I've a live instants where I've setup a monitor session on a stacked pair of C9200 running 17.09. CAT9K_LITE_IOSXE. Monitor session passed through another stack of 2* C9300-48UXM and 2*C9300-12 also on 17.09 CAT9K_LITE_IOSXE.
Then into a VM host where the traffic is collected by WireShark. But I'm only seeing ARP requests and nothing else
C9200 Stack
monitor session 10 source interface Gi1/0/21 - 23 rx
monitor session 10 destination remote vlan 810
vlan 810
name BR#9138COMMISSUE
remote-span
#show monitor session 10 detail
Session 10
----------
Type : Remote Source Session
Description : -
Source Ports :
RX Only : Gi1/0/21-23
TX Only : None
Both : None
Source Subinterfaces :
RX Only : None
TX Only : None
Both : None
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source Drop-cause : None
Source EFPs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : None
Filter VLANs : None
Dest RSPAN VLAN : 810
IP Access-group : None
MAC Access-group : None
IPv6 Access-group : None
