Try adding this line to the config and see if it helps. console(config)#monitor session 1 mode
We have a router plugged into port Te1/0/21 that all our WAN traffic comes from into our data centre.  We have port mirroring configured to mirror that port to Te1/0/22. monitor session 1 destination interface Te1/0/22monitor session 1 source interface Te1/0/21 We have a Sourcefire device monitoring the traffic and when I do a tcpdump for that interface I'm only seeing ARP, STP and connections to the switch http interface. We have mirroring on a N3024 that is working fine for a different router. The 8024F is stacked with another 8024F via the first 4  fibre ports.  8 of the other ports across the 2 switches have fibre connections then we have 7 fibre to rj45 connectors in each switch connecting to cat5e cables to other devices.  Ports 21-24 we are using the rj45 ports rather than the fibre ports on each switch. Switch firmware is 4.2.2.3.
8024F Port Mirroring Not Capturing All Traffic