ethtool

@amitmund September 11, 2026

ethtool is the standard Linux networking utility used to query and configure network interface controllers (NICs) and their kernel drivers. It controls physical link parameters (speed, duplex, auto-negotiation), packet ring buffers, interrupt coalescing, hardware offload engines (TSO, GSO, GRO), and retrieves low-level hardware ASIC telemetry counters.

1. What is ethtool?

ethtool stands for:

Ethernet Tool

It communicates directly with network device drivers via kernel ioctl socket calls and the modern netlink interface (ETHTOOL_MSG_*).

It answers essential network and hardware diagnostic questions: * Is the physical cable or fiber optic transceiver plugged in and reporting carrier signal (Link detected: yes)? * Did auto-negotiation fail, forcing the interface into an unexpected speed or half-duplex state? * Are packets being dropped at the NIC hardware ring buffer layer before reaching the OS kernel? * Are hardware offloads (TCP Segmentation Offload, Checksum Offload) enabled or causing packet corruption? * How many hardware queues (RSS) are active to distribute traffic across CPU cores?

2. Installation & Availability

ethtool is available across standard distribution package repositories:

Debian / Ubuntu

sudo apt update
sudo apt install ethtool

RHEL / Rocky / AlmaLinux / CentOS

sudo dnf install ethtool

Arch Linux

sudo pacman -S ethtool

Verify the installation:

ethtool --version

3. Basic Syntax & Primary Options

ethtool [options] <interface_name>
Command Flag Operational Purpose Practical Example
(no flag) Query link status, supported modes, duplex, and speed. ethtool eth0
-i Display driver name, firmware version, and PCIe bus address. ethtool -i eth0
-S Display hardware ASIC error counters and queue statistics. ethtool -S eth0
**-g / -G** View (-g) or configure (-G) RX/TX descriptor ring buffer sizes. ethtool -g eth0
**-k / -K** View (-k) or toggle (-K) protocol offload engines (TSO, GSO, GRO). ethtool -k eth0
**-c / -C** View (-c) or configure (-C) interrupt coalescing parameters. ethtool -c eth0
**-l / -L** View (-l) or adjust (-L) multi-queue channel allocations (RSS). ethtool -l eth0
-p Physically blink the NIC port LED for physical server identification. sudo ethtool -p eth0 10

4. Anatomy of Default Query Output (ethtool <interface>)

Running ethtool with only an interface name queries the current physical link state:

ethtool eth0

Raw Output Example

Settings for eth0:
    Supported ports: [ TP ]
    Supported link modes:   10baseT/Half 10baseT/Full
                            100baseT/Half 100baseT/Full
                            1000baseT/Full
    Supported pause frame use: Symmetric Receive-only
    Supports auto-negotiation: Yes
    Supported FEC modes: Not reported
    Advertised link modes:  10baseT/Half 10baseT/Full
                            100baseT/Half 100baseT/Full
                            1000baseT/Full
    Advertised pause frame use: Symmetric
    Advertised auto-negotiation: Yes
    Advertised FEC modes: Not reported
    Speed: 1000Mb/s
    Duplex: Full
    Auto-negotiation: on
    Port: Twisted Pair
    PHYAD: 1
    Transceiver: internal
    MDI-X: off (auto)
    Supports Wake-on: pumbg
    Wake-on: d
    Current message level: 0x00000007 (7)
                           drv probe link
    Link detected: yes

Breakdown of Key Output Fields

Output Field Example Value Technical Meaning Diagnostic Significance
Supported link modes 1000baseT/Full Link speeds and duplex combinations the hardware PHY is capable of using. Validates whether a 10G or 1G link is supported by the NIC hardware.
Advertised link modes 1000baseT/Full Speeds and duplex modes broadcast by this NIC to the connected switch port during negotiation. If a mode is missing here, the NIC will refuse to negotiate to that speed.
Speed 1000Mb/s The current negotiated operational data rate across the wire. Detects degraded links (e.g., a 10 Gbps port running at 1 Gbps, or 1 Gbps running at 100 Mbps due to a damaged cable).
Duplex Full Data transfer direction capability (Full = bidirectional simultaneously; Half = one direction at a time). Half duplex on modern switches indicates an auto-negotiation duplex mismatch, causing collisions and frame drops.
Auto-negotiation on Whether dynamic link parameter negotiation with the peer switch port is enabled. If one end is set to off (forced) and the other is on, the link often defaults to Half duplex.
Port Twisted Pair Physical medium connector type (Twisted Pair [RJ45], FIBRE, Direct Attach Copper). Confirms physical layer connector media type.
MDI-X off (auto) Internal pin crossover configuration status (on, off, or auto). Auto-MDIX eliminates the need for crossover cables.
Link detected yes Physical carrier signal detected by the PHY layer. If no, the cable is unplugged, broken, the remote switch port is disabled, or the transceiver is incompatible.

