I do not know how long this facility has existed, but man tc-matchall showed
EXAMPLES
To create ingress mirroring from port eth1 to port eth2:
tc qdisc add dev eth1 handle ffff: ingress
tc filter add dev eth1 parent ffff: \
matchall skip_sw \
action mirred egress mirror \
dev eth2