General rule for a NLB Cluster which applies to each host in the cluster:
 
1. All port rules (range) defined in a host cluster must be unique across the cluster.
2. Host priority (Default Host) must be unique across the cluster.
3. Cluster mode must be unique across the cluster: either Unicast or Multicast.
 
A cluster node maintains a statistical mapping of port rules with associated Virtual IP of the cluster. I will give an port rule example and then explain how it works in cluster when an incoming TCP/IP packet arrives to cluster hosts. I have configured the following port rule at one of the cluster host:
 
Host 1
Port Range: 80 to 80
Protocol: TCP
Host ID: 1
Filtering Mode: Multiple, Load Weight: 70
Virtual IP 10.0.0.1
 
Host 2
Port Range: 80 to 80
Protocol: TCP
Host ID: 2
Filtering Mode: Multiple, Load Weight: 30
Virtual IP 10.0.0.1
 
After configuring port rules on cluster hosts, all the hosts simultaneously invoke a process called “Convergence Process”. The main objective of this process to check any inconsistency in the rule defined for that cluster and also designates a host as the Default Host in case of a host fails to converge successfully. After convergence process has finished all the hosts will maintain a list of statistical mappings in the local computer as portrayed below:
 
Statistical mapping on Host 1 Counter = 1
Host Name Port Range Protocol Host ID Filtering Mode Load Weight Virtual IP Flag
Host 1 80 To 80 TCP 1 Multiple 70 10.0.0.1 1
Host 2 80 To 80 TCP 2 Multiple 30 10.0.0.1 1
 
Statistical mapping on Host 2 Counter = 1
Host Name Port Range Protocol Host ID Filtering Mode Load Weight Virtual IP Flag
Host 2 80 To 80 TCP 2 Multiple 30 10.0.0.1 1
Host 1 80 To 80 TCP 1 Multiple 70 10.0.0.1 1
 
Note: These two hosts are running IIS to host a company web site called CSC.com and this site is mapped to 10.0.0.1 virtual IP Address.
 
How a host does this internally when a client sends traffic for configured port rule
 
Let’s take an example: A client running Windows 2000 or XP open up a browser and type the www.csc.com.

1.	Request is forwarded to the cluster IP Address (10.0.0.1).
2.	Cluster receives the traffic at Network Layer where the NLB driver service sits and watches for an incoming packet.
3.	All hosts simultaneously receive this packet and look in its statistical mapping to see if the traffic is covered in the port rules defined or not.
4.	If traffic is covered in the port rule then it checks whether this host has already served or not. The Flag column indicates the status of host whether this host served the last traffic or not. The Flag will be incremented by 1 if this host had served the last traffic. For example: if Host 1 receives the traffic, it will serve the client and then increment the Flag by 1.
5.	In this example, Host 1 receives the packet/traffic and other hosts discard the packet.
6.	If the traffic is not covered by the port rule then the only host will receive the traffic which has been designated as the Default Host. This is identified by the Host ID in statistical mapping.
7.	After Host 1 has served the request the statistical mapping on that host will look like below:

 
Statistical mapping on Host 1 after serving client Counter = 2
 
Host Name Port Range Protocol Host ID Filtering Mode Load Weight Virtual IP Flag
Host 2 80 To 80 TCP 2 Multiple 30 10.0.0.1 1
Host 1 80 To 80 TCP 1 Multiple 70 10.0.0.1 2
 
You notice that Flag value has been incremented by 1 to make sure this host doesn’t receive the next traffic for the configured port rules. This host will service the next traffic only when the Host 2 has served the second request after Host 1.
 
Please note: There are other things a host consider when receiving the incoming traffic. For example, checking Filtering Mode if configured for a single host or disabled for the configured port rules, Client Affinity, multiple Virtual IP Addresses in a single cluster, Host Priority ID (which is different from Host ID), Mode of the Host (Unicast, Multicast and IGMP), Layer 2 and Layer 3 switch.