Logical Link Control (LLC): How It Works in Networking
Logical Link Control (LLC) is the upper sublayer of the data link layer in IEEE 802 networks. It sits between the network layer and the Media Access Control (MAC) sublayer, helping different network protocols use the same local network technology. Although many modern Ethernet networks rely primarily on EtherType fields to identify upper-layer protocols, LLC remains an important networking concept. Understanding it makes packet captures, legacy networks, VLAN policies, and Layer 2 troubleshooting much easier to interpret.
What Is Logical Link Control?
Logical Link Control, commonly shortened to LLC, is a Layer 2 protocol function defined historically by IEEE 802.2. Its core job is to provide a consistent interface between upper-layer protocols, such as IP, and lower-level media-access technologies, such as Ethernet or Token Ring.
In simple terms, LLC helps answer this question:
“Which protocol should receive this frame after it arrives on the local network?”
The IEEE 802 architecture separates the data link layer into two parts:
- Logical Link Control (LLC): Identifies and manages the logical communication service for upper-layer protocols.
- Media Access Control (MAC): Handles how devices access the physical network medium and use MAC addresses.
This division lets higher-level protocols work independently of the specific LAN technology underneath them. IEEE describes LLC as the top sublayer of the data link layer, positioned between the network layer and MAC services.
Where LLC Fits in the OSI Model
LLC belongs to Layer 2, the data link layer, in the OSI model.
Layer 3: Network layer IP, IPX, other routed protocols
↑
Layer 2: Logical Link Control LLC
↑
Layer 2: Media Access Control MAC
↑
Layer 1: Physical layer Cables, radio signals, fiberThe MAC sublayer determines how frames are sent over a shared medium. LLC provides a logical handoff point so software and protocols above Layer 2 do not need to know the details of that medium.
For example, an upper-layer protocol can use the same LLC-style service whether the underlying IEEE 802 network uses Ethernet, Wi-Fi, or another supported MAC technology.
What Does Logical Link Control Do?
LLC can provide several data-link functions, depending on the LLC service type and network design.
- Protocol multiplexing – Multiplexing is LLC’s most important role. It enables multiple network-layer protocols to share one network interface and one physical network. When a frame arrives, LLC information can help the receiving system identify the protocol that should process the payload. Historically, this allowed protocols such as IP, IPX, and others to coexist on the same LAN.
- Flow control – In connection-oriented LLC implementations, LLC can help regulate the pace of communication so that a receiver is not overwhelmed by incoming frames.
- Error control and recovery – LLC can support acknowledgments and retransmissions for reliable delivery. If a frame is lost or damaged, the receiving device can request that it be sent again. These features are most associated with connection-oriented LLC services rather than ordinary modern IP-over-Ethernet traffic.
LLC vs. MAC: What Is the Difference?
Logical Link Control and Media Access Control are both parts of the data link layer, but they solve different problems.
| Feature | LLC | MAC |
|---|---|---|
| Main purpose | Identifies or supports upper-layer protocol communication | Controls access to the local network medium |
| Position | Upper Layer 2 sublayer | Lower Layer 2 sublayer |
| Works with | Network-layer protocols | Physical media and frame delivery |
| Common identifiers | DSAP, SSAP, control fields | Source and destination MAC addresses |
| Example question answered | “Which protocol gets this data?” | “Where should this frame go?” |
A useful analogy is a postal system: MAC is the street address and delivery route, while LLC is the department or recipient inside the destination building.
Understanding the LLC Frame Header
A basic Logical Link Control header contains three fields:
- Destination Service Access Point (DSAP) – Identifies the service or protocol at the receiving device.
- Source Service Access Point (SSAP) – Identifies the originating service or protocol.
- Control field – Defines the frame type and can support sequencing, acknowledgments, and flow-control behavior.
In some cases, LLC is extended with the Subnetwork Access Protocol (SNAP). LLC/SNAP adds an organizational identifier and protocol identifier, offering a broader way to identify protocols than the original SAP fields alone.
Network equipment may still recognize Ethernet II, LLC, and LLC-SNAP as distinct encapsulation types when applying policies or classifying traffic.
The Three LLC Service Types
Traditional LLC defines three operation types:
- Type 1: Connectionless service – Type 1 LLC sends frames without first establishing a connection and without requiring acknowledgments. It is lightweight and suitable when higher-layer protocols handle reliability.
- Type 2: Connection-oriented service – Type 2 LLC, often called LLC2, establishes a logical connection before sending data. It can use sequencing, acknowledgments, flow control, and retransmission to provide more reliable delivery.
- Type 3: Acknowledged connectionless service – Type 3 LLC supports connectionless communication while allowing acknowledgments. It was designed for cases that need confirmation without maintaining a full connection-oriented session.
Is Logical Link Control Still Used Today?
Yes – but its practical role has changed.
LLC remains valuable in the IEEE 802 networking architecture and appears in technologies, protocols, and packet formats that use LLC or LLC/SNAP encapsulation. It is also relevant to certain control-plane and legacy environments.
However, most everyday IPv4 and IPv6 traffic on wired Ethernet is commonly carried in Ethernet II frames, which identify upper-layer protocols with an EtherType value. That means network engineers are often more likely to inspect EtherType than traditional LLC SAP fields during routine troubleshooting.
The original IEEE 802.2 standard was withdrawn by IEEE in 2011; IEEE points implementers to the stabilized ISO/IEC 8802-2 specification. The concept itself still matters because the LLC/MAC split remains foundational to how IEEE 802 networking is explained and implemented.
Why Network Professionals Should Understand LLC
Logical Link Control knowledge is especially useful when you need to:
- Interpret a packet capture that shows 802.3, LLC, or LLC/SNAP encapsulation
- Troubleshoot legacy IBM, Token Ring, IPX, SNA, or industrial networking environments
- Configure protocol-based VLAN classification or traffic policies
- Understand Layer 2 control traffic and encapsulation differences
- Study for networking certifications that cover the OSI model and IEEE 802 standards
The key is not to assume every Layer 2 frame is the same. Ethernet II, IEEE 802.3 with LLC, and LLC/SNAP use different ways to identify the protocol carried in a frame.
Conclusion
Logical Link Control is the upper portion of the IEEE 802 data link layer. It creates a logical interface between network-layer protocols and the MAC mechanisms that deliver frames across a local network. While classic LLC functions are less visible in modern Ethernet environments, the model remains essential. It explains how protocols share network media, how certain frames identify their payloads, and why Layer 2 troubleshooting sometimes requires looking beyond MAC addresses alone.