A Switched Port Analyzer, or SPAN, is a way that you can monitor traffic. Back when networks used hubs, all traffic was visible because a hub just repeated the traffic out every port except the one it came in on. When switches were introduced, SPAN functionality was introduced to accommodate.
It is common to set a SPAN port up to a device with Wireshark to analyze network traffic. If you are going to monitor the traffic from a single management workstation, you will need two network interfaces cards (NIC) since SPAN traffic is not able traverse the same line as data. If you are only using the management station to monitor the traffic, you can use the single NIC. SPAN actually copies the data from one port to another that you specify. You can monitor egress traffic, ingress traffic, or a combination of the two.
Configure
When you configure a SPAN session, your source and destination ports cannot be the same. You will configure the source, what you want to monitor, to a destination interface, where you will monitor. The following is an example of the syntax you would use to configure a SPAN session.
Switch#configure terminal Switch(config)#monitor session session-id source interface-id Switch(config)#monitor session session-id destination interface-id
Verify
Switch#show monitor