What I've read from the forum search is "can't do it"
as torch only captures traffic going through the CPU.
This is kinda dumb; I just want it to work and if it takes a performance hit running torch, I'm OK with that. Torch is a very important tool. Yet switch chips are a very important performance upgrade. I don't feel comfortable remotely reconfiguring the routerboard as a bridge rather than switch; it could take me a day to get on site if it screws up.
Is there a way to mirror traffic from a switch port to something that can be torched? I'm using rb2011's and CRS switches.