5. Ring Buffer Diagnostics (ethtool -g)

NIC ring buffers are circular FIFO memory queues allocated in host RAM where incoming and outgoing packet descriptors are held before being processed by the CPU or dispatched by the transmitter.

ethtool -g eth0

Raw Output Example

Ring parameters for eth0:
Pre-set maximums:
RX:     4096
RX Mini:    n/a
RX Jumbo:   n/a
TX:     4096
Current hardware settings:
RX:     512
RX Mini:    n/a
RX Jumbo:   n/a
TX:     512

Breakdown of Sections

  • Pre-set maximums: The absolute upper limit of descriptor slots supported by the physical NIC ASIC and driver architecture (e.g., 4096 slots).
  • Current hardware settings: The active number of descriptor slots allocated in system memory (e.g., 512 slots).

Why Ring Buffer Sizing Matters

If incoming network traffic arrives in rapid bursts (microbursts), a small RX ring (512) fills faster than the CPU can service interrupts. Once full, the NIC ASIC drops subsequent incoming frames immediately at the hardware level.

To expand the buffer to the maximum supported limit:

sudo ethtool -G eth0 rx 4096 tx 4096

6. Protocol Offload Engines (ethtool -k)

Modern NICs contain dedicated processing units to handle tasks that would otherwise consume host CPU cycles (checksumming, packet splitting, packet reassembly).

ethtool -k eth0

Raw Output Example (Key Excerpt)

Features for eth0:
rx-checksumming: on
tx-checksumming: on
    tx-checksum-ipv4: on
    tx-checksum-ipv6: on
scatter-gather: on
    tx-scatter-gather: on
tcp-segmentation-offload: on
    tx-tcp-segmentation: on [fixed]
    tx-tcp-ecn-segmentation: on [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off [fixed]
rx-vlan-offload: on
tx-vlan-offload: on

Breakdown of Core Offload Features

Offload Name Flag Key Mechanism Operational Benefit / Trade-off
Receive Checksumming rx-checksumming Hardware calculates and verifies L3/L4 packet checksums. Offloads CPU verification. Disabling is required only when diagnosing faulty NIC checksum hardware.
TCP Segmentation Offload (TSO) tso / tx-tcp-segmentation Kernel hands large buffers (up to 64 KB) to the NIC; the NIC slices them into standard MTU (1500 B) frames. Reduces CPU utilization during high-throughput outbound transmissions.
Generic Segmentation Offload (GSO) gso Software fallback for non-TCP protocols or devices lacking native TSO support. Defers packet segmentation as close to the hardware driver as possible.
Generic Receive Offload (GRO) gro Hardware/driver aggregates sequential incoming TCP packets into a single large buffer before passing to kernel network stack. Dramatically reduces per-packet traversal overhead across the network stack.
Large Receive Offload (LRO) lro Hardware aggregates incoming TCP packets regardless of header options. Often conflicts with IP forwarding and routing routers/firewalls; usually kept off.

Toggling Offload Features

# Disable TCP segmentation offload for debugging
sudo ethtool -K eth0 tso off

# Enable Generic Receive Offload
sudo ethtool -K eth0 gro on

7. Low-Level Hardware Statistics (ethtool -S)

While standard commands like ip -s link show high-level packet counts, ethtool -S extracts internal counters directly from the NIC ASIC registers and driver rings.

ethtool -S eth0 | head -n 25

Raw Output Example

NIC statistics:
     rx_packets: 45210452
     tx_packets: 38910245
     rx_bytes: 45810245120
     tx_bytes: 32105412010
     rx_broadcast: 1420
     tx_broadcast: 45
     rx_dropped: 0
     tx_dropped: 0
     rx_missed_errors: 14250
     rx_fifo_errors: 0
     rx_crc_errors: 12
     rx_frame_errors: 0
     rx_no_buffer_count: 14250
     tx_aborted_errors: 0
     queue_0_rx_packets: 11302613
     queue_1_rx_packets: 11302610
     queue_2_rx_packets: 11302615
     queue_3_rx_packets: 11302614

Critical Hardware Metrics Explained

  • rx_crc_errors / rx_frame_errors: Indicates frames received with corrupted checksum bits. This points to physical layer degradation (damaged Ethernet patch cables, dirty fiber transceivers, loose SFPs, or electromagnetic interference).
  • rx_missed_errors / rx_no_buffer_count: Packets dropped because the NIC's internal FIFO or host RX descriptor ring was exhausted. Packets were discarded before reaching the Linux kernel network stack.
  • queue_N_rx_packets: Displays receive traffic balance across Receive Side Scaling (RSS) hardware queues. Uneven distributions indicate ineffective hashing or single-flow saturation.

