is established between the source and destination SAPs. All frames are sequentially numbered. The receiver sends acknowledgments for correctly received frames. Flow control is managed using a sliding window mechanism. Damaged or lost frames are automatically retransmitted by the LLC.
   • High Reliability: Within an active connection, it provides acknowledgment and ordered delivery, with retransmission when loss is detected. The service is provided by LLC and requires both link endpoints to participate. Link-level acknowledgment does not replace the end-to-end semantics of transport protocols.
   • Use Case: This mode has higher overhead and is less common in IP networks. It was more relevant in older network architectures like IBM's SNA, where link-layer reliability was required.
3. Type 3: Acknowledged Connectionless Service

   This service combines connectionless operation with acknowledgment of individual frames.

   • How it works: No logical connection is established beforehand. Each individual data frame is sent and must be individually acknowledged by the receiver. If an acknowledgment is not received within a certain time, the sender retransmits the frame.
   • Moderate Reliability: It confirms delivery of each frame but does not guarantee the order of arrival. The acknowledgment applies to a particular frame, so the sender can transmit that frame again.
   • Use Case: It can suit selected control or automation systems that require acknowledgment of individual commands without the overhead of a full connection. The appropriate mode depends on the requirements of the protocol.

LLC and Ethernet II Framing

Ethernet standards describe more than one frame format. In the IEEE 802.3 format with LLC, the field after the MAC addresses represents length, while Ethernet II (a DIX frame) uses that field as EtherType.

For IP transmission, the Data Link Layer must identify the protocol carried in the payload. LLC uses SAP fields for this purpose, while Ethernet II uses EtherType. The formats perform the same function in different ways.

• IEEE 802.3 Frame with LLC: The two bytes following the source MAC address represent the Length of the data field. The LLC header then follows, containing the DSAP and SSAP fields which identify the Network Layer protocol.
• Ethernet II Frame: The two bytes following the source MAC address represent the EtherType. This single field directly identifies the Network Layer protocol. For example, an EtherType value of 0x0800 indicates an IPv4 packet, while 0x86DD indicates an IPv6 packet.

Devices distinguish the formats by examining the two-byte field after the MAC addresses. Values from 1501 through 1535 are not the standard interpretation of either the Length field or EtherType. The selected format depends on the applicable standard and upper-layer protocol. A Length field does not identify the network protocol, so this variant requires an LLC header:

• If the value is $\le 1500$ (hex $0x05DC$), it's interpreted as a Length field, and the device expects an IEEE 802.3 frame with an LLC header.
• If the value is $\ge 1536$ (hex $0x0600$), it's interpreted as an EtherType field, and the device processes an Ethernet II frame.

Ethernet II is often selected for user data, while LLC remains important for understanding Data Link Layer services. The actual share of IP traffic depends on the environment, so a fixed value of 99% should not be assumed for every LAN. LLC is also used by some Layer 2 control protocols, including the Spanning Tree Protocol (STP), which exchanges information between switches to prevent network loops.