"Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if
incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN can be monitored."
1.Receive SPAN:
Packets will be forworded to destinations before modification (routing(modified TTL ,MAC-address) or QoS) or doping (ACLs , ingress QoS policing ,VLAN ACLs or egress Qos policing).
2.Transit SPAN:
the packets sent by the source interface after all modification(TTL,MAC-address,QoS values) and processing(ACLs and egresss QoS) is performed by the switch.
3.packes like ping the sourece interfaces,will not be monitored.
reference link:
http://www.cisco.com/en/US/products/hw/switches/ps5528/products_configuration_guide_chapter09186a00802b7c55.html#wp1210541
