Cisco Catalyst 2000 Configuration Handbook page 230

(Source switches only) Select the monitor sources:
2.
(config) monitor session session_number source {{single_interface |
interface_list | interface_range | mixed_interface_list | single_vlan |
vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]} | {remote vlan
rspan_vlan_ID}}
The RSPAN source is identified as one or more physical switch ports src-mod/src-
ports, as one or more VLAN numbers vlans. This is performed only on the switch
where the source is connected. The RSPAN VLAN number to be used is rspan-vlan
(1 to 1000, 1025 to 4094). The direction of the monitored traffic can be rx (traffic
received at the source), tx (traffic transmitted from the source), or both (the default).
By default multicast traffic is monitored as it exits from the source. To disable this
behavior, use the multicast disable keywords.
If a trunk is used as a source port, you can filter the trunk to select specific VLANs
to be monitored by using the filter vlans (one or a range of VLAN numbers) key-
words.
Tip You can configure more than one active RSPAN session at the source switch. The
first session is created as previously shown. To create subsequent sessions, use the create
keyword. If create is omitted, the newly configured session overwrites the first session.
You should use a different RSPAN VLAN for each session.
(Destination switches only) Select the destinations:
3.
monitor session session_number destination {single_interface | interface_list
| interface_range | mixed_interface_list} | {remote vlan rspan_vlan_ID}}
The RSPAN destination port, where the monitoring device is connected, is identified
as mod/port. This is performed only on the switch where the destination port
resides.
The destination port is normally used for a traffic-capturing device, so inbound traf-
fic on the destination port is not allowed by default. If needed, you can enable nor-
mal switching of inbound traffic at the destination with the inpkts enable keywords.
Note RSPAN differs from SPAN in that the destination port always has the STP enabled.
This prevents bridging loops from accidentally forming if other network devices are con-
nected to the destination port. However, this also means that you can't monitor STP
BPDUs with RSPAN.
By default the MAC addresses from inbound packets on the destination port are
learned because they are on any switch port. You can disable address learning on the
destination with the learning disable keywords.
Chapter 12: Switch Management 209