<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi group.</div>
<div> </div>
<div>What issues are known concerning interoperability between WinPcap and Network Load Balancing in Windows?</div>
<div> </div>
<div>I occasionally perform a packet capture to troubleshoot client problems. Noticed an anomaly with captures on Windows servers running Network Load Balancing. Here are my observations:</div>
<div> </div>
<div>The lab consists of the following:</div>
<div> </div>
<div>4 servers</div>
<div>1 firewall appliance with 1:1 configured for the NLB IP address</div>
<div>8 clients</div>
<div> </div>
<div>From any server in this lab farm:</div>
<div>Inbound traffic is captured correctly from the NLB NIC. I see all traffic inbound from clients to web apps hosted on these servers and know that traffic is going to the correct NIC.</div>
<div><b>**</b><b>Outbound traffic </b><b>on the NLB NIC </b><b>is not </b><b>recorded</b><b>.</b><b> </b><b>This holds true whether the capture is in promiscuous mode or not.</b><b>**</b></div>
<div>Inbound and outbound traffic are recorded normally on the dedicated NIC for each server as they communicate with each other behind the firewall.</div>
<div>On the client side, a corresponding packet capture shows that clients see server traffic from the NLB IP address just fine.</div>
<div>From the firewall, I see inbound and outbound communication from each server’s NLB NIC, which further suggests that traffic is passing normally.</div>
<div>My web apps work normally, and affinity is being maintained. </div>
<div> </div>
<div>These observations hold true whether I am using Wireshark or WinDump, which is why I am asking the WinPcap group.</div>
<div> </div>
<div>My environment:</div>
<div> </div>
<div>WinPcap 4.1.2, as bundled with Wireshark 1.8.3</div>
<div>Cisco ASA 5505 (meh, it’s a lab.)</div>
<div>4 HP ProLiant servers</div>
<div>HP NC326i dual port adapter (Broadcom), tested driver versions are 14.2.0.5 from 2010 and 15.2.0.8 from 2012.</div>
<div>Both a dedicated NIC and a clustered NIC are configured.</div>
<div>NLB has the following attributes:</div>
<ul style="margin:0;padding-left:36pt;">
<li>Four servers converged</li><li>Unicast mode</li><li>Port rules defined for 80 and 443</li><li>Multi host with Single affinity</li></ul>
<div> </div>
<div>I searched known bugs / issues and probably missed a checkbox somewhere or something. Any thoughts? Multicast deal?</div>
<div> </div>
<div>Thanks,</div>
<div> </div>
<div>James</div>
<div> </div>
<div> </div>
</span></font>
</body>
</html>