RDGW NLB cluster responding with DUP ICMP Echo

Question

Hello. We have 2 RDGW servers (2012R2) configured in a NLB cluster.

Both servers have 2 NICs, 1 LAN, 1 WAN - NLB is configured on the WAN interface. NLB configured in anycast mode.

We have found out that if the cluster IP or the individual WAN IPs are pinged from a Linux machines, there are ping duplicates being returned. Windows doesn't return duplicates (or hides them).

Can someone confirm if this is a normal behavior or this shouldn't be happening?

Thanks in advance

Example:

64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=1 ttl=117 time=32.2 ms
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=1 ttl=117 time=32.2 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=1 ttl=117 time=32.3 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=1 ttl=117 time=32.3 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=2 ttl=117 time=32.2 ms
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=2 ttl=117 time=32.2 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=2 ttl=117 time=32.3 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=2 ttl=117 time=32.3 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=3 ttl=117 time=32.2 ms
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=3 ttl=117 time=32.2 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=3 ttl=117 time=32.3 ms (DUP!) a
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=3 ttl=117 time=32.3 ms (DUP!)
64 bytes from <NLB_cluster_IP> (<NLB_cluster_IP>): icmp_seq=4 ttl=117 time=32.0 ms

--- <NLB_cluster_DNS> ping statistics ---
4 packets transmitted, 4 received, +9 duplicates, 0% packet loss, time 1502ms
rtt min/avg/max/mdev = 32.084/32.274/32.352/0.232 ms

Thread source link: https://social.technet.microsoft.com/Forums/zh-CN/fb8ca609-89b5-4cfe-af4d-48929dcb5b5d/rdgw-nlb-cluster-responding-with-dup-icmp-echo?forum=winserverPN

Answer 1

Hi ,

Welcome to our new Microsoft Q&A Platform.

Apparently this is normal behavior. All nodes in an NLB cluster respond to pings. The ping command in Windows masks the duplicate replies so you only notice this if pinging from a non-windows box.

For your reference:

http://kreelbits.blogspot.com/2012/03/windows-network-load-balancing-nlb-and.html

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Best Regards,

Candy