# Managing sources in MediaConnect
A source in MediaConnect can be anything that provides a live video feed, such as the following:
+ An on-premises encoder
+ Another AWS Elemental MediaConnect flow
+ An AWS Elemental MediaLive output
+ A playout system (cloud-based or on-premises)
For a list of supported protocols that you can use for your source, see [Protocols](protocols.md).
From the MediaConnect console, you can view Amazon CloudWatch metrics to [monitor the source health](monitor-source-health.md) of an active flow.
**Topics**
+ [Using NDI® sources in a MediaConnect flow](sources-using-ndi.md)
+ [Adding a second source to an existing MediaConnect flow](source-adding.md)
+ [Updating the source of a MediaConnect flow](source-update.md)
+ [Source failover on a MediaConnect flow](source-failover.md)
+ [Managing tags on a MediaConnect source](sources-manage-tags.md)
+ [Removing a source from a MediaConnect flow](source-remove.md)
+ [Source ports on MediaConnect flows](source-ports.md)
+ [Determining a source's peer IP address](source-ip-address.md)
# Using NDI® sources in a MediaConnect flow
AWS Elemental MediaConnect can ingest [Network Device Interface (NDI®)](https://ndi.video/tech/), a protocol for high-quality, low-latency video and audio over IP networks, and convert it into MPEG transport streams. This capability enables direct content ingestion within your network, connecting IP-based video production systems with traditional contribution workflows.
Using NDI sources, you can create streamlined production workflows that take content from your NDI-enabled production systems—such as cameras, vision mixers, and graphics engines—and ingest it directly into a MediaConnect flow from your Virtual Private Cloud (VPC). MediaConnect then converts this NDI input into transport streams, which can be distributed to traditional broadcast infrastructure using protocols like SRT or Zixi. This integration works with your existing NDI infrastructure, requiring no modifications to your current VPC setup.
## Key points
### Understanding NDI terminology
In video and audio workflows, the terms **source** and **output** have specific meanings that vary between contexts. Understanding these differences helps you work with NDI sources across your production workflow.
+ In MediaConnect flows:
+ A **source** is the entry point of a flow. **NDI sources** ingest NDI content into your flow from an upstream NDI sender.
+ An **output** is the exit point of a flow. **NDI outputs** send NDI content from your flow to a downstream NDI receiver.
+ In NDI implementation:
+ An **NDI sender** is a network endpoint that sends video and audio streams over IP networks using the NDI protocol.
+ From the perspective of your MediaConnect flow, the NDI sender is the upstream device that provides content to your flow’s NDI source.
+ When you add an NDI source to your MediaConnect flow, MediaConnect acts as an NDI receiver by connecting to an NDI sender in your network. Your flow can then convert this content for distribution through traditional broadcast protocols.
### How NDI sources work
At a high level, here’s how your content moves through MediaConnect when you use NDI sources in your flows:
1. Set up your VPC infrastructure with at least one NDI discovery server and active NDI senders within the VPC.
1. Create a large-sized flow with an NDI source, configuring your discovery servers and the NDI source settings.
1. Start your flow to discover the NDI senders that are broadcasting content within your VPC.
1. Connect to your selected NDI sender to start receiving content into your flow.
1. Convert and distribute the content through your flow outputs using transport stream protocols such as SRT or Zixi.
This workflow maintains compatibility with NDI-based production systems while adding the flexibility and networking advantages of traditional broadcast distribution.
### Considerations and limitations
When planning your NDI source implementation in MediaConnect, keep in mind the following.
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/mediaconnect/latest/ug/sources-using-ndi.html)
## Next steps
To get started, [create a flow](flows-create-ndi.md) with an NDI source.
## Additional resources
+ [Flow sizes and capabilities](flow-sizes-capabilities.md)
+ [Best practices](best-practices.md)
# Adding a second source to an existing MediaConnect flow
For transport stream flows, you can add a second source for failover. Both sources on the flow must use the same protocol. (However, you can have one source that uses RTP and the other that uses RTP-FEC.) For more information about source failover, see [Source failover](source-failover.md).
The method you use to add a second source to a flow is dependent on the type of source that you want to use:
+ [Standard source](source-adding-standard.md) – Uses content from any source that is not a VPC source or an entitled source.
