MS NLB incoming frame destination mac address

Sergey Mayorov 1 Reputation point
2022-08-19T12:00:03.987+00:00

hello

Is it normal behavior when in wireshark on NLB server (NLB Multicast) I see in incoming frame destination mac address is unicast address(local network adapter) not multicast? If I capture this frame befor it leav port on switch it has multicast address in destination mac address field. Does MS NLB make a substitution value in destination mac address field of incoming ethernet frame?

excuse me for my poor english

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,122 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,351 Reputation points
    2022-08-22T07:23:57.913+00:00

    Hello there,

    In unicast mode, NLB uses the NLB MAC address to replace the original hardware MAC address of each adapter in each node of the cluster and this seems to be behavior by design.

    This article describes how the different Network Load Balancing (NLB) operation modes affect network infrastructure and the best ways in which the network can support each mode.

    Configure network infrastructure to support the NLB operation mode https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-network-to-support-nlb-operation-mode

    ----------------------------------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept it as an answer–