NodeNetworkReceiveErrs

A physical or primary network interface on this host has been receiving a noticeable share of bad packets for a long time.


Severity	warning
Source	node_exporter 1.x, `netdev` collector
Key metrics	`node_network_receive_errs_total`, `node_network_receive_packets_total`

What it means

The kernel counts a receive error when a frame arrives damaged or cannot be accepted: CRC/frame errors, length errors, FIFO overruns and similar. The alert looks at errors as a fraction of received packets and fires only when that fraction stays elevated for an extended period. Virtual interfaces from container networking (veth, cali, flannel, cilium, docker bridges) are ignored.

Every errored frame is a lost packet. TCP recovers with retransmits, so the symptom is usually higher latency, lower throughput, and occasional timeouts rather than a clean outage.

Common causes

A damaged cable, dirty fibre, or failing transceiver/switch port.
Speed or duplex mismatch between the NIC and the switch.
MTU mismatch (jumbo frames on one side only).
Receive ring buffer too small for bursts, causing overruns.
NIC driver or firmware bugs, or a failing NIC.

First checks

Find the worst interfaces across the fleet:

topk(10, rate(node_network_receive_errs_total{device!~"lo|veth.*|cali.*"}[5m]))

Compare with drops, which point to buffer or CPU issues rather than wire damage:

rate(node_network_receive_drop_total{instance="<instance>", device="<device>"}[5m])

Inspect the interface counters on the host:
```
ip -s -s link show <device>
```

Get the detailed NIC statistics, link speed and duplex:

sudo ethtool -S <device> | grep -iE "err|crc|fifo|over|miss" | grep -v ": 0"
sudo ethtool <device> | grep -E "Speed|Duplex|Link detected"

Check ring buffer sizes and kernel messages:

sudo ethtool -g <device>
sudo dmesg -T | grep -i <device> | tail

Fixing it

CRC and frame errors are almost always physical: reseat or replace the cable or optic, or move to another switch port, and check the switch-side counters. Fix speed/duplex or MTU mismatches on both ends. For overruns, enlarge the ring buffer (ethtool -G <device> rx <size>) and spread interrupts across CPUs. Update NIC firmware and driver if errors persist on known-good cabling. On cloud VMs, stop and start the instance to move it to other hardware.

NodeNetworkTransmitErrs: the same interface failing on the send side.
NodeNetworkInterfaceFlapping: a bad link often flaps as well.
NodeExporterDown: severe packet loss can make scrapes fail.