8. Interrupt Coalescing (ethtool -c)

Interrupt coalescing controls how many packets or microseconds the NIC waits before generating a hardware interrupt (IRQ) to the CPU.

ethtool -c eth0

Key Parameters:

  • rx-usecs: Number of microseconds to delay an RX interrupt after a packet arrives.
  • rx-frames: Number of RX packets to accumulate before triggering an interrupt.
  • Adaptive Coalescing (adaptive-rx, adaptive-tx): Dynamically modulates interrupt timing based on packet arrival rates.
# Enable adaptive RX interrupt coalescing (reduces CPU usage under high load)
sudo ethtool -C eth0 adaptive-rx on

# Force strict low-latency mode (zero delay; higher CPU load, lowest latency)
sudo ethtool -C eth0 rx-usecs 0 rx-frames 1

9. Real-World Troubleshooting Scenarios

Scenario A: Diagnosing Packet Drops Caused by Microbursts

An application experiences intermittent TCP connection drops, but top reports low CPU utilization and netstat -s shows no listen queue overflows.

Step 1: Check NIC ASIC hardware drop counters:

ethtool -S eth0 | grep -E "(drop|miss|buffer|fifo)"

Output:

rx_dropped: 0
rx_missed_errors: 52410
rx_no_buffer_count: 52410

Step 2: Inspect the RX ring buffer allocation:

ethtool -g eth0

Current hardware settings show RX is set to 512, while Pre-set maximum is 4096.

Step 3: Expand the descriptor ring to absorb microbursts:

sudo ethtool -G eth0 rx 4096

Verification: Clear counters or monitor rx_no_buffer_count over time. The drop rate stabilizes to zero.

Scenario B: Resolving Speed/Duplex Mismatches

A physical server is expected to communicate at 1 Gbps, but file transfers max out at ~11 MB/s (~100 Mbps) with high latency.

Step 1: Verify operational link settings:

ethtool eth0 | grep -E "(Speed|Duplex|Auto-neg)"

Output:

Speed: 100Mb/s
Duplex: Half
Auto-negotiation: on

Diagnosis: The link settled at 100 Mbps Half-Duplex. This typically occurs when the connected switch port is hardcoded to a fixed speed without auto-negotiation, or when physical wiring cannot maintain signal integrity across all 4 wire pairs of an 8-wire Cat5e/Cat6 cable.

Step 2: Force re-negotiation:

sudo ethtool -r eth0

If it remains at 100Mb/s Half-Duplex, replace the physical cable and verify the upstream switch port profile.

Scenario C: Resolving Capture Confusion with tcpdump

When running tcpdump -i eth0, you observe outgoing IP packets with lengths of 16,000 to 64,000 bytes—far exceeding the interface MTU of 1500 bytes.

Explanation: TCP Segmentation Offload (TSO) is active. The Linux kernel constructs giant segments in memory and passes them to the NIC ASIC. Because tcpdump attaches to the network stack above the physical driver, it captures packets before the NIC hardware slices them into standard 1500-byte wire frames.

To capture actual on-the-wire packet segments:

sudo ethtool -K eth0 tso off gso off

(Remember to re-enable them after analysis to restore CPU performance).

10. Important Interview Questions & Answers

Answer: ip -s link (and ifconfig) reports packet drops recorded by the Linux kernel network subsystem (e.g., when the kernel's netdev_max_backlog queue is exhausted or when memory allocation fails inside the network stack). ethtool -S reports statistics read directly from the NIC hardware ASIC registers. If ethtool -S displays high rx_missed_errors while ip -s link shows zero drops, the packets were dropped by the physical NIC before the kernel ever received or acknowledged them.

Q: How does Receive Side Scaling (RSS) work, and how do you verify it with ethtool?

Answer: RSS allows modern NICs to direct incoming packets into multiple hardware RX descriptor queues using a 4-tuple or 5-tuple hash of IP and port headers. Each queue generates interrupts to a different CPU core, distributing packet processing across cores. You verify RSS queue allocation using ethtool -l <iface> (which displays maximum vs. current channel counts) and monitor per-queue packet counters using ethtool -S <iface> | grep queue_.

Q: What is the operational trade-off of enabling aggressive interrupt coalescing (rx-usecs)?

Answer: Increasing rx-usecs instructs the NIC to wait longer before generating a hardware interrupt, allowing more packets to accumulate into a single batch. This improves throughput and significantly reduces CPU utilization on high-traffic systems by avoiding interrupt storms. However, it increases per-packet latency (jitter), which can degrade the responsiveness of low-latency applications (such as high-frequency trading, DNS resolution, or gaming backends).

0 Likes
3 Views
0 Comments

Filters

No filters available for this view.

Reset All