CentOS VM on Hyper V only shows traffic in one direction?

edit

I have a Cent OS VM with VOIPmonitor running as a VM on Windows 2012 R2 Hyper V. Voipmonitor uses tshark to capture packets. I have also tested manually with tshark. The VM has two NICS attached. One for its network and one is a direct port mirror from the firewall.

I can only see traffic from the one network to the other. None of the return traffic is seen.

I have followed this how to for Hyper V and promiscuous mode: https://cloudbase.it/hyper-v-promiscu...

When I run the same tshark command on the physical host, I can see traffic in both directions.

Any ideas?