VLAN tagged traffic dropped by vSwitch after Intel ICEN driver package fails with error "DDP package failed"

Products

• VMware NSX
• VMware vSphere ESXi

Issue/Introduction

• VLAN tagged traffic is dropped by vSwitch due to the vmnic not removing the VLAN tag.
• You are using Intel based ICEN driver package.
• One or more vmnic interfaces may only be affected. 
• Running a packet trace returns the following 

14:09:13.89233[1] PktHandleID: QBmXINxFAAA=, Captured at PktFree point, Drop Reason 'VlanTag Mismatch'. Drop Function 'VSwitchLookup'. TSO not enabled, RSS type 2 hash 1689173
329, Checksum not offloaded and not verified, SourcePort 2214592528, headroomlen 208, length 102.

• In the host /var/run/log/vmkernel.log you may see similar to the following entries

2025-08-28T12:58:10.724Z cpu153:2098754)icen: icen_SetPfDvm:1531: 0000:1f:00.1: Network adapter is configured in Single VLAN Mode
2025-08-28T12:58:12.312Z cpu153:2098754)icen: icen_SetPfDvm:1531: 0000:45:00.1: Network adapter is configured in Double VLAN Mode

2025-08-28T12:58:10.998Z cpu183:2098788)WARNING: icen: icen_PrintHealthStatus:752: 0000:1f:00.1: DDP package failed
2025-08-28T12:58:10.998Z cpu183:2098788)WARNING: icen: icen_PrintHealthStatus:753: 0000:1f:00.1: Possible Solution: Update to latest base driver and DDP package

Environment

VMware NSX 

VMware vSphere ESXI

Cause

If a custom or the embedded DDP (Dynamic Device Personalization) package fails to load, the vmnic driver may default to single VLAN mode. 

Resolution

This is a condition that may occur in a VMware NSX environment.

 

Workaround: 

Reboot the host to reload the NIC driver. In some circumstances it may be required to reinstall the driver.