Layer 2 Port-Mirroring Restrictions

The following restrictions apply to Layer 2 port mirroring:

The port-mirrored input interface should not participate in any kind of routing activity.
The mirror destination device should be on a dedicated bridge domain and should not participate in any bridging activity. The mirror destination device should not have a route to the ultimate traffic destination, and the mirror destination device should not send the sampled packets back to the source address.
For example, if the VPLS packets sampled at 190.68.20.5 have a destination address of 190.68.9.10 and the port-mirrored traffic is sent to 190.68.20.15 for analysis, the device associated with 190.68.20.15 should not know a route to 190.68.9.10 and should not send the mirrored packets back to 190.68.20.5.
Only Layer 2 transit data can be mirrored. Packets generated by the Routing Engine (such as Layer 2 control packets) are not mirrored.
For either the global port-mirroring instance or a named port-mirroring instance, you can configure only one mirror output interface per port-mirroring instance and packet address family. If you include more than one interface statement under the family (bridge | vpls) output statement, the previous interface statement is overridden.
Layer 2 port mirroring of input or output to a logical interface, input to a forwarding table in a bridge domain, or input to a flood table for a VPLS routing instance is not supported for logical systems.