Cisco Catalyst 2000 Configuration Handbook page 228

The source of traffic for the SPAN session can be either switch ports or VLANs. If
switch ports are to be monitored, they are identified as src-interface (only a single
interface type and number).
If a VLANs is to be monitored, it is identified as src-vlan.
The SPAN destination port, where the monitoring device is connected, is selected by
the interface dest-interface command before the port monitor command is applied.
The destination port must belong to the same VLAN as the source.
Switches inherently monitor traffic in both directions.
Select the source and destination.
■
a. Select the session source:
(global) monitor session session {source {interface interface} | {vlan
vlan-id}} [, | - | rx | tx | both]
The SPAN session is uniquely identified by session (1 or 2). The source can be
an interface (an interface type and number or a port-channel number) or a
VLAN number vlan-id (1 to 1005). Multiple source VLANs can be given by
using the vlan keyword followed by vlan-id numbers separated by commas (,).
To specify a range of VLAN numbers, use the vlan keyword followed by the
first and last vlan-id numbers, separated by a dash (-).
■ Source traffic to be monitored can be one of rx (traffic received at the source),
tx (traffic transmitted from the source), or both (the default).
b. Select the session destination:
(global) monitor session session {destination {interface interface} [, |
-] | {vlan vlan-id}}
The destination for the SPAN session (session number 1 or 2) can be an
interface (interface type and number) or a VLAN number vlan-id (1 to 1005).
Multiple destinations can also be specified, if needed. These can be given with
the interface keyword, followed by a list of interface numbers separated by
commas (,). To specify a range of interfaces, use the interface keyword followed
by the first and last interface numbers, separated by a dash (-).
c. (Optional) Filter VLANs on a trunk source:
(global) monitor session session filter vlan vlan-id} [, | -]
If a trunk is used as a source port, you can filter the trunk to select specific
VLANs to be monitored. A VLAN number is identified as vlan-id (1 to 1005).
Multiple source VLANs can be given with the vlan keyword, followed by a list
of vlan-id numbers separated by commas (,). To specify a range of VLANs, use
the vlan keyword followed by the first and last vlan-id numbers, separated by a
dash (-).
Chapter 12: Switch Management 207