Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a setup where a windows 2008R2 VM runs under KVM on a bridged network and captures a lot of multicast UDP data (from videosurveillance cameras). Strangely, the VM network drops packets after a number of concurrent connections ( more than 128 apparently).

kernel is amd64, kvm 0.76 (Debian Lenny).

However if I setup two different tap0 and tap1 interfaces, bridged through the same br0 to eth0 and eth1, the second interface never drops a single packet. The first interface tap0, however, drops lots of packets even if most connections go to the other one.

But if I keep using eth0 for the host, and dedicate eth1 to the VM, eth1 (the VM) will still drops tons of packets (about 20 to 25%). Apparently only the second interface behaves correctly.

Does anyone have any idea about what may be happening here? I can't make sense of it. I don't understand why the fist interface always drop packets.

Here is the kvp-ifup script :

# set address to "DHCP" for DHCP

echo "Configure $1 interface..."
/usr/sbin/tunctl -u 'root' -t $1
echo "Activating link for $1..."
/sbin/ip link set $1 up
sleep 1
echo "Configure $INTERFACE_BRIDGE bridge..."
/usr/sbin/brctl addbr $INTERFACE_BRIDGE
/usr/sbin/brctl addif $INTERFACE_BRIDGE $1
/usr/sbin/brctl addif $INTERFACE_BRIDGE $INTERFACE_LAN
echo "Activating promiscuous mode on $1 and $INTERFACE_LAN..."
/sbin/ifconfig $1 promisc up
/sbin/ifconfig $INTERFACE_LAN promisc up
sleep 2
echo "IP address on $INTERFACE_BRIDGE..."

if [ "DHCP" == "$BRIDGE_ADDRESS" ]; then
        /sbin/pump -i br0
        # static

echo "Done."

I tried both with a bond (different modes) and no bonding.

The physical NICS are Ethernet controller: Intel Corporation 82574L Gigabit Network Connection (e1000e linux driver)

the VM are using the e1000 driver (better results than virtio)

iptables is perfectly empty.

As for offloading, I cannot check but it should be the defaults :

  • rx-checksumming: on
  • tx-checksumming: on
  • scatter-gather: on
  • tcp segmentation offload: on
  • udp fragmentation offload: off
  • generic segmentation offload: on
  • large receive offload: off
share|improve this question

I see there's a bond in place there, is that true? What bonding mode?

What NIC type and driver is used?

What offloading is enabled?

Is the traffic for the bridge also redirected through the hosts' iptables?

What type of virtual NIC does the VM get attached?

share|improve this answer
See my edits in the main post. Thanks. – wazoox Mar 16 '11 at 22:06
right. then a few things: virtio provides much better results than the emulated NICs. tso and gso are better off left disabled. for bonding, you cannot use modes 0,2 and 6 - they don't play well with a bridge on top. check sysctl for net.bridge.bridge-nf-call-* == 0 – dyasny Mar 17 '11 at 9:16
The virtio driver in w2008r2 64 bits fails somewhat sooner than the e1000 driver, and I even had frozen VMs under high load. I'll check the bridge parameters, Thanks. – wazoox Mar 17 '11 at 11:41
where did you get the virtio driver? is it signed by MS? also, would it be possible to try the same kind of load on a RHEL5.6 box? I'm really not sure how stable what Debian provides is - already seen issues on ubuntu and gentoo that don't even happen on fedora rawhide, not to mention RHEL – dyasny Mar 17 '11 at 11:58
"long to set up" is no excuse to omitting a valid troubleshooting step. – dyasny Mar 17 '11 at 22:40
up vote 0 down vote accepted

After weeks of tinkering, the problem was solved by... replacing the network switch. I guess the one we had wasn't powerful enough or something.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.