Not able to see the egress traffic of a mirrored port when monitoring using a virtual machine
Mirrored egress traffic of a port is not seen when doing a packet capture on a windows VM mounted inside a MAC OS.
Summit and Blackdiamond series
Monitor port is connected to a virtual machine (for capturing the mirrored traffic using wireshark)
When the egress traffic of a port is mirrored, it generally is associated with an internal VLAN tag even though the port is untagged. This is because the mirroring mechanism happens before the VLAN translation or before VLAN ID is removed.
Wireshark has a mechanism to filter this traffic and properly show them in the capture as an untagged traffic based on the register settings in the installed OS.
When installed on a virtual environment such as Windows VM inside a MAC OS, the wireshark is not able to perform this filtering and hence the egress traffic is not seen in the packet capture.
This is not a mirroring issue. Use the wireshark to capture the mirrored traffic on a PC without a VM environment.