cilium/cilium · warning

setting up GSO/GRO on GENEVE netdev: %w

Error message

setting up GSO/GRO on GENEVE netdev: %w

What it means

After creating the cilium_geneve device, setupTunnelDevice configures GSO/GRO (big TCP) via setupTunnelGSOGRO. Failure here is wrapped as this error. GSO/GRO tuning is an optimization; this error means the offload settings could not be applied to the Geneve netdev.

Source

Thrown at pkg/datapath/loader/netlink.go:195

		}

		if err := netlink.AddrReplace(hostDev, &addr); err != nil {
			return fmt.Errorf("failed to replace IPv6 address: %w", err)
		}
	}
	return nil
}

// setupTunnelDevice ensures the cilium_{mode} device is created and
// unused leftover devices are cleaned up in case mode changes.
func setupTunnelDevice(logger *slog.Logger, sysctl sysctl.Sysctl, mode tunnel.EncapProtocol, port, srcPortLow, srcPortHigh uint16, mtu int, bigtcp bigtcp.Config) error {
	switch mode {
	case tunnel.Geneve:
		if err := setupGeneveDevice(logger, sysctl, port, srcPortLow, srcPortHigh, mtu); err != nil {
			return fmt.Errorf("setting up geneve device: %w", err)
		}
		if err := setupTunnelGSOGRO(logger, defaults.GeneveDevice, bigtcp); err != nil {
			return fmt.Errorf("setting up GSO/GRO on GENEVE netdev: %w", err)
		}
		if err := removeDevice(defaults.VxlanDevice); err != nil {
			return fmt.Errorf("removing %s: %w", defaults.VxlanDevice, err)
		}

	case tunnel.VXLAN:
		if err := setupVxlanDevice(logger, sysctl, port, srcPortLow, srcPortHigh, mtu); err != nil {
			return fmt.Errorf("setting up vxlan device: %w", err)
		}
		if err := setupTunnelGSOGRO(logger, defaults.VxlanDevice, bigtcp); err != nil {
			return fmt.Errorf("setting up GSO/GRO on VXLAN netdev: %w", err)
		}
		if err := removeDevice(defaults.GeneveDevice); err != nil {
			return fmt.Errorf("removing %s: %w", defaults.GeneveDevice, err)
		}

	default:
		if err := removeDevice(defaults.VxlanDevice); err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Disable Big TCP (--enable-bigtcp=false) if the node kernel or NIC does not support it.
2. Upgrade the kernel to >= 5.19/6.x for reliable large GSO/GRO on tunnel devices.
3. Check the wrapped error: if device missing, restart the agent to recreate cilium_geneve.
4. Confirm the geneve device exists and offloads are visible: ethtool -k cilium_geneve.

Example fix

// before
cilium-agent --enable-bigtcp=true   # kernel 5.4
// after
cilium-agent --enable-bigtcp=false  # or upgrade kernel to >= 5.19

// only enable Big TCP when the kernel supports large GSO
if kernelVersionLessThan(5, 19) {
    bigtcpEnabled = false
}

if err := setupTunnelGSOGRO(logger, defaults.GeneveDevice, bigtcpCfg); err != nil {
    logger.Warn("GSO/GRO tuning unavailable; continuing without Big TCP", logfields.Error, err)
    return nil // degrade gracefully — offload is an optimization
}

When it happens

Trigger: setupTunnelGSOGRO on defaults.GeneveDevice fails: ethtool-style netlink/tunables unavailable, device vanished after creation, or bigtcp enabled but kernel doesn't support large GSO/GRO seg fields.

Common situations: Big TCP (--enable-bigtcp) enabled on a kernel without support (needs ~5.19+ for GSO_MAX_SIZE changes); geneve device deleted between creation and offload config; restricted environment blocking ethtool features; NIC/driver lacking GRO on the tunnel device.

Related errors

• failed to setup %s tunnel device: %w
• setting up geneve device: %w
• setting up GSO/GRO on VXLAN netdev: %w
• BIG TCP with bpf-lb-dsr-dispatch geneve requires pending ker
• invalid endpoint %q, must be IP:PORT: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/1771513b877cb760. Report an issue: GitHub.