NIC selection — Intel vs Broadcom vs Realtek

The NIC is the part of the firewall that touches the wire. A bad NIC choice — one whose driver drops frames under load, has weak interrupt moderation, or pulls packets across the entire kernel locking hierarchy — turns a perfectly good firewall into a source of intermittent packet loss. This lesson covers which NICs work well on FreeBSD, why Intel i210/i350/i211 are the safe default, and how to spot a NIC that is misbehaving before it becomes an incident.

The chip families that matter

Three families of NIC chips dominate the x86 server and embedded market:

For OPNsense in production, the rule is simple: Intel i210/i211/ i350 for 1 Gbit/s, Intel X710 or Chelsio T5/T6 for 10 Gbit/s. Anything else is a risk.

$ pciconf -lv | grep -A 3 -E 'class=0x020000|network'

igb0@pci0:0:25:0: class=0x020000 card=0x00008086 chip=0x15338086 rev=0x03 hdr=0x00
  vendor     = 'Intel Corporation'
  device     = 'Ethernet Connection I217-V'
  class      = network
  subclass   = ethernet
igb1@pci0:0:26:0: class=0x020000 card=0x00008086 chip=0x153a8086 rev=0x03 hdr=0x00
  vendor     = 'Intel Corporation'
  device     = 'Ethernet Connection I217-V'
igb2@pci0:1:0:0: class=0x020000 card=0x00008086 chip=0x15728086 rev=0x03 hdr=0x00
  vendor     = 'Intel Corporation'
  device     = 'Ethernet Connection I354'
igb3@pci0:1:0:1: class=0x020000 card=0x00008086 chip=0x15728086 rev=0x03 hdr=0x00
  vendor     = 'Intel Corporation'
  device     = 'Ethernet Connection I354'

What “drop-prone” actually means

The phrase “drop-prone NIC” gets used a lot. The underlying mechanisms vary:

1. Receive interrupt moderation bugs. The NIC coalesces interrupts to reduce CPU cost, but a buggy driver can hold packets in the NIC’s buffer too long and overflow it. The symptom: under sustained load, netstat -I igb0 shows dropped and ierrors counters rising.
2. Lack of RSS (Receive Side Scaling). Without RSS, all received packets are processed by CPU 0. Multi-core CPUs are starved; under load, the single CPU saturates and packets back up. Symptom: CPU 0 at 100% in top, all others idle.
3. Poor checksum offload. A NIC with broken checksum offload can either (a) hand the kernel bad checksums, causing PF to drop valid frames, or (b) force the kernel to compute checksums in software, raising CPU cost.
4. Buffer overruns. The NIC’s ring buffer is too small or the driver does not refill it fast enough. Symptom: ifconfig igb0 shows the RX overrun counter incrementing.

A drop-prone NIC shows up in production as “everything is fine until we hit 60% line rate, then packets start dropping” — and the drops persist even after PF is verified to be allowing the traffic.

Intel i210 / i211 / i350 — the safe default

The Intel i210 (single port), i211 (single port, lower power), and i350 (quad port) are the NICs OPNsense ships on its own appliances. They are the safe default because:

1. The FreeBSD igb driver is mature, well-maintained, and included in GENERIC.
2. Hardware offloads (TSO, LRO, checksum, RSS) are correctly implemented and tunable.
3. Interrupt moderation is well tuned out of the box and has knobs (dev.igb.X.intr_rate, dev.igb.X.queueX.intr_rate).
4. RSS works — packets are spread across cores by hash.
5. The chips are widely available on commodity motherboards and PCIe add-in cards.

For 10 Gbit/s, the equivalent safe choices are Intel X710 (4×10 GbE SFP+) and Chelsio T5/T6. Both have mature FreeBSD drivers.

How to verify NIC health in production

Three commands catch most NIC problems:

netstat -I igb0 -w 1      # per-second I/O stats; watch drop counters
vmstat 1                   # interrupt and context-switch rate
pciconf -lv | grep -A 3 igb  # driver and chip binding

Under sustained load, an ierrors or dropped column that climbs without bound is a sign the NIC cannot keep up. The first mitigation is to tune interrupt moderation (sysctl dev.igb.0.intr_rate=8000 raises the rate from default 4000, reducing coalescence). The second is to check the NIC’s PCIe link — a NIC in a PCIe x1 slot at Gen 1 has ~2 Gbit/s of PCIe bandwidth and can become the bottleneck at 1 GbE under load with offloads.

Production patterns

Three patterns cover most decisions:

1. For a 1 Gbit/s firewall: Intel i350 quad-port add-in card or a board with Intel i210/i211 on-board. Disable unused ports or leave them unassigned.
2. For a 10 Gbit/s firewall: Intel X710 (4×10 GbE SFP+) or Chelsio T540 (4×10 GbE). Verify driver (ixl for X710, cxgbe for Chelsio) and check firmware versions.
3. For a virtual machine: use the virtio driver with multi- queue enabled; older e1000 emulated NICs cap at ~3 Gbit/s.

Summary

• Intel i210/i211/i350 is the safe default for 1 Gbit/s; Intel X710 / Chelsio for 10 Gbit/s.
• Realtek works for light traffic but has known driver issues under sustained load.
• Broadcom is mixed — newer chips (bnxt) are solid; older (bxe) is buggy.
• “Drop-prone” means any of: bad interrupt moderation, missing RSS, broken offload, ring-buffer overruns. All show up as rising ierrors/dropped counters.
• Verify NIC health with netstat -I, vmstat 1, and pciconf -lv.