CCR2004-1G-2XS-PCIe performance issues in passthrough mode

I’ve recently bought two Mikrotik CCR2004-1G-2XS-PCIe NICs with the hope of using them as modern (PCIe 3) 10G SFP+ NICs in two Linux workstations.

While I understand that the main use-case of these cards is not straight SFP+ NICs, but instead trading rack space and flexibility with raw performance, I still hopped --- given they are marketed as dual 25G cards, citing from the product page "This NIC can reach wire-speed (100Gbps) with Jumbo frames. It ensures that in most server setups this CCR network card will not be the bottleneck." --- that I could at least use them as 10G NICs in passthrough mode, if not full-duplex on both ports, then at least half-duplex on one port.

However, I can't seem to squeeze more than 7 Gib one way, or somewhere around 2x5 Gib both ways.


This is what I've tried:

  • the Linux workstations both use the latest stable Linux kernel (6.17);
  • before trying the Mikrotik cards, I've used two HP 10G NICs (PCIe 2) to saturate 10 Gib both ways; (using iperf3 over 20 TCP streams in each direction;)
  • I'm using a 1m DAC directly between the two workstations; (I've tried multiple ones;)
  • I've updated the RouterOS on both to 7.20.2, and I've reset to factory defaults afterwards;
  • I've enabled Jumbo frames both in RouterOS and on the Linux host;
  • using the RouterOS BandwidthTest server (after disabling passthrough on one of the ports) I did achieve 10 Gib; (the other port was connected to a Mikrotik switch on 10G, thus why the second SFP port being capped at 10 Gib;)

Here is my full config:

/export terse 
# 2025-10-21 20:26:32 by RouterOS 7.20.2
# software id = CDM3-X6IL
#
# model = CCR2004-1G-2XS-PCIe
# serial number = {redacted}
/interface bridge add admin-mac={redacted} auto-mac=no name=bridge
/interface ethernet set [ find default-name=sfp28-1 ] l2mtu=9500 mtu=9000
/interface ethernet set [ find default-name=sfp28-2 ] l2mtu=9500 mtu=9000
/interface ethernet set [ find default-name=ether-pcie1 ] l2mtu=9500 mtu=9000 passthrough-interface=sfp28-1
/interface ethernet set [ find default-name=ether-pcie2 ] l2mtu=9500 mtu=9000 passthrough-interface=sfp28-2
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/port set 0 name=serial0
/interface bridge port add bridge=bridge interface=ether-pcie3
/interface bridge port add bridge=bridge interface=ether-pcie4
/interface bridge port add bridge=bridge interface=ether1
/ip address add address=192.168.88.1/24 interface=bridge network=192.168.88.0

Could someone with more experience with these cards guide me in the proper direction?

Am I missing something? (On the Linux side there is a standard OpenSUSE 15.6 deployment, with the NICs managed by systemd-networkd.)

Digging a bit on the internet, it seems that (2 years ago) even Mikrotik's own staff has issues getting more than around 7 GiB (in one direction) out of the card on Linux:
=> https://www.youtube.com/watch?v=Y9wUep7_48I

Digging into the comments of that video, I stumbled upon the following message from the @mikrotik account (from 3 weeks ago, that is October 2025):

In a simple pass-trough setup you could always achieve wire-speed. Since filming the video, there have been various software improvements. For example, recently we found there was an issue in setups that involve the virtio network driver that Proxmox uses and the fix resulted in massive throughput improvements.

So, at least according to this comment, one could achieve wire-speed, however, the comment doesn't go any deeper into the "how"...