6/3/25, 5:08 PM ifconfig and ip commands report packet drops?

- Red Hat Customer Portal

Subscriptions Downloads Red Hat Console Get Support

Products & Services Knowledgebase ifconfig and ip commands report packet drops?

ifconfig and ip commands report packet drops?

$ SOLUTION VERIFIED - Updated August 9 2024 at 11:33 AM - English

Environment
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat enterprise MRG realtime 2.3 ( kernel-rt-3.8.13-rt14.25.el6rt )
Bonding

Issue
ifconfig reports rx drops for servers, physical or VMware guests, after upgrading to RHEL7
ip -s link and ifconfig report the rx_drop* counter increasing but no drops are seen with ethtool -S ethX
RHEL7 ifconfig show rx drops while RHEL 6.X guests running on the very same ESX host or cluster show no rx drops
Any NIC hardware type
netstat -i reports RX-ERR and RX-DRP
We are using bond interface on MRG 2.3. Suddenly, dropped packets occurs on slave's one of bond interfaces.
After installing the RT kernel we observed the rx_dropped counter increasing for ifconfig .

https://access.redhat.com/solutions/2073223 1/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

Resolution
This is not a bug. Previous kernels were not accounting for these dropped packets (unknown protocol for example), but they
really were dropped.

ethtool -S should be used for packet drop detection, as described at:

RHEL network interface dropping packets

Root Cause
Links contained herein to external website(s) are provided for convenience only. Red Hat has not reviewed the links and is not
responsible for the content or its availability. The inclusion of any link to an external website does not imply endorsement by Red
Hat of the website or their entities, products or services. You agree that Red Hat is not responsible or liable for any loss or
expenses that may result due to your use of (or reliance on) the external site or content.

Seeing high rx_drop_counters in RHEL 7 from ifconfig|ip -s link is not a definitive conclusion of a network problem. To gain
more traction of a network problem "ethtool -S" can be used for Network Card Statistics or "netstat -s" for Network Application
statistics.

RHEL 7 differentiates packet loss from older o/s (RHEL 6 and RHEL 5), as rx drop counter can increment from the
following reasons:
unrecognised protocol
unknown VLAN
unregistered multicast address.
Incremented for certain packets received by an inactive bond or team member.
From kernel git

https://access.redhat.com/solutions/2073223 2/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

net: add a core netdev->rx_dropped counter

In various situations, a device provides a packet to our stack and we
drop it before it enters protocol stack :
- softnet backlog full (accounted in /proc/net/softnet_stat)
- bad vlan tag (not accounted)
- unknown/unregistered protocol (not accounted)

We can handle a per-device counter of such dropped frames at core level,

and automatically adds it to the device provided stats (rx_dropped), so
that standard tools can be used (ifconfig, ip link, cat /proc/net/dev)

This is a generalization of commit 8990f468a (net: rx_dropped

accounting), thus reverting it.

Diagnostic Steps
ifconfig RX dropped packets increases steadily.

Just a sample of a frame with Ethernet Type 0 which causes rx drop:

# tshark -n -t ad -r /tmp/test.pcap -T fields -e frame.number -e eth.type 2>/dev/null

1 0x00000000
# tshark -n -t ad -r /tmp/test.pcap 2>/dev/null
1 2017-07-28 12:06:40 3c.00.50 -> a8.7a.2f FC 60 Link Ctl, ACK1
# tcpdump -r /tmp/test.pcap -ne 2>/dev/null
12:06:40.532597 00:00:00:00:00:00 > 00:00:00:00:00:01, 802.3, length 60: LLC, dsap Unknown (0x44) Group, ssap Null (0x00)
Command, ctrl 0x2800: Information, send seq 0, rcv seq 20, Flags [Command], length 46

Note: While tcpdump is running, the above frame does not increase rx drop count.
LLDP frames will also cause this every 30 seconds:

https://access.redhat.com/solutions/2073223 3/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

$ tshark -r /tmp/lldp1.pcap
1 06:50:01.100787 0.000000 00:00:00:00:00:00 → LLDP_Multicast LLDP 292 NoS = 00:00:00:00:00:00 TTL = 120 System
Name = hostname.com System Description = Cisco Nexus Operating System (NX-OS) Software 7.0(3)I7(3)\nTAC
2 06:50:31.101609 30.000822 00:00:00:00:00:00 → LLDP_Multicast LLDP 292 NoS = 00:00:00:00:00:00 TTL = 120 System
Name = hostname.com System Description = Cisco Nexus Operating System (NX-OS) Software 7.0(3)I7(3)\nTAC

Product(s) Red Hat Enterprise Linux Component kernel Tags network

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers
have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these
articles may be presented in a raw and unedited form.

Was this helpful?

