Flows not being constructed as expected

Hello all,

I'm using cisco switches to mirror packets by vlan as follows:

monitor session 2 source vlan 1 , 5 - 8 , 10
monitor session 2 filter packet-type good rx
monitor session 2 destination interface Gi4/21


When comparing output of `tcpdump` with `ra -S 127.0.0.1:561  -- icmp and
host [my host]`, I do not see flows constructed for pings as expected (or
at all :) ).

This is the first time I've ingested vlan encapped data into argus and was
wondering if I need to adjust some additional settings that I may have
missed?


Thanks,

Matt