Netvirt classifier attempts to filter out already classified traffic inbound from a service function checking the thernet type on the ethernet header:

cookie=0xf005ba1100000001, duration=6775.394s, table=100, n_packets=0, n_bytes=0, priority=510,encap_eth_type=0x894f actions=resubmit(,17)

The intention is that if ethernet type is NSH, that traffic is already classified and does not need to go again through the classifier.

The problem is that match encap_eth_type=0x894f looks in the inner ethernet header. To match the outer ethernet header, the field NXM_NX_ENCAP_ETH_TYPE needs to be used instead.