KVM network performance: vhost-net, multiqueue and MTU tuning

With the right settings a KVM VM can push many gigabits per second. This guide covers the main KVM network performance levers: virtio-net with vhost-net, multiqueue, MTU and offloads.

Before you start

• Root on the KVM host and the guest.
• Baseline numbers from iperf3 between the VM and another machine; see bandwidth vs throughput.

Use virtio-net

Emulated NICs (e1000, rtl8139) are slow. The interface model must be virtio; inside a Linux guest ethtool -i eth0 should report virtio_net. See VirtIO drivers.

Confirm vhost-net

vhost-net moves packet processing from QEMU userspace into the host kernel. It is used automatically when the module is loaded:

lsmod | grep vhost_net

If missing, sudo modprobe vhost_net and add it to /etc/modules-load.d/. You can force it in XML with <driver name='vhost'/>.

Enable multiqueue

One queue means one CPU handles all packets. For VMs with several vCPUs and heavy traffic, add queues (up to the vCPU count):

<interface type='bridge'>
  <source bridge='br0'/>
  <model type='virtio'/>
  <driver name='vhost' queues='4'/>
</interface>

Restart the VM, then enable the queues inside the guest:

sudo ethtool -L eth0 combined 4

Many recent guests enable all queues automatically; check with ethtool -l eth0.

MTU and jumbo frames

• Keep the default 1500 on internet-facing interfaces.
• On private storage or migration networks, jumbo frames (MTU 9000) can reduce CPU use, but every device on the path (switch, bridge, host NIC, guest) must use the same MTU.
• Set it on the bridge and in the VM XML with <mtu size='9000'/>.

Offloads

Checksum and segmentation offloads (TSO, GSO, GRO) are normally on and should stay on. Check with ethtool -k eth0. Turn them off only to troubleshoot specific bugs.

Measure

On a target machine run iperf3 -s, then in the VM:

iperf3 -c TARGET_IP -P 4 -t 30

-P 4 uses parallel streams, which shows the benefit of multiqueue. Also watch per-CPU load with mpstat -P ALL 1.

Beyond the basics

• SR-IOV or PCI passthrough of NIC functions for near line-rate; see PCI passthrough.
• DPDK with vhost-user for packet-processing appliances.

Troubleshooting

• Throughput capped at about 1 Gbit/s: emulated e1000 NIC, or the host uplink is gigabit.
• One vCPU at 100% softirq: enable multiqueue.
• Connections hang with large packets: MTU mismatch along the path.

Frequently asked questions

Can VPS customers enable multiqueue?

Only inside the guest if the host already provides multiple queues; queue count is a host setting.

Bridge or macvtap for performance?

Both perform well; bridges are more flexible.

Does a firewall slow VM networking?

Large rule sets and connection tracking add some CPU cost; keep rules efficient.

Next steps

• KVM disk performance
• Virtual networking
• Open vSwitch with KVM