Hello David
If you configure VLAN-based SPAN (VSPAN) with VLAN 100 as the source and you send the monitored traffic to a destination port, then you will see all traffic traversing VLAN 100, not just the broadcasts. VLAN-based SPAN is just a convenient way to enable traffic monitoring on all ports belonging to a particular VLAN with just one command. You can specify whether you want to monitor ingress frames, egress frames or both. Consider the following example:
monitor session 1 source vlan 100 rx
monitor session 1 destination interface GigabitEthernet1/48
Assuming you have two active switchports in VLAN 100, one for computer A and the other for computer B, you will be able to monitor all the traffic they exchange. Frames sent from A to B will be monitored on the 1st port as ingress (but not on 2nd as egress) and replies from B to A will be monitored on the 2nd port as ingress (but not on 1st as egress). All monitored frames will be sent out interface GigabitEthernet1/48.
You can always verify your configuration with: show monitor session 1
Please note: the SPAN destination port (GigabitEthernet1/48 in our example) will go into UP/DOWN state and will not be able to forward conventional traffic.
Have a look here for more information: www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc10
Best regards,
Martin
