diff --git a/roles/kube_prometheus_stack/README.md b/roles/kube_prometheus_stack/README.md
index e069671..ee45fa8 100644
--- a/roles/kube_prometheus_stack/README.md
+++ b/roles/kube_prometheus_stack/README.md
@@ -113,7 +113,35 @@
 
 ## Alerts
 
-### `etcdDatabaseHighFragmentationRatio`
+### Network
+
+#### `NodeNetworkMulticast`
+
+This alert is triggered when a node is receiving large volumes of multicast
+traffic which can be a sign of a misconfigured network or a malicious actor.
+
+This can result in high CPU usage on the node and can cause the node to become
+unresponsive.  Also, it can be the cause of a very high amount of software
+interrupts on the node.
+
+In order to find the root cause of this issue, you can use the following
+commands:
+
+```console
+iftop -ni $DEV -f 'multicast and not broadcast'
+```
+
+With the command above, you're able to see which IP addresses are sending the
+multicast traffic.  Once you have the IP address, you can use the following
+command to find the server behind it:
+
+```console
+openstack server list --all-projects --long -n --ip $IP
+```
+
+### etcd
+
+#### `etcdDatabaseHighFragmentationRatio`
 
 ```console
 kubectl -n kube-system exec svc/kube-prometheus-stack-kube-etcd -- \
diff --git a/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet b/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
index 3300e66..a6126f6 100644
--- a/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
+++ b/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
@@ -169,6 +169,24 @@
         ],
       },
       {
+        name: 'network',
+        rules: [
+          {
+            alert: 'NodeNetworkMulticast',
+            expr: 'rate(node_network_receive_multicast_total[1m]) > 1000',
+            'for': '5m',
+            labels: {
+              severity: 'critical',
+            },
+            annotations: {
+              summary: 'High multicast traffic on node {{ $labels.instance }}: {{ $value }} packets/sec',
+              description: 'This can result in high software interrupt load on the node which can bring network performance down.',
+              runbook_url: 'https://github.com/vexxhost/atmosphere/tree/main/roles/kube_prometheus_stack#NodeNetworkMulticast'
+            },
+          },
+        ],
+      },
+      {
         name: 'softnet',
         rules: [
           {