MS NLB incoming frame destination mac address

Sergey Mayorov 1 Reputation point


Is it normal behavior when in wireshark on NLB server (NLB Multicast) I see in incoming frame destination mac address is unicast address(local network adapter) not multicast? If I capture this frame befor it leav port on switch it has multicast address in destination mac address field. Does MS NLB make a substitution value in destination mac address field of incoming ethernet frame?

excuse me for my poor english

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,083 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 39,336 Reputation points

    Hello there,

    In unicast mode, NLB uses the NLB MAC address to replace the original hardware MAC address of each adapter in each node of the cluster and this seems to be behavior by design.

    This article describes how the different Network Load Balancing (NLB) operation modes affect network infrastructure and the best ways in which the network can support each mode.

    Configure network infrastructure to support the NLB operation mode


    --If the reply is helpful, please Upvote and Accept it as an answer–