In some examples, a network device includes an interface, and a processor to apply a restriction on multicast communication associated with an entity on the interface. The restriction on multicast communication includes detecting, on the interface, a multicast communication pattern associated with the entity, indicating, based on the multicast communication pattern on the interface violating a threshold, that the entity is malicious, and blocking processing of the multicast communication associated with the entity in response to indicating that the entity is malicious.