The NSF are accelerator architecture. The actual firewall part, the director, where you perform the capture. Will only see the start of the session. The rest of the packets are accelerated/bypassed...