Hello. I have the below setup for a mirrored port going to a laptop with wireshark. I have the access-list\monitor filter setup, but it's still showing all traffic and is generating a 100 MB file every minute, which is too much. What am I missing? I only want to see traffic from the 172.17.15.0/24 subnet going to 172.17.60.0/24 subnet.
ip access-list 2ndwestvoice
10 permit ip 172.17.15.0/24 172.17.60.0/24
20 deny ip any any
!
monitor session 1
source interface Ethernet1/3 both
rate-limit auto
destination interface Ethernet1/8 primary
filter filter-list 2ndwestvoice
no shut
!
monitor filter-list 2ndwestvoice
permit filter 2ndwestvoice
