Bug 297172 - ng_netflow exports unicast routing information instead of multicast forwarding info for multicast flows
Summary: ng_netflow exports unicast routing information instead of multicast forwardin...
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 15.1-RELEASE
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-net (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-30 17:51 UTC by Gerhard Heusinkveld
Modified: 2026-07-30 23:53 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gerhard Heusinkveld 2026-07-30 17:51:33 UTC 
While investigating NetFlow accounting for IPTV multicast traffic, I observed that exported NetFlow records contain output interface and next-hop information derived from the unicast routing table rather than from the multicast forwarding path.

The test environment consists of:

              Internet
                  |
              vlan02
                  |
             IGMP Proxy
                  |
              vlan05
                  |
              IPTV STB

The IPTV stream is received on vlan02 and forwarded by the multicast forwarding subsystem to vlan05 (IPTV STB).

Observed NetFlow record

Example exported flow:

Source Address      : 217.166.225.124
Destination Address : 224.0.251.124

INPUT_SNMP          : 8
OUTPUT_SNMP         : 13
IP_NEXT_HOP         : 185.93.175.230

where

interface 8 is vlan02
interface 13 is pppoe0 (instead of vlan05)

Experiments

To eliminate the possibility that another NetFlow instance produced the exported flow, all NetFlow nodes were disabled except the node attached to vlan05.

ngctl list showed:

netflow_vlan05

with no active NetFlow nodes attached to any other interface.

Despite this, the exported multicast flow still contained:

INPUT_SNMP  = 8
OUTPUT_SNMP = 13
IP_NEXT_HOP = 185.93.175.230

This indicates that these values are generated by the ng_netflow implementation itself and are not inherited from another NetFlow instance.

From the code, it seems that OUTPUT_SNMP and IP_NEXT_HOP are derived from a unicast routing lookup even if this is multicast.

It is unclear whether this is intended behaviour or an omission in the multicast handling. The ng_netflow manual page does not describe how multicast traffic is exported or how these fields are determined for multicast flows.