Vol. I · No. 46The hardware sectionSat, 10 Oct 2026
Layer 2 · Data-link device

NIC

the network interface card

A NIC is the hardware that connects one computer to the network. It carries the host’s burned-in MAC address, wraps outgoing data into frames, and puts the bits onto the wire — a machine’s one physical door onto the network.

A NIC is a computer’s door onto the network, identified by its unique MAC address.

Operates at
Layer 2
Data Link
Addressed by
MAC address
48-bit, burned in
Its job
Frames
bits ↔ the wire
Found in
Every host
wired & wireless

How it works

The bridge between the computer and the wire
The computer
apps & OS
has data to send
raw data
NIC
frames the data
and stamps its MAC
00:1A:2B:3C:4D:5E
frames on the wire
The network
switch & other hosts
the shared medium
Every frame the NIC sends carries its address
Dest MAC
where it’s going
Src MAC ← this NIC
00:1A:2B:3C:4D:5E
Payload
the actual data

The computer hands raw data to the NIC. The NIC wraps it in a frame stamped with its own MAC address and signals it onto the wire — and, coming back, it keeps only the frames addressed to that MAC.

The main points

What a NIC does, step by step

1
Take data from the OS

The operating system hands the NIC a block of data to send.

2
Wrap it in a frame

The NIC builds an Ethernet frame — destination MAC, its own MAC as the source, then the payload.

3
Signal onto the wire

The frame is turned into electrical, optical or radio signals and put on the medium.

4
Filter what comes back

Incoming frames are read, and only those addressed to this MAC (or to a broadcast) go up to the OS.

In cybersecurity

The NIC is where a host meets the wire, so it’s both a hardware identity to trust — and a layer an attacker can forge or eavesdrop on.

MAC spoofing

A MAC address can be changed in software, so it proves nothing on its own.

Promiscuous mode

A NIC told to keep every frame, not just its own, is how sniffing starts.

MAC filtering

Allow-lists by MAC are a weak control — easily defeated by spoofing.

Network access control

802.1X authenticates the host at the port before the NIC gets to talk.

Device fingerprinting

The MAC’s first three bytes name the vendor, which leaks what the device is.

The first hop

Everything a host sends or receives passes through it — a worthwhile place to monitor.

Protocols it runs

EthernetARP802.11802.1X

Sits beside

SwitchModem

On the bench

NIC — Network Interface Card