Q. An extra network adapter shows up in my Windows Server 2008 failover cluster. What is it?

A. With its enhancements to multisite clustering, Server 2008 required an enhanced capability to handle cluster communications, formally known as the private network. Microsoft created the Microsoft Failover Cluster Virtual Adapter (NetFT), which binds to the most appropriate cluster network configured to allow cluster communication. NetFT manifests itself as an additional network connection on the server and all nodes in the cluster. NetFT binds to the same "network adapter" on all nodes in the cluster.

If you look at the Network Connections applet in Control Panel, you won't see NetFT, but if you run the command "ipconfig /all" you'll see the full details of the additional network connection. NetFT's description will say that the connection is the Microsoft Failover Cluster Virtual Adapter, as shown below.

Ethernet adapter Local Area Connection* 9:Connection-specific DNS Suffix . :Description . . . . . . . . . . . : Microsoft Failover Cluster Virtual AdapterPhysical Address. . . . . . . . . : 02-50-8D-B6-0E-02DHCP Enabled. . . . . . . . . . . : NoAutoconfiguration Enabled . . . . : YesLink-local IPv6 Address . . . . . : fe80::20e3:9481:ae86:83c5%21(Preferred)IPv4 Address. . . . . . . . . . . : 169.254.2.63(Preferred)Subnet Mask . . . . . . . . . . . : 255.255.0.0Default Gateway . . . . . . . . . :DHCPv6 IAID . . . . . . . . . . . : 453136525DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-10-2F-C2-A3-00-50-8D-B6-0E-01DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1fec0:0:0:ffff::2%1fec0:0:0:ffff::3%1NetBIOS over Tcpip. . . . . . . . : Enabled

Notice the NetFT adapter has its own IP address from the Automatic Private IP Addressing (APIPA)/AutoNet range of 169.254.x.x. This address isn't actually used for data transfer; the IP address of the physical adapter NetFT is bound to is used for all communication. Any traffic sent over the NetFT adapter also shows as traffic on the physical adapter NetFT is bound to, as that's the adapter the traffic is really sent over. An example is shown here.

In the example, I have two nodes, node1 and node2, with Cluster Shared Volume (CSV)-enabled storage that's connected via iSCSI. The example picture was taken on the non-coordinator node (node2) of the cluster. I also mounted a separate LUN on node2, so you could see traffic not going via CSV.

The first traffic (red) is a file copy locally on node2 to the mounted iSCSI LUN, which only shows traffic via iSCSI. The second traffic (blue) is where I shared out the additional LUN on node2 and performed a file copy to the share from another computer. You can see data on the physical network adapter (RealTek) that is receiving the data sent to the share. You can also see traffic on the iSCSI as node2 takes the data being sent to the share and writes it.

The third traffic (yellow) is a file copy locally on node2 to the CSV storage. At this point, you might expect to see traffic sent over iSCSI, but because this is a file copy, it actually has to be sent to the co-coordinator node (node1) for the I/O. This means the data is sent over the NetFT adapter, which is bound to RealTek, so you the file copy over the NetFT (Local Area Connection*), so it is sent using the RealTek adapter. If the file copying had been within a virtual machine using direct I/O, you would see data transfer on the iSCSI.

I'll discuss more about which adapter is used to transfer data in a future FAQ. The important thing to take away here is that any data sent over NetFT will also show as traffic on the adapter NetFT is bound to, but traffic sent directly to the adapter NetFT binds to doesn't show as traffic on the NetFT virtual NIC.

For more on NetFT, see the following video:


Related Reading:

Videos:

Check out hundreds more useful Q&As like this in John Savill's FAQ for Windows. Also, watch instructional videos made by John at ITTV.net.