1
Diagnostic step 1
On a single non-critical guest, disable virtio offloads (ethtool -K vnet0 tso off gso off gro off) and test large transfers to confirm impact; revert after test.
FULL AI ANALYSIS
KVM guest interface MTU drops to 1500 and large TCP transfers stall after enabling 802.1Q VLAN tagging on host bridge
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Behavior strongly suggests interaction between VLAN offloading, jumbo frames, and virtio/bridge handling on the host. The fact that removing VLAN tagging from the host resolves the issue and that kernel driver logs reference send failures during high throughput indicates a host-side driver/firmware or offload path bug rather than guest configuration. Offloads (TSO/GSO/GRO) can cause the host to hand oversized skbs to the NIC which, when combined with VLAN tag processing in hardware, can exceed device constraints and result in drops or send failures.
Possible causes
Host NIC driver incorrectly handling VLAN offloads with TSO/GSO enabled, producing bad hardware descriptors for jumbo frames.
90%Kernel/firmware bug in NIC offload path that manifests only when VLANs and jumbo frames are combined under high throughput.
80%qemu/virtio and linux bridge interaction with VLAN-tagged bridges leading to double-tagging or mis-sized frames that the NIC rejects.
35%Switch trunk port MTU or L2 settings incompatible with the NIC's VLAN offload behavior, causing silent drops for large frames.
5%Suggested fixes
2
Diagnostic step 2
Temporarily disable VLAN offload on the host NIC (ethtool -K eth0 rxvlan off txvlan off) and test with bridge VLANs active; if transfers recover, offload is implicated.
3
Diagnostic step 3
Run tcpdump on host physical interface to verify whether frames leaving the NIC are correctly VLAN-tagged and within MTU; capture both host and guest to compare.
4
Diagnostic step 4
Set the host NIC MTU intentionally to 1500 and test; if problem disappears, narrow to jumbo+VLAN offload interaction. Restore previous MTU after testing.
5
Diagnostic step 5
If host-side offload disablement stops failures, collect dmesg, ethtool -S, driver version, firmware version and prepare a minimal reproducible test case for NIC vendor or kernel bug report; escalate with collected captures and steps. Avoid changing production guests' critical settings without maintenance window; perform tests on a single replica guest first.