n 10 destination interface Gi1/0/20 You can also monitor one or more interfaces. Multiple interfaces can be configured separately or on a single configuration line: 3750(config)#monitor session 11 source interface g1/0/11 3750(config)# monitor session 11 source interface g1/0/12 Entering the two preceding commands adds the following line to the configuration: monitor session 11 source interface Gi1/0/11 - 12 The sources in a monitor session can be configured as either receive (rx), transmit (tx), or both. The default is both: 3750(config)#monitor session 1 source int g1/0/12 ? Specify another range of interfaces Specify a range of interfaces both Monitor received and transmitted traffic Monitor received traffic only Monitor transmitted traffic only Interfaces should usually be monitored in both directions, while VLANs should be monitored in only one direction. When capturing VLAN information, be careful if you see double pack- ets. Remember that each packet will come into the VLAN on one port and exit on another. Using the default behavior of both when monitoring a VLAN will result in almost every packet being duplicated in your packet capture. I can't tell you how many times I've been convinced that I'd stumbled onto some rogue device duplicating packets on the network, only to realize that I'd once again burned myself by monitoring a VLAN in both directions. The safest thing to do when monitoring VLANs is to monitor them only in the rx direction. Because the default is both, I like to think that I'm a victim of some inside joke at Cisco, as opposed to being a complete idiot. To see which SPAN sessions are configured or active, use the show monitor command: 3750#sho monitor Session 1 : Local Session Source VLANs RX Only Destination Ports Gi1/0/22 Encapsulation Native Ingress Disabled Session 10 : Local Session Source VLANs TX Only Destination Ports Gi1/0/20 Encapsulation Native Ingress Disabled To disable monitoring on a specific SPAN, you can delete the entire monitor session, remove all the sources, or remove 