Use daemonlogger + VXLAN to create "software span"

daemonlogger@.service

[Unit]
Description=Daemonlogger %i
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/daemonlogger -i %i -o span0 'not (dst X.X.X.X and dst port 4789)'
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255

[Install]
WantedBy=multi-user.target

HOWTO.txt

**Only really tested on Ubuntu 16.04**

Requirements:
* Two Linux systems (one to send traffic, one to receive)
* Network connectivity over UDP 4789

Sender Setup
* Install daemonlogger (sudo apt install daemonlogger)
* Save systemd service config as /etc/systemd/system/daemonlogger@.service (replace X.X.X.X with IP of receiver)
* Reload systemd (sudo systemctl daemon-reload)
* Put interfaces snippet for span0 in /etc/network/interfaces.d (replace X.X.X.X with IP of receiver)
* Bring up span0 (sudo ifup span0)
* Add a daemonlogger instance for each interface you want to monitor (sudo systemctl enable daemonlogger@IFACE)
* Start each daemonlogger instance (sudo service daemonlogger@IFACE start)

Receiver Setup
* Put interfaces snippet for span0 in /etc/network/interfaces.d (replace X.X.X.X with IP of receiver)
* Bring up span0 (sudo ifup span0)

span0.sender

auto span0
iface span0 inet manual
	pre-up ip link add span0 type vxlan id 0 remote X.X.X.X dstport 4789
	up ip link set span0 up
	down ip link set span0 down
	post-down ip link del span0

span0.target

auto span0
iface span0 inet manual
	pre-up ip link add span0 type vxlan id 0 local X.X.X.X dstport 4789
	up ip link set span0 up
	down ip link set span0 down
	post-down ip link del span0