HFSC shaping accuracy vs hardware offloading persistence on Intel NICs

Shaping accuracy versus offloading behavior

HFSC traffic shaping in pfSense relies on ALTQ queue discipline operating at the kernel level. Hardware offloading features—TCP Segmentation Offload (TSO), Large Receive Offload (LRO), and checksum offloading—can cause packets to be processed by the NIC before reaching the shaper, bypassing queue enforcement and producing inaccurate bandwidth limits or latency spikes.

The GUI exposes toggles for each offloading type under System > Advanced > Networking, yet no definitive guidance documents which combination is safe across all NIC drivers. Benchmarks indicate disabling offloading raises CPU utilization by 5–15% on links above 1 Gbps, creating a throughput–accuracy trade-off.

Further complicating the decision, several Intel drivers (igb, ix) automatically re-enable offloading after a reboot or interface reset unless loader tunables such as hw.igb.tso or hw.ix.lro are set. This persistence gap means a one-time GUI change may not survive production maintenance windows.

Open questions

1. Which specific offloading toggles must be disabled to guarantee HFSC queue discipline sees every packet on Intel igb/ix interfaces?
2. Do the required loader tunables persist across pfSense version upgrades without manual re-application?
3. At what throughput threshold does the CPU penalty of disabling offloading outweigh the shaping inaccuracy on a given hardware platform?