Depends on the signature and the type of traffic.
The atomic signatures will likely alert on each copy of the packet.
The stream based regex signatures may only fire one alarm because the stream reassembly code may throw out the duplicate packet.
Fragmented traffic may also only fire a single alarm because the fragmentation reassembly code may throw out the duplicate packet.
As for why you are getting duplicates:
What type of span are you using, and what type of switch are you using, and what is routing between the vlans?
If you are doing a both (tx+rx) span on a vlan, and both the source and destination ports are in the same vlan then you are getting duplicates even within the same vlan: once for the rx, and again for the tx.
Try using only rx span so you see the packets just when they enter the switch and not when they leave the switch.
If you are using a Cat 6000 with an MSFC doing the routing then try spanning rx on each port of each of the vlans being routed. This way you see the packets come in one vlan, instead of in on one vlan and out on the second vlan. (Note: the MSFC port in many cases doesn't act the same with span as the other physical ports of the switch. Packets being routed by the MSFC may be switched in hardware to increase routing performance, and never actually be sent to the MSFC port, so span won't see them as either rx or tx to the MSFC port.)
