Skip to main content
RunBook Academy

← All break/fix scenarios in OPNsense

intermediateNetworking~25 min

Break/Fix: Interface Packet Loss From Driver or Duplex Mismatch

Reported symptoms

  • ●Throughput on one interface is below expected; latency is high
  • ●netstat -I <iface> shows a growing input error or drop counter
  • ●Ping works but bulk transfers are slow

Evidence

  • · netstat -I ix0: input errors 12480, drops 3200
  • · ifconfig ix0 media: 1000baseT full-duplex (but peer reports 1000baseT half-duplex)
  • · tcpdump -ni ix0 shows fragmented or undersized frames
Diagnosis and resolutionclick to reveal

Root cause

A duplex mismatch, failing NIC, saturated ring buffer, or bad cable/SFP is dropping frames before they reach the firewall. The most common case is auto-negotiation falling back to half-duplex on one side while the other stays full-duplex.

Remediation

1. On the firewall: ifconfig <iface> media 1000baseT mediaopt full-duplex to force full-duplex, or hard-set the peer switch port to match. 2. Replace the cable or SFP and re-test. 3. If the driver supports it, raise the ring buffer (e.g. hw.ix.max_rx_ring=4096 via loader.conf.local). 4. Capture on the interface to look for CRC errors and runt frames.

Verification

netstat -I <iface> shows zero input errors and drops under load; throughput matches the expected budget; ping latency is stable.

Prevention

Disable auto-negotiation on firewall-facing switch ports and hard-set 1000/full or 10000/full. Document the agreed media/speed/duplex per port. Monitor per-interface input errors and drops in your observability stack — even a small CRC rate is the early signal of a failing cable or SFP.

Scenario

You are operating an OPNsense edge with traffic anomalies on one interface. The following symptoms appear:

  • Throughput on one interface is below expected; latency is high
  • netstat -I <iface> shows a growing input error or drop counter
  • Ping works but bulk transfers are slow

Available evidence:

  • netstat -I ix0: input errors 12480, drops 3200
  • ifconfig ix0 media: 1000baseT full-duplex (but peer reports 1000baseT half-duplex)
  • tcpdump -ni ix0 shows fragmented or undersized frames

Your task

Determine the cause, recover, document, and validate.

Investigation

The investigation follows the discipline taught in Part XXXVI:

  1. Form hypothesis, find evidence, test, validate.
  2. Use the available evidence above to bound the search.
  3. Reach one of the likely root causes.

Recovery procedure

(Do not reveal until you have reasoned through the problem.)

  1. Identify the failing component.
  2. Apply the remediation pathway.
  3. Validate with the verification step.
  4. Document the incident.

Remediation

  1. On the firewall: ifconfig <iface> media 1000baseT mediaopt full-duplex to force full-duplex, or hard-set the peer switch port to match. 2. Replace the cable or SFP and re-test. 3. If the driver supports it, raise the ring buffer (e.g. hw.ix.max_rx_ring=4096 via loader.conf.local). 4. Capture on the interface to look for CRC errors and runt frames.

Verification

netstat -I <iface> shows zero input errors and drops under load; throughput matches the expected budget; ping latency is stable.

Rollback

Restore auto-negotiation if needed; revert ring-buffer changes via loader.

Prevention

Disable auto-negotiation on firewall-facing switch ports and hard-set 1000/full or 10000/full. Document the agreed media/speed/duplex per port. Monitor per-interface input errors and drops in your observability stack — even a small CRC rate is the early signal of a failing cable or SFP.