How to Configure Encapsulated Packet Task Offload in Windows 11 Using PowerShell

Modern software-defined networking (SDN), container platforms, and Hyper-V virtualisation environments encapsulate network packets inside overlay protocols such as Virtual Extensible LAN (VXLAN) or Network Virtualisation using Generic Routing Encapsulation (NVGRE). While network overlays provide multi-tenant isolation and flexible IP routing across physical networks, encapsulating packets adds outer IP and UDP/GRE headers. Without dedicated hardware support, the physical network adapter cannot parse the inner packet, disabling standard hardware acceleration features like checksum calculation and Large Send Offload (LSO). Windows 11 includes Encapsulated Packet Task Offload (also known as NVGRE/VXLAN Task Offload), which delegates inner-packet processing to the physical network card controller. Using PowerShell, you can inspect, enable, and tune encapsulated task offloads.

Understanding Encapsulated Packet Task Offload

When encapsulated packet task offload is active on a network adapter:

• Inner Packet Checksumming: The physical network interface card (NIC) parses both the outer transport header (e.g. UDP port 4789 for VXLAN) and the inner payload, calculating IP, TCP, and UDP checksums directly in hardware.
• Inner Large Send Offload (LSO): The NIC segments large virtual machine or container TCP buffers into MTU-sized packets, applying the encapsulation envelope to each segment automatically.
• Virtual Switch Acceleration: Hyper-V virtual switches and Windows Subsystem for Linux (WSL2) bridge interfaces leverage encapsulated offloads to achieve wire-speed virtual networking with minimal CPU interrupt overhead.
• Troubleshooting Considerations: If NIC drivers contain bugs handling specific encapsulation formats or if packet sniffers report corrupted inner checksums, disabling encapsulated task offload forces the host CPU to process overlays in software, restoring packet reliability.

Auditing Encapsulated Offloads with Get-NetAdapterEncapsulatedPacketTaskOffload

To inspect whether your physical network adapters support and actively run encapsulated task offloads, open an elevated PowerShell prompt and run Get-NetAdapterEncapsulatedPacketTaskOffload:

Get-NetAdapterEncapsulatedPacketTaskOffload

The command outputs a structured table displaying adapter status:

Name                   EncapsulatedPacketTaskOffloadNvgre EncapsulatedPacketTaskOffloadVxlan
----                   ---------------------------------- ----------------------------------
Ethernet               Enabled                            Enabled
vEthernet (Default)    Disabled                           Disabled
Wi-Fi                  NotSupported                       NotSupported

To query a specific network adapter by name:

Get-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet"

Enabling Encapsulated Packet Task Offload via PowerShell

To enable hardware overlay offloads on a supported network card, use the Enable-NetAdapterEncapsulatedPacketTaskOffload cmdlet:

Enable-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet"

To explicitly enable offloads for both NVGRE and VXLAN overlay protocols:

Enable-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet" -NvgreSupported $true -VxlanSupported $true

If you exclusively use VXLAN (standard in Kubernetes, Docker overlay networks, and modern SDN fabrics):

Enable-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet" -VxlanSupported $true

Verify that the configuration is active:

Get-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet"

Disabling Encapsulated Packet Task Offload via PowerShell

If virtual machines experience dropped overlay packets, connection resets across SDN gateways, or packet inspection tools misinterpret hardware-checksummed packets, disable encapsulated task offloads using Disable-NetAdapterEncapsulatedPacketTaskOffload:

Disable-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet"

To disable only NVGRE while maintaining VXLAN hardware support:

Disable-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet" -NvgreSupported $true

Confirm that the status shifts to Disabled:

Get-NetAdapterEncapsulatedPacketTaskOffload -Name "Ethernet"

The change applies immediately at the NDIS miniport driver level without requiring an adapter restart or system reboot.

Inspecting Driver-Level Advanced Properties

Network card manufacturers (such as Intel, Mellanox, or Realtek) often register granular overlay properties in the Windows Device Manager driver properties. You can inspect these vendor keys directly in PowerShell using Get-NetAdapterAdvancedProperty:

Get-NetAdapterAdvancedProperty -Name "Ethernet" | Where-Object { $_.DisplayName -match "Encapsulated|VXLAN|NVGRE" }

This reveals hardware-specific driver keys (e.g. VXLAN Checksum Offload or Encapsulated Task Offload) and allows fine-grained driver tuning via Set-NetAdapterAdvancedProperty.

Verifying Overlay Throughput and Packet Health

After adjusting encapsulated task offload settings, evaluate virtual network performance:

1. Run an iPerf3 or network throughput benchmark between two overlay virtual machines or containers:

   iperf3.exe -c 10.0.0.5 -t 30

2. Observe CPU core load on the Windows 11 host. When encapsulated offload is active, host CPU consumption remains low even during saturated 10 Gbps+ transfers.
3. Verify that no packet checksum errors appear in guest network logs using netstat -s.