Traffic received on multiple ingress interfaces or Test Access Points (TAPs) is aggregated, filtered, and forwarded to a monitoring tool on egress interface or egress-group. The forwarding decision is based on the ACLs and route-maps applied on the aggregated logical interface or port-channel.