Quick Tips: How to Monitor Multicast Traffic with NetFlow Version 9


Problem: Streaming media applications consume a lot of bandwidth, because they use multicast to deliver content.  In most cases, the applications that are using multicast to deliver their content are not business critical applications.  However, there are time s when streaming media IS the mission critical app and so needs to be prioritized.

Answer:  NetFlow Version 9 is the only version of NetFlow that accurately records multicast traffic for both ingress and egress directions.  Unfortunately, earlier versions of NetFlow do not support egress monitoring or account for the outbound traffic after replication.  NetFlow V9 enables you to add bandwidth or implement QOS policies to restrict bandwidth usage.


  • Ingress flows have a destination interface of 0 or “null” and so only a single flow is exported
  • Egress flows will show the destination interfaces and multiple flows are exported. Multicast traffic does NOT yield egress traffic.

STEP 2: Ensure Memory Capacity

HEAVY TRAFFIC can definitely put a load on your switch or router memory.  Before turning on NetFlow for multicast monitoring, ensure plenty of memory capacity.   For heavy traffic you should upgrade router memory.

STEP 3: Increase Global Flow Hash Table (For Heavy Traffic)

  • NetFlow has a maximum cache size of 65,536 flow record entries.
  • Each entry is 64 Bytes long and Netflow Multicast accounting adds 16 Bytes to deduce the packet-replication factor to each record bringing the total to 80 Bytes.

Recommended: SolarWinds Orion NetFlow Traffic Analyzer provides more robust monitoring of NetFlow, J-Flow, and sFlow® data.  Download the fully-functional free trial here and use it to get full visibility into your traffic in under an hour.