Our website relies on funding from our readers, and we may receive a commission when you make a purchase through the links on our site.

Post image for Quick Tips: How to Monitor Multicast Traffic with NetFlow Traffic Analyzer

Quick Tips: How to Monitor Multicast Traffic with NetFlow Traffic Analyzer

by Aaron Leskiw, CCDA, CCNA, MCSE, ITILv3, MCSA, A+ - Last Updated: August 30, 2023

Problem: Streaming media applications consume a lot of bandwidth, because they use multicast to deliver content.  In most cases, the applications that are using multicast to deliver their content are not business critical applications.  However, there are time s when streaming media IS the mission critical app and so needs to be prioritized.

Answer:  NetFlow Traffic Analyzer from SolarWinds is the only version of NetFlow that accurately records multicast traffic for both ingress and egress directions.  Unfortunately, earlier versions of NetFlow do not support egress monitoring or account for the outbound traffic after replication.  NetFlow V9 enables you to add bandwidth or implement QOS policies to restrict bandwidth usage.

STEP 1: Enable INGRESS and EGRESS

  • Ingress flows have a destination interface of 0 or “null” and so only a single flow is exported
  • Egress flows will show the destination interfaces and multiple flows are exported. Multicast traffic does NOT yield egress traffic.

STEP 2: Ensure Memory Capacity

HEAVY TRAFFIC can definitely put a load on your switch or router memory.  Before turning on NetFlow for multicast monitoring, ensure plenty of memory capacity.   For heavy traffic you should upgrade router memory.

STEP 3: Increase Global Flow Hash Table (For Heavy Traffic)

  • NetFlow has a maximum cache size of 65,536 flow record entries.
  • Each entry is 64 Bytes long and Netflow Multicast accounting adds 16 Bytes to deduce the packet-replication factor to each record bringing the total to 80 Bytes.

Recommended: SolarWinds NetFlow Traffic Analyzer provides more robust monitoring of NetFlow, J-Flow, and sFlow® data.  Download the fully-functional free trial here and use it to get full visibility into your traffic in under an hour.

SolarWinds NetFlow Traffic Analyzer

Monitor Multicast Traffic with NetFlow Traffic Analyzer FAQs

Can NetFlow version 9 be used to monitor multicast traffic?

Yes, NetFlow version 9 can be used to monitor multicast traffic by providing detailed information on the source and destination addresses, ports, and protocols of multicast traffic flows.

What are some of the benefits of monitoring multicast traffic with NetFlow version 9?

Some of the benefits of monitoring multicast traffic with NetFlow version 9 include identifying the sources of multicast traffic, detecting potential issues with multicast traffic, and optimizing network performance by identifying and resolving any bottlenecks or inefficiencies in multicast traffic.

How do you enable NetFlow version 9 for multicast traffic monitoring?

To enable NetFlow version 9 for multicast traffic monitoring, you need to configure your network devices, such as routers or switches, to export NetFlow data to a NetFlow collector. You can then use a NetFlow analyzer tool to analyze the NetFlow data and monitor multicast traffic.

What types of network devices can be used to export NetFlow data for multicast traffic monitoring?

A wide range of network devices can be used to export NetFlow data for multicast traffic monitoring, including routers, switches, firewalls, and load balancers.

What types of NetFlow analyzers can be used for multicast traffic monitoring?

A variety of NetFlow analyzers can be used for multicast traffic monitoring, including open-source solutions such as nfdump and commercial solutions such as SolarWinds NetFlow Traffic Analyzer and Plixer Scrutinizer.

What types of data can be collected and analyzed by NetFlow version 9 for multicast traffic monitoring?

NetFlow version 9 can collect and analyze a wide range of data for multicast traffic monitoring, including source and destination IP addresses, ports, protocols, packet sizes, and more.