Windows 2000 Network Adapter Link Detection

Microsoft Windows 2000 detects physical network connection changes through an architecture known as NDIS Media Sense. Operating at the Network Driver Interface Specification (NDIS) 5.0 layer, this feature enables the operating system to automatically recognize when a network cable is connected or disconnected, allowing protocol stacks and system services to respond dynamically to hardware link changes without requiring a system reboot.

The Role of NDIS Media Sense

Prior to Windows 2000, network interfaces generally remained bound to protocols regardless of physical connectivity. Windows 2000 introduced NDIS 5.0, which added Media Sense functionality. Media Sense acts as the central communication channel between the physical network interface card (NIC) hardware, the miniport driver, and upper-layer network protocols like TCP/IP.

Hardware and Miniport Driver Detection

The detection process begins at the physical layer (PHY) of the network adapter:

  1. Carrier Detection: The NIC hardware continuously monitors the physical medium for a link pulse or carrier signal (such as an active Ethernet connection).
  2. Interrupt Generation: When the physical state changes—such as unplugging or inserting an RJ-45 cable—the transceiver signals a state change, triggering an interrupt on the network adapter.
  3. Status Indication: The adapter's NDIS 5.0 miniport driver receives this hardware event and issues a status notification to the NDIS wrapper by calling the NdisMIndicateStatus function.

The miniport driver reports link states using specific status codes:

  • NDIS_STATUS_MEDIA_DISCONNECT: Indicates that the physical link has been severed.
  • NDIS_STATUS_MEDIA_CONNECT: Indicates that the physical link has been re-established.

Protocol and Operating System Response

Once the NDIS library receives the status notification, it broadcasts the event to bound protocol drivers, most notably the TCP/IP stack.

When a disconnect event occurs, Windows 2000 initiates a short internal delay timer to prevent transient disconnections from resetting the interface immediately. If the link remains down, the TCP/IP stack unbinds the IP address from the adapter, marks associated routes in the routing table as invalid, and cancels pending address resolution requests. If configured with DHCP, the client enters a dormant state until a connection is restored.

When a reconnect event occurs, the miniport driver signals NDIS_STATUS_MEDIA_CONNECT. The TCP/IP stack re-evaluates the adapter, initializes DHCP renewal requests or re-applies static IP configurations, and restores routing table entries.

Visual and Administrative Integration

The link detection mechanism directly feeds the Windows 2000 user interface. The Network and Dial-up Connections subsystem catches these NDIS events to update the system tray icon, presenting a red "X" over the network icon or displaying "A network cable is unplugged" tooltip notifications. Administrators could also modify this behavior via the Windows Registry using the DisableDHCPMediaSense value under HKLM\System\CurrentControlSet\Services\Tcpip\Parameters to prevent the IP stack from unbinding during brief link drops.