- Data link
The correct answer is 1.
When traffic is passing through a router, the frames have to enter the router (with the router as the destination at layer 2, some remote host for layer 3). Once the router determines layer 2 is it (and it is a valid frame and layer 3 protocol is enabled this interface), it removes the layer 2 header. The router then looks at the destination layer 3 address, if that address is not one of its own addresses, then it has to determine if it has a route. If so, it will determine the egress interface, layer 2 encapsulation type and addressing for layer 2. It then does a re-write of the layer 2 and dispatches the frame out the egress interface. This process happens (more or less) for every frame and every packet sent from host to host that passes through a router..