How do I investigate packet errors or drops on a physical server NIC?
Network counters describe different loss mechanisms depending on the driver. CRC or framing errors, receive-buffer exhaustion and policy drops need different responses. A cumulative nonzero counter may be historical, so record its change during the affected interval instead of treating any old error as the current cause.
Before you start
- Authorised access to the dedicated server and the named inspection tools.
Instructions
1. Read standard interface counters
Inspect the exact physical port or relevant virtual interface. Repeat the same query after the incident interval to compare deltas.
date -u -Is
ip -s link show dev enp1s0Review received/transmitted packets, errors and dropped counts. The counters are generally cumulative since an interface or driver reset.
2. Read driver-specific statistics
The detailed names and meanings vary by NIC and driver. Use the vendor’s documentation when interpreting a particular counter.
sudo ethtool -S enp1s0Compare growth with link state, CPU load and switch-side counters. Do not clear counters or change offload settings before preserving evidence.
Check the result
- A growing counter is tied to the observed loss and the relevant host, cable/transceiver, switch or workload cause is investigated.
Troubleshooting
- The switch reports errors but the host does not
- Inspect both directions and the correct physical port mapping.
- Drops rise only under peak load
- Queue pressure or processing capacity may be involved; physical cable replacement is not automatically the answer.
- Counters reset unexpectedly
- Check driver reloads, interface resets, reboots and monitoring continuity.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.