Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a MS NLB cluster (Win 2003) which includes just two hosts. The cluster is configured to use Multicast operation mode (not IGMP).

For some reason I am seeing packets intended for the NLB cluster

Destination: MS-NLB-VirtServer-Multicast_bd:1a:0f:04 (03:ce:bd:1a:0f:04)

landing on all the servers on the LAN. Is it normal? Can something be done to get rid of them? We don't control the switch, but I could ask the guys to tweak it, if I knew what to ask

share|improve this question (Search for switch flooding) – Ryan Ries Jan 3 '13 at 15:56
up vote 4 down vote accepted

This is perfectly normal. From a general standpoint, multicast traffic is analogous to broadcast traffic. Multicast traffic is sent to all switch ports. Hosts that aren't interested in the multicast traffic ignore it. In order to "scope" the multicast traffic to only those hosts that are interested you'll need to configure IGMP snooping.

share|improve this answer
Thanks joeqwerty – Afanasii Jan 4 '13 at 8:38
Glad to help... – joeqwerty Jan 6 '13 at 5:56

If you don't use IGMP, then the switch doesn't know which ports are members of the multicast group. Therefore, the packets are flooded to all ports. You need to get IGMP turned on and configured with the virtual MAC of the NLB cluster.

share|improve this answer
Thanks longneck (I would have ticked your answer as "acceptable" if it allowed multiple ticks. joeqwerty's answer seems a bit better phrased) – Afanasii Jan 4 '13 at 8:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.