ndsad + kerio

[Aidaho]

Добрый день.
Поставил на вин 2003 керио и понадобилось отсылать netflow коллектор с этой машинки. Но появились какие то странности... Трафик шлется, но очень уж маленький. Т.е. керио показывает гигабайт например, а на коллекторе 10-15 мегов. В чем может быть проблема? Может кто сталкивался?

вот конфиг

Код: Выделить всё

ip 192.168.63.1
port 9996
force all
promisc all
hash lo 64
hash all 32
heap 65536
dump 5
log ndsad.log

а вот что пишет в логе:

Код: Выделить всё

ndsad.exe[1716]: Session opened on Tue Jan 12 12:11:20 2010
ndsad.exe[1716]: binary version `1.32.2'
ndsad.exe[1716]: `\Device\NPF_{C2B02FCA-ED99-4E58-B4CB-D8C19FB54BF5}': new device
ndsad.exe&#91;1716&#93;&#58; Starting worker thread for device <\Device\NPF_&#123;C2B02FCA-ED99-4E58-B4CB-D8C19FB54BF5&#125;>
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;BF21A540-26A0-4678-9149-3F7C6EDDC1EF&#125;'&#58; new device
ndsad.exe&#91;1716&#93;&#58; Starting worker thread for device <\Device\NPF_&#123;BF21A540-26A0-4678-9149-3F7C6EDDC1EF&#125;>
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;E2544AC7-7419-46FA-A8F5-9F3C757E9879&#125;'&#58; new device
ndsad.exe&#91;1716&#93;&#58; Starting worker thread for device <\Device\NPF_&#123;E2544AC7-7419-46FA-A8F5-9F3C757E9879&#125;>
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;12544D63-CE42-4975-BB04-CF8054AD842B&#125;'&#58; new device
ndsad.exe&#91;1716&#93;&#58; Starting worker thread for device <\Device\NPF_&#123;12544D63-CE42-4975-BB04-CF8054AD842B&#125;>
ndsad.exe&#91;1716&#93;&#58; Creating NFC for <eth> family. dev <\Device\NPF_&#123;C2B02FCA-ED99-4E58-B4CB-D8C19FB54BF5&#125;>
ndsad.exe&#91;1716&#93;&#58; NFC created <0xd87a08>.
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;C2B02FCA-ED99-4E58-B4CB-D8C19FB54BF5&#125;' thread started successfully.
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;BF21A540-26A0-4678-9149-3F7C6EDDC1EF&#125;' thread started successfully.
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;E2544AC7-7419-46FA-A8F5-9F3C757E9879&#125;' thread started successfully.
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;12544D63-CE42-4975-BB04-CF8054AD842B&#125;' thread started successfully.
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;C2B02FCA-ED99-4E58-B4CB-D8C19FB54BF5&#125;' thread is preparing for PCAP loop call
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;BF21A540-26A0-4678-9149-3F7C6EDDC1EF&#125;' thread is preparing for PCAP loop call
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;E2544AC7-7419-46FA-A8F5-9F3C757E9879&#125;' thread is preparing for PCAP loop call
ndsad.exe&#91;1716&#93;&#58; `\Device\NPF_&#123;12544D63-CE42-4975-BB04-CF8054AD842B&#125;' thread is preparing for PCAP loop call
ndsad.exe&#91;1716&#93;&#58; NFC<eth> status on Tue Jan 12 12&#58;11&#58;26 2010
	14/30 messages ready, 97 flows seen...
	21/64 &#40;32.81%&#41; hash usage, 156 entries scaned, 14 dropped
ndsad.exe&#91;1716&#93;&#58; Heap<1>&#58; 14/1092 nodes, 840/65520 bytes
ndsad.exe&#91;1716&#93;&#58; Heap<2>&#58; 0/-1 nodes, 0/-548 bytes
ndsad.exe&#91;1716&#93;&#58; NFC<eth> status on Tue Jan 12 12&#58;11&#58;32 2010
	4/30 messages ready, 231 flows seen...
	29/64 &#40;45.31%&#41; hash usage, 249 entries scaned, 34 dropped

за ранее спасибо