How to Use ethtool in Linux to Diagnose Network Interface Link Speed, Ring Buffers, and Offload Capabilities

In high-throughput enterprise Linux environments—such as Kubernetes nodes, Ceph storage clusters, and high-frequency trading gateways—diagnosing networking bottlenecks requires looking beneath high-level socket utilities like ip or netstat. When physical 10GbE, 25GbE, or 100GbE network interface cards (NICs) suffer from silent packet drops, micro-burst buffer exhaustion, or duplex negotiation mismatches, the root cause invariably resides in the low-level interaction between the kernel driver and the physical hardware controller.

The standard utility for querying and tuning network interface controller parameters in Linux is ethtool. Using ethtool, systems engineers can audit PHY link states, tune Direct Memory Access (DMA) RX/TX ring buffers, inspect granular hardware ASIC counters, and govern silicon-level packet offloading engines (such as TSO, GRO, and checksum offloading) to maximize line-rate throughput while minimizing CPU interrupt overhead.

Architectural Overview: The Linux Network Driver and DMA Ring Buffer Pipeline

Before a network frame is processed by the Linux kernel’s TCP/IP network stack, it passes through several physical and memory buffers:

Stage / Subsystem	Architectural Mechanism	Operational Role
Physical (PHY) Layer	Auto-Negotiation & SerDes	Establishes physical link speed (e.g. 10000Mb/s), duplex mode, and IEEE 802.3x flow control (pause frames).
DMA Ring Buffers (RX/TX)	Circular Descriptor FIFO in RAM	Allocates memory addresses where the NIC transfers incoming packets via Direct Memory Access without CPU intervention.
NAPI & SoftIRQ	Interrupt Mitigation Subsystem	Switches the driver from per-packet hardware interrupts to a polling loop (NAPI), draining the RX ring buffer into sk_buff structures.
Hardware Offloading (ASIC)	Silicon Acceleration Pipelines	Offloads compute-intensive tasks—such as TCP packet segmentation (TSO) and checksum verification—from host CPUs directly to the NIC.

Installing and Verifying ethtool

Most modern Linux distributions include ethtool in their base repositories. Install it via your package manager if absent:

# On Debian / Ubuntu Server
sudo apt update && sudo apt install -y ethtool

# On RHEL / Rocky Linux / Fedora
sudo dnf install -y ethtool

Auditing Physical Link Speed and Auto-Negotiation

Query the physical operating state of an interface (e.g. eth0 or enp3s0):

ethtool eth0

Review the primary output fields:

Settings for eth0:
    Supported ports: [ FIBRE ]
    Supported link modes:   10000baseT/Full
    Speed: 10000Mb/s
    Duplex: Full
    Port: Direct Attach Copper
    Auto-negotiation: on
    Link detected: yes

Ensure that Speed matches your switch port provisioning and that Duplex reports Full. A fallback to Half duplex indicates a faulty physical patch cable or an auto-negotiation protocol mismatch.

Inspecting and Expanding DMA Ring Buffers

When bursty incoming traffic overwhelms the NAPI polling cycle, the RX ring buffer fills completely. Any subsequent packets arriving at the NIC are dropped directly by the silicon before reaching the kernel (visible as rx_dropped or rx_missed_errors).

Step 1: Check Current Ring Buffer Capacity

ethtool -g eth0

The output presents both maximum supported hardware capabilities and currently allocated descriptor counts:

Ring parameters for eth0:
Pre-set maximums:
RX:             4096
RX Mini:        n/a
RX Jumbo:       n/a
TX:             4096
Current hardware settings:
RX:             512
TX:             512

In this common default configuration, the hardware is capable of 4096 descriptors, but the driver has only allocated 512, making the interface highly susceptible to micro-burst packet loss.

Step 2: Expand Ring Buffers to Hardware Maximums

sudo ethtool -G eth0 rx 4096 tx 4096

Expanding the RX descriptor queue provides a memory cushion that absorbs micro-bursts without dropping packets, ensuring the kernel has sufficient time to schedule SoftIRQ processing.

Governing Hardware Offloading Capabilities

Modern NICs possess specialized ASIC circuitry that handles TCP segmentation, assembly, and checksums. Auditing and toggling these features resolves latency spikes and driver incompatibilities.

