MULTICAST - Multicast Traffic

Method description

A method to detect IPv4 multicast traffic based on the use of:

• Multicast addresses (224.0.0.0 to 239.255.255.255)

• Directed broadcast addresses (X.Y.Z.255)

• All-host broadcast address (255. 255. 255. 255)

• IPv6 multicast (ff00::/8)

Detection of directed broadcast and all-host broadcast traffic can be suppressed by setting the option IgnoreBroadcast to the value “Yes”. A minimum number of multicast requests to be reported can be set using the option MinimalAttempts (this threshold is always evaluated). The condition used in detection is met when at least one of the thresholds (MaxBPP or MinTransferred) is exceeded. If some of these thresholds are equal to zero, the other one has to be satisfied. If both of these thresholds are equal to zero, they are ignored.

This method consists of the following submethod:

• MulticastDetection: Reports the presence of multicast or broadcast traffic in the monitored network in an unexpected or high volume.

Method configuration

In case of network problems associated with multicast traffic, it is recommended to apply this method network-wide for all communication in the network regardless of IP addresses. The right place for traffic monitoring is the Internet connection line or the central switch.

Method parameters

• IgnoreBroadcast: Omission of broadcast and IPv6 all-host multicast within the detection.

• MinimalAttempts: Threshold for a minimal count of multicast (or broadcast) connections.

• MaxBPP: Maximal average value of bytes per packet (this metric is not used if the parameter is set to 0).

• MinPPS: Minimal average value of packets per second (this metric is used only together with the MaxBPP parameter).

• MinTransferred: Minimal amount of data transferred to Multicast or Broadcast IP addresses (in MiB).

Assigned filter

The filter is used for restricting source IP addresses.

Interpretation of results

This method reliably alerts the IP addresses on the network that generate multicast traffic.