Hi group. What issues are known concerning interoperability between WinPcap and Network Load Balancing in Windows?
I occasionally perform a packet capture to troubleshoot client problems. Noticed an anomaly with captures on Windows servers running Network Load Balancing. Here are my observations: The lab consists of the following: 4 servers 1 firewall appliance with 1:1 configured for the NLB IP address 8 clients >From any server in this lab farm: Inbound traffic is captured correctly from the NLB NIC. I see all traffic inbound from clients to web apps hosted on these servers and know that traffic is going to the correct NIC. **Outbound traffic on the NLB NIC is not recorded. This holds true whether the capture is in promiscuous mode or not.** Inbound and outbound traffic are recorded normally on the dedicated NIC for each server as they communicate with each other behind the firewall. On the client side, a corresponding packet capture shows that clients see server traffic from the NLB IP address just fine. >From the firewall, I see inbound and outbound communication from each server's >NLB NIC, which further suggests that traffic is passing normally. My web apps work normally, and affinity is being maintained. These observations hold true whether I am using Wireshark or WinDump, which is why I am asking the WinPcap group. My environment: WinPcap 4.1.2, as bundled with Wireshark 1.8.3 Cisco ASA 5505 (meh, it's a lab.) 4 HP ProLiant servers HP NC326i dual port adapter (Broadcom), tested driver versions are 14.2.0.5 from 2010 and 15.2.0.8 from 2012. Both a dedicated NIC and a clustered NIC are configured. NLB has the following attributes: * Four servers converged * Unicast mode * Port rules defined for 80 and 443 * Multi host with Single affinity I searched known bugs / issues and probably missed a checkbox somewhere or something. Any thoughts? Multicast deal? Thanks, James
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
