Hello Steve, i've never noticed any similar behaviour; i may only tell you that nfacctd does not generate any kind of additional traffic (it does not resolve any kind of address). Which kind of traffic is it (ARP, IP, who generate it, etc.) ? Can you post some tcpdump trace of such traffic ?
Cheers, Paolo