YES NO

People who viewed this solution also viewed

Why are packet drops reported in Unexpected IP change due to Frame errors reported via
ifconfig not reflected in ethtool? mistyped ifconfig command. ifconfig

https://access.redhat.com/solutions/2073223 4/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

Solution - 6 thg 8, 2024 Solution - 15 thg 6, 2024 Solution - 5 thg 8, 2024

Get notified when this content is updated FOLLOW

Comments

Add comment

NEWBIE

Formatting Help

Send notifications to content followers

Submit

https://access.redhat.com/solutions/2073223 5/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

Abel Romo Feb 22, 2016 10:52 PM

I have two NICs bonded. In RHEL <7, I could add up the dropped packets from each NIC and it would match the
dropped packets of the bond. With RHEL 7, that's not the case anymore. Example (purposefully left out NICs not
COMMUNITY
MEMBER belonging to the bond and TX information):
38 Points

2: eno1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP mode DEFAULT qlen 1000
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
73438005 512529 0 **170** 0 143599
3: enp16s0f1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP mode DEFAULT qlen 100
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
11952901 150763 0 **150762** 0 143561
5: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
85390906 663292 0 **281097** 0 287160

 

Does anyone have an explanation to this behaviour? Thank you.

Reply

Ilan Green Feb 22, 2016 11:01 PM

I think it might be worthwhile having a look first at the ethtool -S output such that we can see if these are all

RED HAT
RX or TX or something else?
https://access.redhat.com/solutions/2073223 6/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal
ACTIVE
CONTRIB... Reply
245 Points

Abel Romo Feb 22, 2016 11:08 PM

Thanks Ilan, here is the ethtool -S output for both NICs. However, if I grep the output for "drop", it
doesn't find anything:
COMMUNITY
MEMBER

38 Points [root@fborcdv16 ~]# ethtool -S eno1

NIC statistics:
rx_bytes: 73655473
rx_error_bytes: 0
tx_bytes: 61004777
tx_error_bytes: 0
rx_ucast_packets: 350007
rx_mcast_packets: 144211
rx_bcast_packets: 20378
tx_ucast_packets: 405216
tx_mcast_packets: 810
tx_bcast_packets: 2
tx_mac_errors: 0
tx_carrier_errors: 0
rx_crc_errors: 0
rx_align_errors: 0
tx_single_collisions: 0
tx_multi_collisions: 0
tx_deferred: 0
tx_excess_collisions: 0

https://access.redhat.com/solutions/2073223 7/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

tx_late_collisions: 0
tx_total_collisions: 0
rx_fragments: 0
rx_jabbers: 0
rx_undersize_packets: 0
rx_oversize_packets: 0
rx_64_byte_packets: 185225
rx_65_to_127_byte_packets: 282857
rx_128_to_255_byte_packets: 13857
rx_256_to_511_byte_packets: 11622
rx_512_to_1023_byte_packets: 3910
rx_1024_to_1522_byte_packets: 17125
rx_1523_to_9022_byte_packets: 0
tx_64_byte_packets: 3783
tx_65_to_127_byte_packets: 337927
tx_128_to_255_byte_packets: 41224
tx_256_to_511_byte_packets: 7637
tx_512_to_1023_byte_packets: 5683
tx_1024_to_1522_byte_packets: 9774
tx_1523_to_9022_byte_packets: 0
rx_xon_frames: 0
rx_xoff_frames: 0
tx_xon_frames: 0
tx_xoff_frames: 0
rx_mac_ctrl_frames: 0
rx_filtered_packets: 882
rx_ftq_discards: 0
rx_discards: 0
rx_fw_discards: 0
[root@fborcdv16 ~]# ethtool -S enp16s0f1

https://access.redhat.com/solutions/2073223 8/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

NIC statistics:
rx_bytes: 12005557
rx_error_bytes: 0
tx_bytes: 256
tx_error_bytes: 0
rx_ucast_packets: 2
rx_mcast_packets: 144194
rx_bcast_packets: 7232
tx_ucast_packets: 0
tx_mcast_packets: 0
tx_bcast_packets: 4
tx_mac_errors: 0
tx_carrier_errors: 0
rx_crc_errors: 0
rx_align_errors: 0
tx_single_collisions: 0
tx_multi_collisions: 0
tx_deferred: 0
tx_excess_collisions: 0
tx_late_collisions: 0
tx_total_collisions: 0
rx_fragments: 0
rx_jabbers: 0
rx_undersize_packets: 0
rx_oversize_packets: 0
rx_64_byte_packets: 130779
rx_65_to_127_byte_packets: 15281
rx_128_to_255_byte_packets: 1
rx_256_to_511_byte_packets: 5367
rx_512_to_1023_byte_packets: 0

https://access.redhat.com/solutions/2073223 9/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

rx_1024_to_1522_byte_packets: 0
rx_1523_to_9022_byte_packets: 0
tx_64_byte_packets: 4
tx_65_to_127_byte_packets: 0
tx_128_to_255_byte_packets: 0
tx_256_to_511_byte_packets: 0
tx_512_to_1023_byte_packets: 0
tx_1024_to_1522_byte_packets: 0
tx_1523_to_9022_byte_packets: 0
rx_xon_frames: 0
rx_xoff_frames: 0
tx_xon_frames: 0
tx_xoff_frames: 0
rx_mac_ctrl_frames: 0
rx_filtered_packets: 315027
rx_ftq_discards: 0
rx_discards: 0
rx_fw_discards: 0
[root@fborcdv16 ~]#

