With my colleague we were working on strange NLB cluster issue and were discussing Layer 2 data transmission and strange MAC addresses on NLB cluster. My colleague brought an interesting point to my attention
Distribution of Cluster Traffic
Network Load Balancing uses layer-two broadcast or multicast to simultaneously distribute incoming network traffic to all cluster hosts.
In its default unicast mode of operation, Network Load Balancing reassigns the station address (“MAC” address) of the network adapter for which it is enabled (called the cluster adapter), and all cluster hosts are assigned the same MAC address. Incoming packets are thereby received by all cluster hosts and passed up to the Network Load Balancing driver for filtering. To insure uniqueness, the MAC address is derived from the cluster’s primary IP address entered in the Network Load Balancing Properties dialog box. For a primary IP address of 220.127.116.11, the unicast MAC address is set to 02-BF-1-2-3-4. Network Load Balancing automatically modifies the cluster adapter’s MAC address by setting a registry entry and then reloading the adapter’s driver; the operating system does not have to be restarted.
Network Load Balancing provides a second mode for distributing incoming network traffic to all cluster hosts. Called multicast mode, this mode assigns a layer two multicast address to the cluster adapter instead of changing the adapter’s station address. The multicast MAC address is set to 03-BF-1-2-3-4 for a cluster’s primary IP address of 18.104.22.168. Since each cluster host retains a unique station address, this mode alleviates the need for a second network adapter for communication between cluster hosts, and it also removes any performance penalty from the use of dedicated IP addresses.
More information is here: Network Load Balancing Technical Overview