It doesn't appear span monitor session needs to be stopped in order to add/remove monitored vlans.
- By default, the session is created in the shut state, and the session is a local SPAN session.
- Switch(config-monitor)# shut ----this is going to disable the entire span session including all monitored vlans.
- If you're referring to source vlans then there's no add/remove syntax, it has to be cancelled then specified.
switch(config)# monitor session 1
Monitored vlans
switch(config-monitor)# source vlan 3, 6-10 tx
Add vlan 1
switch(config-monitor)# no source vlan 3, 6-10 tx
switch(config-monitor)# source vlan 1,3, 6-10 tx
Remove vlan 3
switch(config-monitor)# no source vlan 3, 6-10 tx
switch(config-monitor)# source vlan 6-10 tx
- Using filter option: Filter from the configured sources.
switch(config-monitor)# filter vlan 3, 7
- Virtual SPAN: destination port in trunk mode then you can add/remove vlans from trunk.
switch(config)# interface ethernet 3/1
switch(config-if)# switchport
switch(config-if)# switchport mode trunk
switch(config-if)# switchport trunk allowed vlan add 100-200
switch(config-if)# switchport monitor
switch(config-if)# no shut
switch(config)# interface ethernet 3/2
switch(config-if)# switchport
switch(config-if)# switchport mode trunk
switch(config-if)# switchport trunk allowed vlan add 201-300
switch(config-if)# switchport monitor
switch(config-if)# no shut
switch(config)# monitor session 3
switch(config-monitor)# source vlan 100-300
switch(config-monitor)# destination interface ethernet 3/1-2
switch(config-monitor)# no shut
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_14span.html
I hope this helps. Good luck!