+ [VPC source](source-adding-vpc.md) – Uses content that comes from a VPC that you configure.
MediaConnect doesn't support two sources on the following types of flow:
+ Flows with an entitled source
+ Flows with a CDI source
+ Flows with an NDI® source
For redundancy with ST 2110 JPEG XS sources, you can specify two inbound VPC interfaces on an individual media stream. For redundancy with CDI sources, create a second flow.
From the MediaConnect console, you can view Amazon CloudWatch metrics to [monitor the source health](monitor-source-health.md) of an active flow.
# Adding a standard source to an existing MediaConnect flow
You can add a second source to an existing flow for failover. Both sources on the flow must use the same protocol. (However, you can have one source that uses RTP and the other that uses RTP-FEC.) For more information about source failover, see [Source failover](source-failover.md).
**To add a standard source to an existing flow (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that you want to update.
1. Choose the **Source** tab.
1. In the **Source failover configuration** section, choose **Edit**.
1. In the **Edit source failover configuration** window, make sure that **Failover** is set to **Active**.
**Note**
If you activate failover on a flow that is running, you might encounter a brief interruption in the flow output.
1. In the **Failover mode** drop-down menu, select the mode to use with your source protocol. For a list of the modes supported by each protocol, see [Failover support for source protocols in MediaConnect](source-failover.md#source-failover-table)
1. For **Recovery window**, specify the size of the buffer (delay) that you want the service to maintain. A larger buffer means a longer delay in transmitting the stream, but more room for error correction. A smaller buffer means a shorter delay, but less room for error correction. You can choose a value from 100–15000 ms. If you keep this field blank, MediaConnect uses the default value of 200 ms.
1. Choose **Update**.
1. In the **Sources** section, choose **Add**.
1. For **Name**, specify a name for your source. This value is an identifier that is visible only on the MediaConnect console.
1. For **Source type**, choose **Standard source**.
1. Determine which protocol your source uses.
**Note**
All sources on a flow must use the same protocol. However, you can have one source that uses RTP and the other that uses RTP-FEC.
1. For specific instructions based on your protocol, choose one of the following tabs:
------
#### [ RIST ]
1. For **Protocol**, choose **RIST**.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
**Note**
The RIST protocol requires one additional port for error correction. To accommodate this requirement, MediaConnect reserves the port that is \$11 from the port that you specify. For example, if you specify port 4000 for the output, the service assigns ports 4000 and 4001.
1. For **Allowlist CIDR**, specify a range of IP addresses that are allowed to contribute content to your source. Format the IP addresses as a Classless Inter-Domain Routing (CIDR) block, for example, 10.24.34.0/23. For more information about CIDR notation, see [RFC 4632](https://tools.ietf.org/html/rfc4632).
**Important**
Specify a CIDR block that is as precise as possible. Include only the IP addresses that you want to contribute content to your flow. If you specify a CIDR block that is too wide, it allows for the possibility of outside parties sending content to your flow.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Maximum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 1–15,000 ms. If you keep this field blank, MediaConnect uses the default value of 2,000 ms.
------
#### [ RTP or RTP-FEC ]
1. For **Protocol**, choose **RTP** or **RTP-FEC**.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
**Note**
The RTP-FEC protocol requires two additional ports for error correction. To accommodate this requirement, MediaConnect reserves the ports that are \$12 and \$14 from the port that you specify. For example, if you specify port 4000 for the output, the service assigns ports 4000, 4002, and 4004.
1. For **Allowlist CIDR**, specify a range of IP addresses that are allowed to contribute content to your source. Format the IP addresses as a Classless Inter-Domain Routing (CIDR) block, for example, 10.24.34.0/23. For more information about CIDR notation, see [RFC 4632](https://tools.ietf.org/html/rfc4632).
**Important**
Specify a CIDR block that is as precise as possible. Include only the IP addresses that you want to contribute content to your flow. If you specify a CIDR block that is too wide, it allows for the possibility of outside parties sending content to your flow.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
------
#### [ SRT listener ]
1. For **Protocol**, choose **SRT listener**.
1. For **Source description**, enter a description that will remind you later where this source is from. This might be the company name or notes about the setup.