Step 1: Query Active Offload Flags

ethtool -k eth0

Key offload parameters to verify:

• rx-checksumming: on: Hardware calculates IP/TCP/UDP checksums on ingress.
• tx-checksumming: on: Hardware generates checksums on egress.
• tcp-segmentation-offload (TSO): on: The kernel passes huge 64KB buffers to the NIC, and the NIC slices them into standard 1500-byte MTU frames in hardware.
• generic-receive-offload (GRO): on: The NIC coalesces incoming sequential TCP packets into single large frames before passing them to the kernel stack, drastically reducing per-packet CPU overhead.

Step 2: Modifying Offloads for Specialized Workflows

While offloads boost throughput on standard routers, virtualised firewalls, packet capture appliances (Wireshark/Zeek), and VPN tunnels often require disabling TSO/GRO to prevent packet corruption:

# Disable TSO and GRO for transparent bridging / packet capture
sudo ethtool -K eth0 tso off gro off

# Re-enable hardware acceleration
sudo ethtool -K eth0 tso on gro on

Querying Granular Hardware ASIC Counters

Generic kernel statistics from ip -s link do not reveal why packets were dropped. Query the low-level hardware counters maintained by the physical NIC chipset:

ethtool -S eth0 | grep -E "drop|err|miss|discard|over"

Typical diagnostic metrics include:

• rx_missed_errors: Packets discarded because the RX ring buffer was exhausted. (Solution: Increase RX ring buffer via ethtool -G).
• rx_crc_errors: Packets received with corrupted checksums. (Solution: Check fiber optic transceivers, clean LC connectors, or replace bent copper cables).
• tx_dropped: Transmit buffer overrun or queue discipline (qdisc) congestion.
• rx_flow_control_xon / rx_flow_control_xoff: Indicates IEEE 802.3x pause frames sent by upstream switches to throttle transmission.

Persisting ethtool Configuration Across Reboots

Changes made via ethtool are volatile and reset upon system reboot. Make configurations persistent across reboots using modern systemd network configurations.

Option A: Via systemd-networkd Link Configuration

Create /etc/systemd/network/10-eth0.link:

[Match]
OriginalName=eth0

[Link]
WakeOnLan=off

[Network]
# Increase ring buffers via systemd native directives
RxBufferSize=4096
TxBufferSize=4096

Option B: Via Netplan (Ubuntu Server)

Edit /etc/netplan/50-cloud-init.yaml:

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      ring:
        rx: 4096
        tx: 4096

Apply changes with sudo netplan apply.

Troubleshooting ethtool Operational Anomalies

Consult this diagnostic reference table to debug hardware tuning errors and driver incompatibilities:

Issue / Error Message	Underlying Root Cause	Remediation Procedure
Cannot set device ring buffer settings: Operation not supported	Virtualised network driver (e.g. virtio_net, VMware vmxnet3) or cloud hypervisor does not permit guest ring buffer modification.	Ring buffer sizes are managed at the hypervisor host layer. Ensure proper virtio multi-queue is provisioned in the host configuration.
Network interface drops link for 1-2 seconds after executing ethtool -G.	Expected hardware behaviour; reallocating DMA descriptors requires resetting the NIC chip.	Never adjust ring buffer descriptors on production interfaces during active peak traffic windows. Schedule changes during maintenance windows.
High latency on small UDP packet streams despite 10Gbps link.	Adaptive interrupt moderation (coalescence) is buffering packets too aggressively.	Audit coalescence with ethtool -c eth0. Reduce rx-usecs via sudo ethtool -C eth0 adaptive-rx off rx-usecs 10.
Cannot get register dump: Operation not permitted	Command executed without administrative root privileges, or Secure Boot kernel lockdown mode restricts raw register reads.	Run commands prepended with sudo. If kernel lockdown is active, inspect statistics via ethtool -S instead.

Leveraging ethtool to audit link negotiation, expand DMA ring buffers, and govern hardware offload capabilities equips Linux systems engineers with total visibility into physical network controllers, ensuring flawless line-rate data transmission.