Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs (rx, tx or both) to a dedicated monitor port feeding Wireshark or an IDS. Original traffic untouched; the monitor port stops switching.

• RSPAN: mirrors across switches through a dedicated remote-span VLAN — L2 domain only.
• ERSPAN: GRE-encapsulated, routable across L3 to a remote collector; type I/II/III differ in header fidelity.

monitor session 1 source interface Gi1/0/1 both
monitor session 1 destination interface Gi1/0/24
! RSPAN adds:
vlan 900
 remote-span

Watch oversubscription (N sources → 1 monitor port drops), and remove sessions after troubleshooting — a lingering SPAN quietly eats bandwidth and CPU.