Windows 2000 implements a network architecture which adheres approximately to the TCP/IP model. However it is not just intended to support the TCP/IP protocol stack. It can also support NetBEUI (NetBIOS Extended User Interface), ATM, IPX/SPX and a variety of others. The Network Access Layer function is implemented primarily using network interface cards (NICs) and their drivers. (in Windows 2000 all drivers run in kernel mode) Windows 2000 network drivers adhere to a specification called NDIS (Network Driver Interface Specification) which provides a device independent interface for higher layers. In Windows 2000, the NDIS interface is implemented in a file called NDIS.sys known as the NDIS wrapper. The NDIS wrapper exposes a set of NDIS functions which are documented in Microsoft's Windows 2000 Driver Development Kit (DDK) and are called by the higher level software implementing protocols such as IP, so-called protocol drivers. At the lowest level NICs are directly controlled by miniport drivers which handles all hardware specific operations. The NDIS wrapper hides the miniport drivers from the protocol drivers but also contains supporting routines which can be called by the miniport to simplify it.
Above NDIS are the protocol drivers such as the one which implements TCP/IP (Tcpip.sys). At the top of every protocol stack Windows defines a common Transport Driver Interface (TDI). This serves TDI clients which are also drivers and implement the kernel-mode portion of networking APIs such as Winsock (the Windows implementation of the Berkeley sockets API). These APIs, of which there are several in common use, are intended for use by application programs in user mode. Winsock for example, exposes its API functions via user-mode DLLs (e.g. Ws2_32.dll is the main DLL for Winsock 2.0)
For details of NDIS and TDI visit http://www.microsoft.com/hwdev/driver/drvrsc.asp