ethtool and offloads - link-layer diagnostics

ethtool is the link-layer diagnostic tool. It talks directly to the NIC driver and exposes the state that the kernel does not normally show: speed, duplex, offloads, ring buffers, driver-private settings. When “the network is slow” points to layer 1 or 2, ethtool is the first tool to reach for.

Basic inspection

ethtool eth0                  # everything for eth0
ethtool -S eth0               # statistics counters
ethtool -i eth0               # driver info
ethtool -k eth0               # offload features
ethtool -g eth0               # ring buffer sizes
ethtool -c eth0               # interrupt coalescing
ethtool -l eth0               # combined / queue count
ethtool -m eth0               # module (SFF/SFP) info, if fibre
ethtool --show-priv-flags eth0   # driver-private flags

Output of ethtool eth0:

Settings for eth0:
    Supported ports: [ TP ]
    Supported link modes:   10baseT/Half 10baseT/Full
                            100baseT/Half 100baseT/Full
                            1000baseT/Full
                            10000baseT/Full
    Supported pause frame use: No
    Supports auto-negotiation: Yes
    Supported FEC modes: Not reported
    Advertised link modes:  10baseT/Half 10baseT/Full
                            ...
    Advertised pause frame use: No
    Advertised auto-negotiation: Yes
    Speed: 10000Mb/s
    Duplex: Full
    Port: Twisted Pair
    PHYAD: 0
    Transceiver: internal
    Auto-negotiation: on
    MDI-X: Unknown
    Supports Wake-on: pumbg
    Wake-on: d
        Current message level: 0x00000007 (7)
               drv probe link
    Link detected: yes

The most important lines:

• Speed: actual negotiated speed. If the link is at 100 Mb/s when the switch is 10 Gb/s, autonegotiation failed.
• Duplex: Full or Half. Half duplex on a modern network is almost always a problem.
• Auto-negotiation: on or off. Mismatched autoneg is the #1 cause of “link is slow” tickets.
• Link detected: yes or no. If no, the link is down.

Common offload settings

Modern NICs do work in hardware to relieve the CPU:

ethtool -k eth0 | head -20     # show all offloads
ethtool -K eth0 tso off        # disable TSO
ethtool -K eth0 gro off        # disable GRO
ethtool -K eth0 rxvlan off     # disable VLAN stripping

Disable offloads only with a specific reason: they cost CPU but help throughput.

Ring buffers

The NIC ring buffer holds packets between the NIC and the kernel:

ethtool -g eth0                # show current and max
ethtool -G eth0 rx 4096        # set rx ring to 4096

A small ring buffer drops packets under load (visible as RX dropped in -S). Increase when there is CPU headroom and packet drops are seen.

Statistics

ethtool -S eth0 shows every counter the driver exposes:

     rx_packets: 12345678
     tx_packets: 8765432
     rx_bytes:   9876543210
     tx_bytes:   1234567890
     rx_crc_errors: 0
     rx_frame_errors: 0
     rx_length_errors: 0
     rx_over_errors: 0
     rx_fifo_errors: 0
     rx_missed_errors: 0
     tx_aborted_errors: 0
     tx_carrier_errors: 0
     tx_fifo_errors: 0
     tx_heartbeat_errors: 0
     tx_window_errors: 0
     rx_errors: 0
     tx_errors: 0
     rx_dropped: 0
     tx_dropped: 0
     multicast: 12345
     collisions: 0

The errors to watch:

• rx_crc_errors: frame check sequence errors. Cable problem, bad SFP, EMI.
• rx_frame_errors: misaligned frames. Cable or speed mismatch.
• rx_fifo_errors: NIC FIFO overrun. Ring buffer too small or CPU too slow.
• rx_missed_errors: packets dropped because no buffer was available.
• tx_carrier_errors: physical layer problem (no carrier).

Any non-zero error count sustained over time is a problem.

Common diagnoses

“The link is slow”:

ethtool eth0 | grep -E 'Speed|Duplex|Auto-negotiation'

If speed is 100 Mb/s instead of 10 Gb/s, autonegotiation failed. Check the switch port, the cable, and the NIC driver.

“Packets are being dropped”:

ethtool -S eth0 | grep -E 'dropped|missed|fifo'

Sustained drops = ring buffer too small or CPU saturated.

“Captures show bad checksums”:

This is usually checksum offload - the NIC computes the checksum as the packet leaves, so captures on the wire show zero checksums. The packet is correct; the capture is just “before the NIC finished”. Disable with ethtool -K eth0 tx-checksumming off to verify.

“Link is up but no traffic”:

ethtool eth0 | grep 'Link detected'
ip link show eth0

If Link detected: yes but no traffic, the issue is higher up the stack.

Knowledge check