1. For **Allowlist CIDR block**, specify a range of IP addresses that are allowed to contribute content to your source. Format the IP addresses as a Classless Inter-Domain Routing (CIDR) block, for example, 10.24.34.0/23. For more information about CIDR notation, see [RFC 4632](https://tools.ietf.org/html/rfc4632).
**Important**
Specify a CIDR block that is as precise as possible. Include only the IP addresses that you want to contribute content to your flow. If you specify a CIDR block that is too wide, it allows for the possibility of outside parties sending content to your flow.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
1. For **Source listener address**, enter the address MediaConnect will use for the SRT connection. The address can be an IP address or a domain name.
1. For **Maximum bitrate** (optional), specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Minimum latency**, specify the minimum size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 10–15,000 ms. If you keep this field blank, MediaConnect uses the default value of 2,000 ms.
The SRT protocol uses a **minimum latency** configuration on each side of the connection. The larger of these two values is used as the *recovery latency*. If the transmitted bitrate, multiplied by the recovery latency, is higher than the *receiver buffer*, the buffer will overflow and the stream can fail with a `Buffer Overflow Error`. On the SRT receiver side, the receiver buffer is configured by the SRTO\$1RCVBUF value. The size of the receiver buffer is limited by the *flow control window size* (SRTO\$1FC) value. On the MediaConnect side, the receiver buffer is calculated as the **maximum bitrate** value multiplied by the **minimum latency** value. For more information about the SRT buffer, see [the SRT Configuration Guidelines.](https://github.com/Haivision/srt/blob/master/docs/API/configuration-guidelines.md)
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
------
#### [ SRT caller ]
1. For **Protocol**, choose **SRT caller**.
1. For **Source description**, enter a description that will remind you later where this source is from. This might be the company name or notes about the setup.
1. For **Source listener address**, enter the address MediaConnect will use for the SRT connection. The address can be an IP address or a domain name.
1. For **Source listener port**, enter the port MediaConnect will use for the SRT connection.
1. For **Maximum bitrate** (optional), specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Minimum latency**, specify the minimum size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 10–15,000 ms. If you keep this field blank, MediaConnect uses the default value of 2,000 ms.
The SRT protocol uses a **minimum latency** configuration on each side of the connection. The larger of these two values is used as the *recovery latency*. If the transmitted bitrate, multiplied by the recovery latency, is higher than the *receiver buffer*, the buffer will overflow and the stream can fail with a `Buffer Overflow Error`. On the SRT receiver side, the receiver buffer is configured by the SRTO\$1RCVBUF value. The size of the receiver buffer is limited by the *flow control window size* (SRTO\$1FC) value. On the MediaConnect side, the receiver buffer is calculated as the **maximum bitrate** value multiplied by the **minimum latency** value. For more information about the SRT buffer, see [the SRT Configuration Guidelines.](https://github.com/Haivision/srt/blob/master/docs/API/configuration-guidelines.md)
1. For **Stream ID** (optional), enter an identifier for the stream. This identifier can be used to communicate information about the stream.
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
------
#### [ Zixi push ]
1. For **Protocol**, choose **Zixi push**.
AWS Elemental MediaConnect populates the value of the inbound port.
1. For **Allowlist CIDR**, specify a range of IP addresses that are allowed to contribute content to your source. Format the IP addresses as a Classless Inter-Domain Routing (CIDR) block, for example, 10.24.34.0/23. For more information about CIDR notation, see [RFC 4632](https://tools.ietf.org/html/rfc4632).
**Important**
Specify a CIDR block that is as precise as possible. Include only the IP addresses that you want to contribute content to your flow. If you specify a CIDR block that is too wide, it allows for the possibility of outside parties sending content to your flow.
1. For **Stream ID**, specify the stream ID set in the Zixi feeder.
**Important**
The stream ID must match the value set in the Zixi feeder. If you leave this field blank, MediaConnect uses the source name as the stream ID. If the stream ID is not exactly the same as the source name, you must manually enter the stream ID.
1. For **Maximum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 0–60,000 ms. If you keep this field blank, the service uses the default value of 6,000 ms.
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Decryption type**, choose **Static key**.
