MAC Addresses on NLB Cluster

With my colleague we were working  on strange NLB cluster issue and were discussing Layer 2 data transmission and strange MAC addresses on NLB cluster. My colleague brought an interesting point to my attention

Distribution of Cluster Traffic

Network Load Balancing uses layer-two broadcast or multicast to simultaneously distribute incoming network traffic to all cluster hosts.


In its default unicast mode of operation, Network Load Balancing reassigns the station address (“MAC” address) of the network adapter for which it is enabled (called the cluster adapter), and all cluster hosts are assigned the same MAC address. Incoming packets are thereby received by all cluster hosts and passed up to the Network Load Balancing driver for filtering. To insure uniqueness, the MAC address is derived from the cluster’s primary IP address entered in the Network Load Balancing Properties dialog box. For a primary IP address of, the unicast MAC address is set to 02-BF-1-2-3-4. Network Load Balancing automatically modifies the cluster adapter’s MAC address by setting a registry entry and then reloading the adapter’s driver; the operating system does not have to be restarted.


Network Load Balancing provides a second mode for distributing incoming network traffic to all cluster hosts. Called multicast mode, this mode assigns a layer two multicast address to the cluster adapter instead of changing the adapter’s station address. The multicast MAC address is set to 03-BF-1-2-3-4 for a cluster’s primary IP address of Since each cluster host retains a unique station address, this mode alleviates the need for a second network adapter for communication between cluster hosts, and it also removes any performance penalty from the use of dedicated IP addresses.

More information is here: Network Load Balancing Technical Overview


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: