Windows 2000 Network Load Balancing for Web Clusters

Microsoft Windows 2000 Advanced Server and Datacenter Server implement Network Load Balancing (NLB) as a software-based clustering technology designed to scale and provide fault tolerance for IP-based applications, primarily web servers. This article explains the core mechanics of Windows 2000 NLB, detailing its driver-level architecture, packet filtering algorithms, convergence process, and session affinity options.

Driver-Level Architecture

Windows 2000 implements NLB as an intermediate network driver (Wlbs.sys) that resides between the physical Network Interface Card (NIC) driver and the upper-level TCP/IP protocol stack. Because it operates within the Network Driver Interface Specification (NDIS) layer, NLB is fully transparent to both client browsers and web applications running on Internet Information Services (IIS).

Distributed Packet Filtering

Unlike hardware load balancers that intercept and redirect traffic, Windows 2000 NLB operates on a fully distributed architecture with no single point of failure or centralized dispatcher.

All incoming TCP/IP requests destined for the cluster’s virtual IP (VIP) address are delivered simultaneously to every server (node) in the cluster. Each node's NLB driver runs a stateless, deterministic hashing algorithm that evaluates the incoming packet's source IP address, source port, destination IP address, and destination port. Based on predefined port rules and node weightings, the algorithm determines which single host is responsible for the connection. The assigned host passes the packet up to the TCP/IP stack for processing, while all other hosts drop the packet immediately at the driver level.

Unicast and Multicast Modes

Windows 2000 NLB coordinates packet delivery across the cluster using two primary addressing modes:

  • Unicast Mode: NLB replaces the original MAC address of each network adapter with a shared, virtual cluster MAC address. To prevent switch MAC address conflicts, nodes communicate with each other using a dedicated, secondary NIC or masked MAC addressing.
  • Multicast Mode: NLB retains the adapter's original MAC address and assigns an additional multicast MAC address for cluster traffic. This allows intra-cluster communication on a single adapter while delivering incoming web requests to all nodes.

Convergence and Fault Tolerance

High availability is maintained through periodic heartbeat messages exchanged between all cluster hosts across the local subnet.

If a web server fails or fails to send heartbeats within a designated timeout period (typically five seconds), the remaining nodes initiate a process called convergence. During convergence, the surviving members determine the new cluster membership, redistribute the hashing algorithm's workload, and resume processing incoming traffic. The entire convergence process typically completes within a few seconds without administrative intervention.

Client Affinity and State Management

For web applications requiring session persistence, Windows 2000 NLB provides client affinity settings within its port rules:

  • No Affinity: Successive requests from the same client can be directed to different cluster nodes, optimal for stateless static web pages.
  • Single Affinity: Directs all requests from a specific client IP address to the same cluster host, preserving session state and cookie data.
  • Class C Affinity: Directs all clients within the same Class C IP subnet to the same host, accommodating clients using proxy server arrays with rotating outbound IP addresses.