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
1. For **Decryption algorithm**, choose the type of encryption that was used to encrypt the source.
------
#### [ Zixi push for AWS Elemental Link UHD device ]
After creating the additional Zixi push source, you must configure the AWS Elemental Link device using MediaLive. See the following MediaLive setup instructions to complete the process after you have created the source: [Using a device in a flow](https://docs.aws.amazon.com/medialive/latest/ug/device-use-flow.html) in the *MediaLive User Guide*. Ensure you have access to both MediaConnect and MediaLive to complete these steps.
**Note**
Zixi push for AWS Elemental Link UHD devices only supports failover mode. Merge mode is not supported.
1. For **Protocol**, choose **Zixi push**.
AWS Elemental MediaConnect populates the value of the inbound port.
1. For **Allowlist CIDR**, specify a range of IP addresses that are allowed to contribute content to your source. Format the IP addresses as a Classless Inter-Domain Routing (CIDR) block, for example, 10.24.34.0/23. For more information about CIDR notation, see [RFC 4632](https://tools.ietf.org/html/rfc4632).
**Important**
If you know the range of public IP addresses that your Link device uses to connect to the internet, enter that CIDR block. Note that this is not the same as the IP address of the AWS Elemental Link device. If you cannot obtain this information, it is possible to configure the CIDR block to be open to all possible IP addresses by using 0.0.0.0/0. Typically, it is not best practice to assign a CIDR block that is open to the entire internet (0.0.0.0/0). However, if this method must be used, the data being transferred is encrypted using AES-128 encryption.
1. For **Maximum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value between 0 and 60,000 ms. If you keep this field blank, the service uses the default value of 6,000 ms. The **Maximum latency** value should match the **Latency** value configured on the AWS Elemental Link device. For information on configuring the Link device's latency, see: [Configuring the device](https://docs.aws.amazon.com/medialive/latest/ug/device-edit.html) in the *AWS Elemental MediaLive User Guide*
1. For **Decryption**, choose **Activate** and do the following:
1. For **Decryption type**, choose **Static key**.
1. For **Decryption algorithm**, choose **AES-128**. AWS Elemental Link requires AES-128, do not select another algorithm.
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
------
1. Choose **Save**.
# Adding a VPC source to an existing MediaConnect flow
You can add a second source to an existing transport stream flow for failover. Both sources on the flow must be binary identical (come from the same encoder) and they must use the same protocol. (However, you can have one source that uses RTP and the other that uses RTP-FEC.) For more information about source failover, see [Source failover](source-failover.md).
**Important**
Before you start this procedure, make sure that you completed the following steps:
In Amazon VPC, set up your VPC and associated security groups. For more information about VPCs, see the [Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/). For information about configuring security groups to work with your VPC interface, see [Security group considerations](vpc-interface-security-groups.md).
In IAM, [set up MediaConnect as a trusted service](security-iam-trusted-entity.md).
If the source of your flow requires encryption, [set up encryption](encryption-static-key-set-up.md).
[Stop your flow](https://docs.aws.amazon.com/mediaconnect/latest/ug/flows-stop.html) or make sure that it's in a standby state. You can't add VPC interfaces to an active flow.
MediaConnect doesn't support two sources on CDI flows. For redundancy with ST 2110 JPEG XS sources, you can specify two inbound VPC interfaces on an individual media stream. For redundancy with CDI sources, create a second flow.
**To add a VPC source to an existing flow (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that you want to update.
1. Choose the **Source** tab.
1. In the **Source failover configuration** section, choose **Edit**.
1. In the **Edit source failover configuration** window, make sure that **Failover** is set to **Enabled**.
**Note**
If you enable failover on a flow that is running, you might encounter a brief interruption in the flow output.
1. For **Recovery window**, specify the size of the buffer (delay) that you want the service to maintain. A larger buffer means a longer delay in transmitting the stream, but more room for error correction. A smaller buffer means a shorter delay, but less room for error correction. You can choose a value from 100–15000 ms. If you keep this field blank, MediaConnect uses the default value of 200 ms.
1. Choose **Update**.
1. In the **Sources** section, choose **Add source**.
1. For **Name**, specify a name for your source. This value is an identifier that is visible only on the MediaConnect console.
1. For **Source type**, choose **VPC source**.
1. Determine which protocol your source uses.
**Note**
All sources on a flow must use the same protocol. However, you can have one source that uses RTP and the other that uses RTP-FEC.
