A 10 Gb NIC connected directly to a 1 Gb either negotiates a 1 Gb connection, or it doesn't work at all. You cannot have the situation you describe unless you have something like a switch in between, where the 10 Gb NIC connects to a 10 Gb switch port.
It is very easy to search and find ethernet speed negotiation
on the Internet, such as the Wikipedia article:
Auto-negotiation (formerly "NWay") is based on pulses similar to those
used by 10BASE-T devices to detect the presence of a connection to
another device. These connection present pulses are sent by Ethernet
devices when they are not sending or receiving any frames. They are
unipolar positive-only electrical pulses of a nominal duration of 100
ns, with a maximum pulse width of 200 ns,[5] generated at a 16 ms time
interval (with a timing variation tolerance of 8 ms). These pulses are
called link integrity test (LIT) pulses in the 10BASE-T terminology,
and are referred to as normal link pulses (NLP) in the
auto-negotiation specification.
A device detects the failure of a link if neither a frame nor two of
the LIT pulses is received for 50-150 ms. For this scheme to work,
devices must send LIT pulses regardless of receiving any. Three bursts
of Fast Link Pulses, used by autonegotiating devices to declare their
capabilities.
Auto-negotiation uses similar pulses labeled as NLP. NLP are still
unipolar, positive-only, and of the nominal duration of 100 ns; but
each LIT is replaced by a pulse burst consisting of 17 to 33 pulses
sent 125 µs apart. Each such pulse burst is called a fast link pulse
(FLP) burst. The time interval between the start of each FLP burst is
the same 16 milliseconds as between normal link pulses (variation
tolerance of 8 ms). How a link code word (a 16 bit word) is encoded in
a fast link pulse burst
The FLP burst consists of 17 NLP at a 125 µs time interval (with a
tolerance of 14 µs). Between each pair of two consecutive NLP (i.e. at
62.5 µs after first NLP of the pulse pair) an additional positive pulse may be present. The presence of this additional pulse indicates
a logical 1, its absence a logical 0. As a result, every FLP contains
a data word of 16 bits. This data word is called a link code word
(LCW). The bits of the link code word are numbered from 0 to 15, where
bit 0 corresponds to the first possible pulse in time and bit 15 to
the last.
Edit for the dumbed-down, plain-English version from Fluke, per your comment:
In regular English, auto-negotiation is simply the method used by two
devices to achieve the best rate possible of transmission. It allows
them to discuss in a sense, the possible rates of transmission, then
pick the best one that they both share. They do this by swapping
advertisements of their own abilities using pulses called Fast Link
Pulses (FLPs). The FLP lets one link partner know what the other is
capable of. As they swap FLPs, the two stations detect the highest
common denominator between them, according to the following:
- 1000BASE-T
- 100BASE-T2 Full Duplex
- 100BASE-TX Full Duplex
- 100BASE-T2
- 100BASE-T4
- 100BASE-TX
- 10BASE-T Full Duplex
- 10BASE-T
For example, if station A and B are auto-negotiating with each other,
and A is capable of 10/100/1000 full or half duplex, but B is only
capable of 10/100 full or half duplex, then the highest common link
rate is 100, at full duplex. As long as both sides are negotiating,
the link will operate at the highest possible connection rate between
them.
Best Answer
Auto negotiation is performed on the physical layer - the NIC driver may report what has been negotiated or it may not (only speed). If you want to look deeper into this I see two variants:
Both variants are passive. If you need a lab simulation to check whether the device works in all possible scenarios you'd have to expand variant 2 so that you generate your own FLP bursts.