Reply

Ilan Green Feb 28, 2016 1:57 PM

Sorry for the late reply. I suspect it might be driver related, as some drivers will count broadcasts which

RED HAT
were not meant for them as dropped (e.g. see solution https://access.redhat.com/solutions/340783)
ACTIVE Question is which interface is used and whether the driver and firmware versions of the 7.1 system are the
CONTRIB...
same of the systems < 7.1 (ethtool -i )
https://access.redhat.com/solutions/2073223 10/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

245 Points
Reply

Abel Romo Feb 29, 2016 10:36 PM

Thanks for the reply, Ilan. This is our network driver/firmware:

COMMUNITY
MEMBER [root@fborcdv16 ~]# ethtool -i eno1
38 Points driver: bnx2
version: 2.2.6
firmware-version: bc 6.2.0 NCSI 2.0.11
bus-info: 0000:10:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no
[root@fborcdv16 ~]#

Turns out RHEL7 is not supported on this old hardware, so we don't have manufacturer's support or
firmware/driver updates. Basically, we are on our own.

One thing that still puzzles me is if I add up the two slaves' RX bytes, RX packets or multicast packets,
they match the bond0 values. But if I add up the two slaves' RX drop packets, it doesn't match bond0
drop counter.

https://access.redhat.com/solutions/2073223 11/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

[root@fborcdv16 ~]# ip -s link show dev bond0; ip -s link show dev eno1; ip -s link show dev enp16s0f1
5: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
902518992 2914617 0 610283 0 971133
TX: bytes packets errors dropped carrier collsns
224796428 1653273 0 0 0 0
2: eno1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP mode DEFAULT qlen
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
862092334 2404692 0 170 0 485627
TX: bytes packets errors dropped carrier collsns
224796172 1653269 0 0 0 0
3: enp16s0f1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP mode DEFAULT
link/ether 5c:f3:fc:96:45:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
40426658 509925 0 169969 0 485506
TX: bytes packets errors dropped carrier collsns
256 4 0 0 0 0
[root@fborcdv16 ~]#

 

Reply

Ilan Green Mar 2, 2016 4:10 PM

With respect to bnx2 support it might be possible that the hardware vendor does provides driver and

RED HAT
firmware updates which will enable support of this NIC with RHEL 7. Hence I suggest you contact the
https://access.redhat.com/solutions/2073223 12/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal
ACTIVE
CONTRIB... vendor or have a look at the vendor site.
245 Points
Though I haven't seen any kernel patches related to bonding - it might be that some of the bond setting
are not propagated to the interfaces. Might worthwhile verifying if settings are aligned between the bond
and the interfaces like LRO, tcp checksum offloading. Such discrepancies might explain this gap

Reply

Michael Oct 8, 2016 2:28 AM

See article Why am I seeing the rx_dropped ifconfig counter increase on rt_kernel/RHEL7?

COMMUNITY Your RHEL7 ifconfig RX dropped counters are no longer a reliable source of error detection. Red Hat states,
MEMBER

57 Points "Working as designed. These errors can safely be ignored ... " because "RHEL7 kernels contains code that
updates the rx_dropped counter for other non-error conditions".

To verify if there really is a problem, you need to use "ethtool -S" or "netstat -s".

Reply

Sarunas Oct 15, 2018 3:17 PM

If the switch is broadcasting Spanning Tree Protocol or VRRP packets, these count as unknown and unregistered
multicast protocols.
NEWBIE

https://access.redhat.com/solutions/2073223 13/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

5 Points
Reply

Quick Links

Help

Site Info

Related Sites

About

Red Hat Subscription Value

About Red Hat

Red Hat Jobs

https://access.redhat.com/solutions/2073223 14/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

About Red Hat

Jobs
Events
Locations
Contact Red Hat
Red Hat Blog
Inclusion at Red Hat
Cool Stuff Store
Red Hat Summit

Copyright © 2025 Red Hat, Inc.

Privacy statement
Terms of use
All policies and guidelines
Digital accessibility
Cookie preferences

https://access.redhat.com/solutions/2073223 15/16
6/3/25, 5:08 PM ifconfig and ip commands report packet drops? - Red Hat Customer Portal

https://access.redhat.com/solutions/2073223 16/16