1. For specific instructions based on your protocol, choose one of the following tabs:
------
#### [ RIST ]
1. For **Protocol**, **RIST** will automatically be selected.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
**Note**
The RIST protocol requires one additional port for error correction. To accommodate this requirement, MediaConnect reserves the port that is \$11 from the port that you specify. For example, if you specify port 4000 for the output, the service assigns ports 4000 and 4001.
1. For **VPC interface name**, choose the name of the VPC interface that you want to use as the source.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Maximum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 1–15,000 ms. If you keep this field blank, MediaConnect uses the default value of 2,000 ms.
------
#### [ RTP or RTP-FEC ]
1. For **Protocol**, choose **RTP** or **RTP-FEC**.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
**Note**
The RTP-FEC protocol requires two additional ports for error correction. To accommodate this requirement, MediaConnect reserves the ports that are \$12 and \$14 from the port that you specify. For example, if you specify port 4000 for the output, the service assigns ports 4000, 4002, and 4004.
1. For **VPC interface name**, choose the name of the VPC interface that you want to use as the source.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
------
#### [ SRT listener ]
1. For **Protocol**, **SRT listener** will automatically be selected.
1. For **Source description**, enter a description that will remind you later where this source is from. This might be the company name or notes about the setup.
1. For **VPC interface name**, choose the name of the VPC interface that you want to use as the source.
1. For **Inbound port**, specify the port that the flow listens on for incoming content.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Minimum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 10 -15,000 ms. If you keep this field blank, the service uses the default value of 2,000 ms.
The SRT protocol uses a **minimum latency** configuration on each side of the connection. The larger of these two values is used as the *recovery latency*. If the transmitted bitrate, multiplied by the recovery latency, is higher than the *receiver buffer*, the buffer will overflow and the stream can fail with a `Buffer Overflow Error`. On the SRT receiver side, the receiver buffer is configured by the SRTO\$1RCVBUF value. The size of the receiver buffer is limited by the *flow control window size* (SRTO\$1FC) value. On the MediaConnect side, the receiver buffer is calculated as the **maximum bitrate** value multiplied by the **minimum latency** value. For more information about the SRT buffer, see [the SRT Configuration Guidelines.](https://github.com/Haivision/srt/blob/master/docs/API/configuration-guidelines.md)
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
------
#### [ SRT caller ]
1. For **Protocol**, **SRT caller** will automatically be selected.
1. For **Source description**, enter a description that will remind you later where this source is from. This might be the company name or notes about the setup.
1. For **VPC interface name**, choose the name of the VPC interface that you want to use as the source.
1. For **Source listener port**, enter the port MediaConnect will use for the SRT connection.
1. For **Source listener address**, enter the address MediaConnect will use for the SRT connection. The address can be an IP address or a domain name.
1. For **Maximum bitrate**, specify the maximum expected bitrate (in bits per second) for the flow. We recommend that you specify a value that is twice the actual bitrate. The lowest value that you can enter in this field is 100 Kbps.
1. For **Minimum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 10 -15,000 ms. If you keep this field blank, the service uses the default value of 2,000 ms.
The SRT protocol uses a **minimum latency** configuration on each side of the connection. The larger of these two values is used as the *recovery latency*. If the transmitted bitrate, multiplied by the recovery latency, is higher than the *receiver buffer*, the buffer will overflow and the stream can fail with a `Buffer Overflow Error`. On the SRT receiver side, the receiver buffer is configured by the SRTO\$1RCVBUF value. The size of the receiver buffer is limited by the *flow control window size* (SRTO\$1FC) value. On the MediaConnect side, the receiver buffer is calculated as the **maximum bitrate** value multiplied by the **minimum latency** value. For more information about the SRT buffer, see [the SRT Configuration Guidelines.](https://github.com/Haivision/srt/blob/master/docs/API/configuration-guidelines.md)
1. For **Stream ID** (optional), enter an identifier for the stream. This identifier can be used to communicate information about the stream.
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
------
#### [ Zixi push ]
1. For **Protocol**, **Zixi push** will automatically be selected.
AWS Elemental MediaConnect populates the value of the inbound port.
