Some more findings. On the guest, I can see that: /sys/devices/xen/vif-0/net/eth0/statistics/tx_packets is still increasing when I do a ping from the guest to the host after the network hang. There are no dropped packets visible. On the host, I can see that: /sys/class/net/vif1/statistics/tx_dropped is increasing (vif1 is the guest interface): bridge name bridge id STP enabled interfaces br1 8000.feffffffffff no vif1 The host is running kernel 3.16.7-21-xen from 13.2 that doesn't show the bug when installed on the guest. So, it seems that the guest kernel is dropping packages coming in from the host but still sends out packages to the host. This is a pretty weird behaviour.