SPAN

Switch port analyser, number of sessions is switch-dependent, by default traffic in both directions


monitor session 1 source interface gi0/2
monitor session 1 destination interface gi0/3

no monitor session 1

Remote SPAN

On low end switches, reflector port - unused port the resources are used for remote span


vlan 901
	remote span

monitor session 1 source interface gi0/2
monitor session 1 destination remote vlan 901

monitor session 1 source remote vlan 901
monitor session 1 destination interface gi0/3

ERSPAN

Capturing on a remote network


monitor session 1 type erspan-source
	source interface gi0/2
	destination
		erspan-id 100
		orgin ip address 10.10.1
		ip prec 5
		ip ttl 32
		mtu 1700
		ip address 10.10.0.1
		vrf 1
		no shutdown