How to Diagnose Network Ring Buffer Packet Drops in Linux Using ethtool

High-throughput Linux servers handling intensive database queries, microservices, or streaming workloads can experience unexplained packet loss even when overall CPU utilisation and network bandwidth appear healthy. When incoming packet rates exceed the rate at which network interface card (NIC) drivers and Linux softirqs can process descriptors, hardware ring buffers overflow, silently discarding packets before they reach the Linux kernel networking stack. The ethtool utility provides essential diagnostics to inspect, measure, and tune these hardware ring buffers.

Understanding Hardware RX and TX Ring Buffers

A network interface ring buffer is a circular memory queue allocated in host RAM and shared between the NIC hardware and the device driver via Direct Memory Access (DMA):

• RX Ring Buffer (Receive): Holds descriptors pointing to pre-allocated socket buffers (sk_buff) awaiting inbound packets. When a frame arrives on the wire, the NIC DMA controller writes the payload directly into host memory and marks the descriptor ready.
• TX Ring Buffer (Transmit): Holds outbound descriptors scheduled for transmission across the physical media.
• Buffer Exhaustion (Drops): If bursts of incoming traffic fill all available RX descriptor slots before the operating system kernel services the hardware interrupt and executes NAPI softirq polling (NET_RX_SOFTIRQ), subsequent incoming packets are instantly dropped at the NIC hardware layer.

Identifying Ring Buffer Packet Drops

Standard tools like ifconfig or ip -s link display general drop counters, but ethtool reveals granular hardware-specific register metrics:

# Query interface hardware statistics
sudo ethtool -S eth0 | grep -E "drop|miss|over|fifo|exhaust"

Depending on your network card vendor (Intel, Mellanox/Nvidia, Broadcom, or AWS ENA), examine the following telltale counters:

• rx_dropped: General receive packet drop counter.
• rx_missed_errors: Hardware discarded frames due to lack of host RX descriptor buffers.
• rx_no_buffer_count: Occurs when DMA cannot locate an available host memory buffer.
• rx_fifo_errors: Hardware FIFO queue overflow.

If these counters are actively climbing during peak traffic hours, your network adapter is dropping frames due to insufficient ring buffer capacity.

Inspecting Current and Maximum Ring Buffer Parameters

To inspect the current configured buffer sizes alongside the maximum limits supported by the physical NIC hardware, execute:

sudo ethtool -g eth0

The command emits two distinct sections:

Ring parameters for eth0:
Pre-set maximums:
RX:             4096
RX Mini:        n/a
RX Jumbo:       n/a
TX:             4096
Current hardware settings:
RX:             512
RX Mini:        n/a
RX Jumbo:       n/a
TX:             512

In the example above, the hardware supports up to 4,096 descriptors, but the driver is currently restricted to 512, providing a massive 8x headroom expansion to absorb sudden network traffic bursts.

Increasing Ring Buffer Sizes to Eliminate Packet Drops

To expand the active ring buffer depth to the hardware maximum, use the -G flag:

# Expand RX and TX ring buffers to 4096 descriptors
sudo ethtool -G eth0 rx 4096 tx 4096

# Verify the updated settings
sudo ethtool -g eth0

The adjustment takes effect immediately without rebooting the system, although a momentary link renegotiation (sub-millisecond) may occur.

Making Ring Buffer Settings Persistent Across Reboots

Because ethtool changes are stored in volatile kernel memory, persist your changes using modern distribution network managers:

Ubuntu / Debian with systemd-networkd

Create a network link override file at /etc/systemd/network/10-eth0.link:

[Match]
OriginalName=eth0

[Link]
ReceiveBufferSize=4096
TransmitBufferSize=4096

RHEL / Rocky Linux / NetworkManager

Use nmcli to configure persistent ethtool parameters on the connection profile:

sudo nmcli connection modify "System eth0" ethtool.ring-rx 4096 ethtool.ring-tx 4096
sudo nmcli connection up "System eth0"

Complementary Kernel Network Stack Tuning

Expanding the hardware ring buffer provides the NIC with greater shock absorption during traffic spikes. To ensure the kernel networking subsystem processes these buffered frames expeditiously, complement the buffer expansion with the following sysctl tuning in /etc/sysctl.d/99-network-performance.conf:

# Maximum packets queued on input before processing
net.core.netdev_max_backlog = 10000

# Budget of packets softirq can process in one poll cycle
net.core.netdev_budget = 600

# Apply changes
sudo sysctl -p /etc/sysctl.d/99-network-performance.conf

By monitoring hardware drop counters and tuning ring buffer descriptors with ethtool, systems administrators can completely eliminate microburst packet loss and ensure stable high-throughput networking in Linux.