Hello,
now I self found the answer. I forgot to activate the route-cache (in this case I used cef) at the inbound interface. Now the packets were not process-switched an can be recognized by nbar.
Is that explanation right? Anyhow I have the function working I want it.
Regards
Daniel