usually be monitored in both directions, while VLANs should be monitored in only one direction. Chapter 18: Catalyst 3750 Features When capturing VLAN information, be careful if you see double pack- ets. Remember that each packet will come into the VLAN on one port and exit on another. Using the default behavior of both when monitor- ing a VLAN will result in almost every packet being duplicated in your packet capture. I can't tell you how many times I've been convinced that I'd stumbled onto some rogue device duplicating packets on the network, only to realize that I'd once again burned myself by monitoring a VLAN in both directions. The safest thing to do when monitoring VLANs is to monitor them only in the rx direction. Because the default is both, I like to think that I'm a victim of some inside joke at Cisco as opposed to being a complete idiot. To see what SPAN sessions are configured or active, use the show monitor command: 3750# sho monitor Session 1 : Local Session Source VLANs RX Only Destination Ports : Gi1/0/22 Encapsulation : Native Ingress Disabled Session 10 : Local Session Source VLANs TX Only Destination Ports : Gi1/0/20 Encapsulation : Native Ingress : Disabled To disable monitoring on a specific SPAN, you can delete the entire monitor session, remove all the sources, or remove the destination. All monitor commands can be negated: 3750 (config)# no monitor session 11 source interface Gi1/0/11 - 12 You can remove all local SPAN, all RSPAN, or all SPAN sessions as a group by adding the local, remote, or all keywords: 50(config)# no monitor session ? <1-66> SPAN session number Remove all SPAN sessions in the box local Remove Local SPAN sessions in the box remote Remove Remote SPAN sessions in the box You should always remove your SPAN sessions when you no longer need them. SPAN takes up system resources, and confusion can be caused if someone plugs a device into the SPAN destination port. RSPAN works the same way that SPAN does, with the exception that the destina- tion interface is on another swit