When using windows load balancing, windows will create a virtual mac address which will be used for the real ip’s AND the virtual ip.
So if you look in your arp table you’ll see 3 ip’s, from which 2 are use on 2 servers and 1 is virtual, with the same mac address.

And now the really bad part: Windows will use different (non default) mac addresses on the interface, so the switch on which the servers are connected will see those mac address (different per server). But NOT the mac address used for the server and cluster ip’s. So, as soon as the incoming packets reach the switch, it does not know what to do with it and it will start flooding the whole vlan…
As you can read here, Microsoft does this on purpose…. *ARGH*