To analyze network traffic passing through ports or VLANs you can configure SPAN or remote SPAN to mirror the traffic to another port on the switch or on another switch that has been connected to a network analyzer. The network analyzer can be Wireshark or Riverbed Cascade Pilot what capture or analyze the traffic. Cascade Pilot is here quite interesting because you can filter the traffic before and then send it to Wireshark for a deep analysis.
Back to the configuration, SPAN mirrors traffic received or sent (or both) on source ports or source VLANs to a destination port for analysis. The SPAN session does not affect the switching of network traffic on the source. Except for traffic on the destination, ports do not receive or forward traffic there are shown as monitoring interfaces.
Configure local SPAN session:
Define the source interface which traffic you want to mirror
monitor session 1 source interface GigabitEthernet 0/41
or VLAN as source
monitor session 1 source vlan 500
Define the destination interface
monitor session 1 destination interface GigabitEthernet 0/10
Configure remote SPAN session (1st switch):
At first create an remote SPAN VLAN
vlan 2010 name RSPAN_VLAN remote-span exit
Then like the local SPAN session define the source
monitor session 1 source interface gi 0/47
or VLAN
monitor session 1 source vlan 500
At the end of the configuration of the 1st switch you configure the remote SPAN VLAN as destination
monitor session 1 destination remote vlan 2010
Configure remote SPAN session (2nd switch):
Like on the other switch you need to create at first an remote SPAN VLAN
vlan 2010 name RSPAN_VLAN remote-span exit
Then as source you configure the RSPAN VLAN
monitor session 1 source remote vlan 2010
In the end the destination interface
monitor session 1 destination interface gi 0/18
Important is to verify that the RSPAN VLAN is allowed between these two switches on thier Trunk Interfaces!
With the following command you can verify the monitoring session you configured
show monitor session 1