#2 one-way traffic only

[Ed Davison]

I have installed rcdcap 0.8 on Ubunto 14.04 server.
Cisco CSR 1000v configured with an ERSPAN pointing to my server.
ERSPAN configured as:

monitor session 1 type erspan-source
 description sniff to in-network
 source interface Gi2
 destination
  erspan-id 1
  mtu 1464
  ip address 172.20.44.168
  origin ip address 172.20.44.4

rcdcap running as:

rcdcap -i eth1 --erspan --tap-persist --tap-device mon1

When monitoring traffic with tcpdump/wireshark on mon1 I am only seeing packets in one direction.
I have already done a packet capture on the Cisco switch using the web UI and wireshark shows packets both directions on the interface monitored by the ERSPAN.

How do I troubleshoot this?

[Zero effect]

Are the remote packets in one direction or the local packets?