WLBS Cluster Appears to Stop Servicing Clients (258609)

CAUSE

By default, WLBS masks the cluster's virtual media access control (VMAC) address when sending packets to prevent a switch from learning the VMAC address and associating it with a port (for WLBS to work properly, packets going to the virtual IP address must reach all cluster hosts). If the switch associates the VMAC address with a port, packets going to the virtual IP address are sent to just the cluster host that is connected to the port on which the switch created the association in its index table.

The full Microsoft Systems Management Server (SMS) version of Network Monitor (Netmon) binds to the adapter below the WLBS NDIS miniport driver and has a security feature that emits Logical Link Control (LLC) frames when capturing data to warn other computers in the local area network (LAN) that packets are being sniffed. Because these LLC frames originate from the Netmon driver below the WLBS driver, WLBS has no chance to mask the VMAC address. The switch would then add an entry in its Index table mapping the VMAC address to the port from which it received the LLC frame. Packets with a destination of the virtual IP address would only reach the host that sent the LLC frame. This host would not service clients that are supposed to be serviced by the other cluster hosts.