1. For **VPC interface name**, choose the name of the VPC interface that you want to use as the source.
1. For **Stream ID**, specify the stream ID set in the Zixi feeder.
**Important**
The stream ID must match the value set in the Zixi feeder. If you leave this field blank, MediaConnect uses the source name as the stream ID. If the stream ID is not exactly the same as the source name, you must manually enter the stream ID.
1. For **Maximum latency**, specify the size of the buffer (delay) that you want the service to maintain. A higher latency value means a longer delay in transmitting the stream, but more room for error correction. A lower latency value means a shorter delay, but less room for error correction. You can choose a value from 0–60,000 ms. If you keep this field blank, the service uses the default value of 6,000 ms.
1. If the source is encrypted, choose **Enable** in the **Decryption** section and do the following:
1. For **Decryption type**, choose **Static key**.
1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role).
1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key).
1. For **Decryption algorithm**, choose the type of encryption that was used to encrypt the source.
------
1. Choose **Save**.
# Updating the source of a MediaConnect flow
Updating the source of a flow allows you to modify where your content comes from without having to create a new flow. For most flows, you can make these updates even while the flow is running.
## Prerequisites
Depending on the type of update you want to make, there are some steps to complete before you get started.
**If you're updating a flow with an entitled source**
You can't update an entitled flow while it's active. Before you update the flow source, you must [stop the flow first](https://docs.aws.amazon.com/mediaconnect/latest/ug/flows-stop.html). After you make your updates, you can then restart the flow.
**If you're switching between an NDI® source and a transport stream source**
You can update the flow source while it's either active or on standby.
+ **When changing to an NDI source**
Before you update the flow source, you must edit the flow first and change the flow size from medium to large.
+ **When changing to a transport stream source**
Your flow size will remain as large after you update the source type. If you want to downgrade the flow size, you'll need to edit the flow afterwards as a separate step.
## Procedure
The following procedure guides you through the process of updating a flow source.
**To update the source of an existing flow (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that you want to update.
1. Choose the **Source** tab.
1. Choose the source that you want to update.
1. Choose **Update**.
1. Make the appropriate changes, and then choose **Update source**.
**To update the source of an existing flow (AWS CLI)**
+ In the AWS CLI, use the **update-flow-source** command:
```
aws mediaconnect update-flow-source --flow-arn arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:AwardsShow --source-arn arn:aws:mediaconnect:us-east-1:111122223333:source:2-3aBC45dEF67hiJ89-c34de5fG678h:AwardsShowSource --allowlist-cidr 10.24.34.0/24 --profile PMprofile
```
# Source failover on a MediaConnect flow
Source failover is a setup that involves two redundant sources for a transport stream flow. This redundancy helps to minimize disruption to your video stream. To use source failover, you specify two sources for the flow, then choose one of two options for the failover mode: *Merge* or *Failover*.
+ Merge mode combines the sources into a single stream, allowing a graceful recovery from any single-source loss. If you set the failover mode to *Merge*, you can set the recovery window, which is the size of the buffer (delay) that you want MediaConnect to maintain. A larger recovery window means a longer delay in transmitting the stream, but more room for error correction. A smaller recovery window means a shorter delay, but less room for error correction. Sources used this way need to be *binary identical*, which means that they need to have originated from the same encoder. MediaConnect must also receive content from the two sources at the same time. Additionally, if the sources use RTP protocol, they must have RTP headers with aligned sequence numbers and they must also comply with the SMPTE ST 2022-7 standard.
**Note**
SMPTE ST 2022-7 is a standard developed by the Society of Motion Picture and Television Engineers (SMPTE) group. The ST 2022-7 standard defines a method that replaces missing packets with packets in an identical, redundant stream. This type of failover requires a small latency buffer in your workflow to allow time for MediaConnect to recover packets from the two streams.
+ Failover mode allows switching between a primary and a backup stream. This switching facilitates an easy transition to a more reliable stream. If you set the failover mode to *Failover*, you can specify a source as the primary source. The second source serves as the backup. If you don’t specify a primary source, MediaConnect treats both sources with equal priority, and switches to the available source as needed.
