1. A method comprising: determining whether a multicast message has been received, the message including a destination address; examining a local filtering store for a match for the destination address; sending the message to a number of virtual machines if a match for the address is found; analyzing a filtering store of at least one of the virtual machines for a match for the address if a match is not found in the local filtering store; dropping the message if a match for the destination address is not found in the local filtering store and the filtering stores of the virtual machines; sending the message to a number of the virtual machines if a match for the address is found in a filtering store of one of the virtual machines; and identifying the virtual machines to analyze for a match for the destination address.