View flow logs for multicast

This page describes support for multicast traffic in VPC Flow Logs.

VPC Flow Logs samples packets in your Virtual Private Cloud (VPC) network to generate flow logs. Flow logs are aggregated by IP connection (5-tuple).

You can view flow logs in Cloud Logging, and you can export logs to any destination that Cloud Logging export supports. These logs can be used for network monitoring, forensics, security analysis, and expense optimization. For example, multicast producers can use log-based metrics to track packet loss for multicast consumers. For more information, see the Log-based metrics overview in the Cloud Logging documentation.

For more information, see the VPC Flow Logs overview.

VPC Flow Logs records for multicast

The following table summarizes the unique information included in VPC Flow Logs records for multicast traffic depending on whether the reporter of the flow is a multicast producer or a multicast consumer.

Flow reporter	Description of logs
Multicast producer	For multicast producers, VPC Flow Logs generates two sets of flow logs: Regular flow logs that correspond to the aggregate traffic sent to multicast consumers. These flow logs include information about the corresponding multicast domain and group range so that you can observe throughput from a multicast producer to a group. Per-consumer flow logs that provide observability for individual multicast consumers. These flow logs include information about the corresponding multicast domain and group range, per-consumer latency, and per-consumer packet loss. To help ensure accurate loss and latency measurements, multicast producers must set a unique IP ID per packet. For details, see Record format for multicast producers.
Multicast consumer	VPC Flow Logs records include the following information: The corresponding multicast domain and group range. You you can use these logs to observe throughput from a multicast group to the multicast consumer. For details, see Record format for multicast consumers.

Flow reporter

Description of logs

Multicast producer

For multicast producers, VPC Flow Logs generates two sets of flow logs:

Regular flow logs that correspond to the aggregate traffic sent to multicast consumers. These flow logs include information about the corresponding multicast domain and group range so that you can observe throughput from a multicast producer to a group.
Per-consumer flow logs that provide observability for individual multicast consumers. These flow logs include information about the corresponding multicast domain and group range, per-consumer latency, and per-consumer packet loss. To help ensure accurate loss and latency measurements, multicast producers must set a unique IP ID per packet.

For details, see Record format for multicast producers.

Multicast consumer

VPC Flow Logs records include the following information:

The corresponding multicast domain and group range. You you can use these logs to observe throughput from a multicast group to the multicast consumer.

For details, see Record format for multicast consumers.

Record format for multicast producers

This section describes the unique fields and field format differences in VPC Flow Logs records for multicast traffic when the reporter of the flow is a multicast producer.

For a full list of fields in VPC Flow Logs records, see About VPC Flow Logs records.

For a given multicast producer flow, VPC Flow Logs generates up to three flow log records for the same traffic:

A regular log record. This record corresponds to aggregate traffic to a group and is always generated.
A per-consumer latency log record. This record is typically always generated. However, in rare cases when 100% packet loss occurs during the aggregation interval, this record isn't generated.
A per-consumer packet loss record. This record is generated only if packet loss occurs.

For details about the fields in each log record, see the following table.

Field	Field format	Field type: Base or optional metadata
log_type	string If the log is a per-consumer log, this field is populated with a value of `PER_MULTICAST_CONSUMER_PRODUCER_LOG`. Otherwise, this field isn't populated.	Base
disposition	string Applies to per-consumer logs. If the log represents packet loss, this field is populated with a value of `DROPPED`. Otherwise, this field isn't populated.	Base
drop_reason	string Applies to per-consumer logs. If the value of the `disposition` field is `DROPPED`, this field is populated with a value of `LOST_IN_TRANSIT`. Otherwise, this field isn't populated.	Base
one_way_network_latencies	Latencies Applies to per-consumer logs. If the `disposition` isn't populated, meaning there is no packet loss, this field is populated with one-way network latency in milliseconds with sub-millisecond precision as measured during the aggregation interval. If not populated, the measurement isn't available.	Base
rtt_msec	Not populated for multicast traffic.	Base
round_trip_time	Not populated for multicast traffic.	Base
bytes_sent	int64 Populated as follows: If the `disposition` field isn't populated, this field is the estimated number of user payload bytes sent from the multicast producer to the consumer. If the `disposition` field is populated with a value of `DROPPED`, this field is the estimated number of user payload bytes dropped. Consider an example in which a multicast producer sends 1000 bytes, but 100 bytes are dropped. In this case, two separate per-consumer logs are generated: one with `bytes_sent: 900`, and one with `bytes_sent: 100`.	Base
packets_sent	int64 Populated as follows: If the `disposition` field isn't populated, this field is the estimated number of packets sent from the multicast producer to the consumer. If the `disposition` field is populated with a value of `DROPPED`, this field is the estimated number of packets dropped. Consider an example in which a multicast producer sends 100 packets, but 10 packets are dropped. In this case, two separate per-consumer logs are generated: one with `packets_sent: 90`, and one with `packets_sent: 10`.	Base
Source and destination metadata fields
dest_multicast_group_range	MulticastGroupDetails If the destination of the flow is a multicast group IP address and reporter of the flow is a multicast producer, then this field is populated with multicast domain and group range details.	Metadata
dest_instance	InstanceDetails Populated as follows: If the multicast producer and consumer are in the same project, or if they are in the same organization but separate projects and cross-project annotations are enabled, this field is populated with no differences from the regular format. If the multicast producer and consumer are in separate projects and cross-project annotations disabled, this field is populated with alternative consumer identifiers as described in InstanceDetails field format differences.	Metadata
dest_vpc	VpcDetails Populated as follows: If the multicast producer and consumer are in the same project, or if they are in the same organization but separate projects and cross-project annotations are enabled, this field is populated with no differences from the regular format. If the multicast producer and consumer are in separate projects and cross-project annotations disabled, this field is populated with alternative consumer identifiers described in VpcDetails field format differences.	Metadata

Latencies field format

Field	Type	Description
median_msec	double	The median latency as measured during the aggregation interval.

MulticastGroupDetails field format

Field	Type	Description
project_id	string	The ID of the multicast administrator project.
location	string	The zone of the multicast producer.
name	string	The name of the multicast group range that contains the group IP address that traffic was sent to.
domain	string	The name of the multicast domain that contains the group range.

InstanceDetails field format differences

If the multicast producer and consumer are in separate projects and cross-project annotations are disabled, the following identifiers are used for the destination instance. These fields are populated because the regular string fields vm_name and project_id aren't available.

Field	Type	Description
instance_id	int64	Integer ID of the instance.
project_number	int64	Project number for the instance.

VpcDetails field format differences

If the multicast producer and consumer are in separate projects and cross-project annotations are disabled, the following identifiers are used for the destination VPC network. These fields are populated because the regular string fields vpc_name or project_id aren't available.

Field	Type	Description
vpc_id	int64	Integer ID of the VPC network.
project_number	int64	Project number for the VPC network.

Record format for multicast consumers

The following table describes the unique fields and field format differences in VPC Flow Logs records for multicast traffic when the reporter of the flow is a multicast consumer.