MediaConnect uses the two modes of failover in the following ways:
+ In the *Merge* mode, MediaConnect uses content from both sources. The flow randomly selects one of the sources to start with. If that source is missing a packet, the flow pulls the missing packet from the other source. For example, if the flow is using source A and packet 123 is missing, MediaConnect pulls in packet 123 from source B and continues using source A. In this mode, the two sources are binary identical/ST 2022-7 compliant.
+ In the *Failover* mode, if you don't specify a primary source, MediaConnect randomly uses one of the sources to provide content for the flow. If MediaConnect does not receive data from the source for 500 milliseconds, the flow switches to the other source, and can continue switching back and forth between sources as needed. If you do specify a primary source, MediaConnect uses that source to provide content for the flow. The flow switches to the other source if the primary source does not send data for 500 milliseconds, and switches back to the primary source as soon as data returns.
**Note**
MediaConnect doesn't support source failover on CDI flows, on NDI® flows, or on entitlement flows. For more information about creating redundancy with CDI flows, visit: [Creating a flow that uses a CDI source](flows-create-cdi.md). Additionally, you cannot add a second source to an existing flow for failover if you are using the Zixi pull protocol.
## Failover support for source protocols in MediaConnect
The following table describes which source protocols support failover.
| Protocol | Does this protocol support source failover? | How many sources can be added? | Supported failover modes |
| --- | --- | --- | --- |
| RIST | Yes | 2 | Merge or failover |
| RTP | Yes | 2 | Merge or failover |
| RTP-FEC | Yes | 2 | Merge or failover |
| SRT listener | Yes | 2 | Failover only |
| SRT caller | Yes | 2 | Failover only |
| Zixi pull | No | None - Zixi pull cannot be used as a source. | Source failover is not supported |
| Zixi push | Yes | 2 | Merge or failover |
| Zixi push for AWS Elemental Link UHD | Yes | 2 | Failover only |
| CDI | No | 1 | Source failover is not supported |
| ST 2110 JPEG XS | No | 1 | Source failover is not supported |
| Entitlement flows | No | 1 | Source failover is not supported |
| NDI**®** Speed HQ | No | 1 | Source failover is not supported |
# Managing tags on a MediaConnect source
You can use tags to help you track the billing and organization for your AWS Elemental MediaConnect flows, sources, outputs, and entitlements. These are the same tags that AWS Billing and Cost Management provides for organizing your AWS bill. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*.
**Topics**
+ [Adding tags on a MediaConnect source](sources-manage-tags-add.md)
+ [Editing tags on a MediaConnect source](sources-manage-tags-edit.md)
+ [Removing tags from a MediaConnect source](sources-manage-tags-remove.md)
# Adding tags on a MediaConnect source
Use tags to help you track the billing and organization for your AWS Elemental MediaConnect sources. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*.
**To add tags to a source (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that is associated with the source that you want to add tags to.
1. Choose the **Sources** tab.
A list of sources for that flow appears.
1. Choose the source that you want to add tags to.
1. Choose **Manage tags**.
1. Choose **Manage tags** again, and then choose **Add tag**.
1. For each tag that you want to add, do the following:
1. Enter a key and a value. For example, your key can be **sports** and your value can be **golf**.
1. Choose **Add tag**.
1. Choose **Update**.
# Editing tags on a MediaConnect source
Use tags to help you track the billing and organization for your AWS Elemental MediaConnect sources. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*.
**To edit tags on a source (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that is associated with the source that you want to edit tags for.
1. Choose the **Sources** tab.
A list of sources for that flow appears.
1. Choose the source that you want to edit tags for.
1. Choose **Manage tags**.
1. Choose **Manage tags** again.
1. Update the tags, as needed.
1. Choose **Update**.
# Removing tags from a MediaConnect source
You can remove a tag from a source if you no longer want to use it to track the billing and organization for it.
**To remove tags from a source (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow that is associated with the source that you want to remove tags from.
1. Choose the **Sources** tab.
A list of sources for that flow appears.
1. Choose the source that you want to remove tags from.
1. Choose **Manage tags**.
1. Choose **Manage tags** again.
1. Choose **Remove tag** next to each tag that you want to delete.
1. Choose **Update**.
# Removing a source from a MediaConnect flow
If a flow has more than one source, you can remove one of the sources even when the flow is currently running.
**To remove a source from a flow (console)**
1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/).
