Splunk Stream is not capture interfaces

Hi, I install stream-app on Splunk Search-Head and deploy independent Stream forwarder via `"curl -sSL http://stream-cont-func02:8000/en-us/custom/splunk_app_stream/install_streamfwd | sudo bash"` command. I enabled HEC. I check the stream-app GUI, server status is active and send metadata. I mirror the traffic from switch to server interface and check the interface via tcpdump command. I see the traffics are mirrored. But I can not see the traffics int the splunk stream app. Splunk says normally splunk streamfwd capture all network interfaces. What can I do? Best Regards Thank you