according to this : https://www.linux.org/docs/man8/tc-mirred.html
this script will work for me :
root@ultra:~# cat ipmirror.sh
#!/bin/sh
#https://www.linux.org/docs/man8/tc-mirred.html
#https://medium.com/swlh/traffic-mirroring-with-linux-tc-df4d36116119
sniffPort=wan
mirrorPort=dummy0
#Turn on the mirror port
ip link add ${mirrorPort} type dummy
ip link set ${mirrorPort} up
#Add the ingress queue discipline. This qdisc lets us attach the matchall filter
##tc qdisc add dev ${sniffPort} handle ffff: ingress
tc qdisc del dev ${sniffPort} handle ffff: ingress
tc qdisc add dev ${sniffPort} handle ffff: ingress
#Mirror all incoming ICMP packets on sniffPort to a mirrorPort interface for examination with e.g. tcpdump:
##tc filter add dev ${sniffPort} parent ffff: protocol ip u32 match ip protocol 1 0xff action mirred egress mirror dev ${mirrorPort}
#Mirror all incoming IP packets on sniffPort to a mirrorPort interface for examination with e.g. tcpdump:
##tc filter add dev ${sniffPort} parent ffff: protocol ip u32 match u32 0 0 action mirred egress mirror dev ${mirrorPort}
#Mirror all incoming traffic on sniffPort to a mirrorPort interface for examination with e.g. tcpdump:
tc filter add dev ${sniffPort} parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev ${mirrorPort}
tc qdisc del dev ${sniffPort} handle 1: root
tc qdisc add dev ${sniffPort} handle 1: root prio
#Mirror all outgoing traffic from sniffPort to a mirrorPort interface for examination with e.g. tcpdump:
tc filter add dev ${sniffPort} parent 1: protocol all u32 match u32 0 0 action mirred egress mirror dev ${mirrorPort}
tc -s -p filter ls dev ${sniffPort} parent ffff:
tc -s qdisc ls dev ${sniffPort}
echo tcpdump -n -i ${mirrorPort}
edited : fixed IP