1. On the **Flows** page, choose the name of the flow.
1. Choose the **Source** tab.
1. Choose the source that you want to remove.
1. Choose **Remove**.
# Source ports on MediaConnect flows
Each source on a flow must use a different port (for exceptions to this, see the note). Some protocols require additional ports for error correction. For sources that use these protocols, AWS Elemental MediaConnect automatically reserves the additional ports that are needed. All MediaConnect protocols use UDP ports. The following table lists which additional ports, if any, the service reserves.
**Important**
There is an exception to the port requirements for sources that use the Zixi protocol. For standard Zixi sources, all sources use port 2088. For VPC Zixi sources, the sources will use an inbound port range of 2090-2099. The 2090-2099 port range is reserved exclusively for Zixi VPC sources and cannot be used by another source protocol. The VPC Zixi source port is assigned by MediaConnect when the source is created.
****
| Protocol | Ports needed | Ports required |
| --- | --- | --- |
| CDI | Port | The port that you specify. This is the only port needed for the source. |
| RIST | Port and port\$11 | The port that you specify, plus one additional port. MediaConnect automatically reserves a port that is \$11 from the port that you specified. For example, if you specify port 3000 for this output, the service also reserves port 3001. |
| RTP | Port | The port that you specify. This is the only port needed for the output. |
| RTP-FEC | Port, port\$12, and port\$14 | The port that you specify, plus two additional ports. MediaConnect automatically reserves ports that are \$12 and \$14 from the port that you specified. For example, if you specify port 2000 for this output, the service also reserves ports 2002 and 2004 for error correction. |
| SRT listener | Port | The port that you specify. This is the only port needed for the source. |
| SRT caller | Port | The port that you specify. This is the only port needed for the source. |
| ST 2110 JPEG XS | Port | The port that you specify. This is the only port needed for the source. |
| Zixi push | Port | For standard sources: MediaConnect automatically uses port 2088.**For VPC sources**: MediaConnect automatically assigns a port in the range of 2090-2099 when the source is created. The 2090-2099 port range is reserved exclusively for Zixi VPC sources and cannot be used by another source protocol. |
| NDI**®** | Port | The ports that you specify for each media stream. If you don't specify a custom port, MediaConnect uses the default NDI discovery protocol (TCP-5959) to announce NDI sources on your network. |
# Determining a source's peer IP address
A source peer IP address shows which device is currently sending content to your flow. This information is valuable for troubleshooting and monitoring, as it helps you to diagnose connectivity issues on your own without having to contact AWS support.
For example, you can use the source peer IP address to do the following:
+ Verify that the expected source is connected
+ Troubleshoot connection issues
+ Monitor security by ensuring content is coming from expected IPs
## Finding a source’s peer IP address
You can view the current peer IP address for each of your flow sources in the MediaConnect console, or by using the [DescribeFlow](https://docs.aws.amazon.com/mediaconnect/latest/api/API_DescribeFlow.html) API operation.
**To determine a source’s peer IP address**
1. On the **Flows** page, choose the name of the flow that you want to view.
1. Choose the **Sources** tab.
1. Select the source that you want to view, and then choose **Details**.
1. Under **Peer IP Address**, note the peer IP address.
**Note**
For SRT caller sources, the peer IP address matches the IP address that you configured during setup. This is because MediaConnect initiates the connection to this pre-defined IP address. MediaConnect reports this address to provide a complete picture of your flow's configuration.
For protocols with dynamic peers (like RTP sources, RIST sources, and SRT listener sources), the peer IP address reflects the current state of the flow, showing the address of the device currently sending traffic to your source.
### Important information about peer IP addresses
**Peer IP display and updates**
+ For troubleshooting purposes, MediaConnect shows the latest IP address information in near real-time.
+ Although most updates happen quickly, it might take up to 20 seconds for peer IP address changes to be reflected in the console and API responses.
+ Only the current peer IP address is displayed. Historical records aren't currently available.
+ The peer IP address might not be visible for flows that haven't been started yet, or flows that were started before May 2025. In these cases, you might need to restart your flow to see the peer IP information.
**Supported protocols and source types**
+ Peer IP addresses are shown for most protocols, including both pre-configured and dynamic connections
+ Peer IP addresses aren't available for:
+ Entitlements
+ CDI/ST2110 sources