Linux Network Packet Monitoring and Tuning: Tools, RingBuffer, Interrupts, and SoftIRQ Optimization

In the previous article we illustrated the complete Linux network packet reception process, which involves the RingBuffer, hardware interrupt handling, and the ksoftirqd soft‑interrupt thread that moves packets from the RingBuffer to the protocol stack and finally to the socket receive queue.

1) ethtool

The ethtool utility queries and configures NIC parameters. Useful options include:

-i – display driver information (name, version, etc.).

-S – show NIC packet statistics.

-g / -G – view or modify RingBuffer size.

-l / -L – view or modify the number of NIC queues.

-c / -C – view or change interrupt coalescing parameters.

Example output:

# ethtool -i eth0
driver: ixgbe
...

The driver source resides in drivers/net/ethernet/intel/ixgbe , where functions such as the NAPI poll callback and the open routine are implemented.

2) ifconfig

ifconfig not only configures IP addresses and brings interfaces up or down, but also displays NIC statistics:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.162.42.51  netmask 255.255.248.0  broadcast 10.162.47.255
        inet6 fe80::6e0b:84ff:fed5:88d1  prefixlen 64  scopeid 0x20<link>
        ether 6c:0b:84:d5:88:d1  txqueuelen 1000  (Ethernet)
        RX packets 2953454  bytes 414212810 (395.0 MiB)
        RX errors 0  dropped 4636605  overruns 0  frame 0
        TX packets 127887  bytes 82943405 (79.1 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Key fields include RX packets, RX bytes, RX errors, RX dropped, and RX overruns.

3) /proc pseudo‑filesystem

The /proc filesystem provides runtime kernel data. Useful entries for networking are:

/proc/sys – kernel parameters.

/proc/cpuinfo – CPU details.

/proc/meminfo – memory statistics.

/proc/interrupts – hardware interrupt counts.

/proc/softirqs – soft‑interrupt counts.

/proc/slabinfo – slab allocator usage.

/proc/net/dev – per‑interface packet counters (bytes, packets, errs, drop, fifo, frame, colls).

RingBuffer Monitoring and Tuning

Use ethtool -g eth0 to view RingBuffer limits and current settings. If rx_fifo_errors is non‑zero, packets are being dropped because the RingBuffer is full. Increase the size with ethtool -G eth0 rx 4096 tx 4096 , but be aware that a larger buffer may increase latency.

Hardware Interrupt Monitoring and Tuning

Inspect /proc/interrupts to see which CPU handles each NIC interrupt. The file /proc/irq/ IRQ /smp_affinity shows the CPU affinity mask (e.g., 8 means CPU3). Note that interrupt count does not equal packet count because of interrupt coalescing and NAPI polling.

Multi‑Queue NIC Optimization

Modern NICs support multiple queues. ethtool -l eth0 displays the maximum and current queue numbers. Increase the active queues (e.g., ethtool -L eth0 combined 32 ) to let more CPUs participate in packet processing, which is more effective than merely enlarging the RingBuffer.

Interrupt Coalescing

Coalescing reduces interrupt frequency. ethtool -c eth0 shows parameters such as rx-usecs and rx-frames . Adjust them with ethtool -C eth0 adaptive-rx on or by setting explicit thresholds. Be cautious: fewer interrupts improve throughput but may increase latency.

Soft‑Interrupt Monitoring and Tuning

Soft‑interrupt statistics are available in /proc/softirqs . The kernel parameter net.core.netdev_budget controls how many packets the ksoftirqd thread processes in one burst (default 300). Increase it (e.g., sysctl -w net.core.netdev_budget=600 ) to let the thread handle more packets before yielding the CPU.

GRO (Generic Receive Offload)

GRO merges multiple received packets into a larger one before passing them to the network stack, similar to interrupt coalescing but at the soft‑interrupt stage. Check the status with ethtool -k eth0 | grep generic-receive-offload and enable it with ethtool -K eth0 gro on . For transmission, the analogous feature is GSO.

Conclusion

Understanding Linux kernel mechanisms for network packet reception—RingBuffer, hardware and soft interrupts, multi‑queue handling, interrupt coalescing, and GRO—allows you to monitor real‑time statistics, identify bottlenecks, and apply kernel parameters or ethtool settings to optimize throughput and reduce packet loss in production services.