Hi,
on a host running PVE 9 (kernel 7.0.14-5-pve), the in-tree ice driver occasionally reports phantom multi-gigabyte jumps in the software Rx byte counters.
NIC: Intel E810-XXV for SFP (rev 02), board.id K57775-015
Driver: ice (in-tree), version 7.0.14-5-pve
Firmware: 4.30 0x8001b891 1.3415.0
fw.mgmt 7.3.4 / fw.app 1.3.43.0 (ICE OS Default Package)
fw.netlist 4.2.5000-1.14.0
The issue affects only the software statistics (rx_queue_*_bytes and the aggregated rx_bytes reported by the network stack). Hardware counters and packet counters remain correct, and packet captures show no corresponding traffic. This appears to be a statistics accounting bug, but it breaks all byte-based monitoring and alerting on the affected host.
rx_queue_7_bytes = 5.0 GB
rx_queue_7_packets = 13964
10:38:35
rx_queue_7_bytes = 7.5 GB
rx_queue_7_packets = 13965
Delta over one second: +~2.5 GB, +1 packet
During the affected time windows:
Overall, this appears to be a software accounting issue inside the ice driver or its interaction with the networking stack, rather than actual traffic being received.
on a host running PVE 9 (kernel 7.0.14-5-pve), the in-tree ice driver occasionally reports phantom multi-gigabyte jumps in the software Rx byte counters.
NIC: Intel E810-XXV for SFP (rev 02), board.id K57775-015
Driver: ice (in-tree), version 7.0.14-5-pve
Firmware: 4.30 0x8001b891 1.3415.0
fw.mgmt 7.3.4 / fw.app 1.3.43.0 (ICE OS Default Package)
fw.netlist 4.2.5000-1.14.0
The issue affects only the software statistics (rx_queue_*_bytes and the aggregated rx_bytes reported by the network stack). Hardware counters and packet counters remain correct, and packet captures show no corresponding traffic. This appears to be a statistics accounting bug, but it breaks all byte-based monitoring and alerting on the affected host.
Example
10:38:34rx_queue_7_bytes = 5.0 GB
rx_queue_7_packets = 13964
10:38:35
rx_queue_7_bytes = 7.5 GB
rx_queue_7_packets = 13965
Delta over one second: +~2.5 GB, +1 packet
Additional evidence
- ip -s link show reports:
- 9.8 M Rx packets
- 388 GB Rx bytes
- → approximately 40 kB per packet, which is impossible on an MTU-1500 Ethernet link.
- During another occurrence, /sys/class/net/<iface>/statistics/rx_bytes increased by 3.93 GB within one second on a single 10 GbE interface, corresponding to roughly 31 Gbit/s, well above the physical link capacity.
- The size of the erroneous increment varies (approximately 2.5 GB, 2.7 GB, 3.9 GB), suggesting this is not a simple counter wraparound.
Why this is not real traffic
During the affected time windows:
- tcpdump -i bond0 captured at most 271 frames and about 55 kB during the peak second.
- tshark -z io,stat,1 never reported more than a few tens of kB/s.
- Hardware NIC counters (rx_bytes.nic, rx_unicast.nic) increased smoothly at roughly 87 B per packet, while only the software-maintained per-queue and netdev rx_bytes counters exhibited the multi-GB jumps.
Overall, this appears to be a software accounting issue inside the ice driver or its interaction with the networking stack, rather than actual traffic being received.