int fa0/24
port monitor fa0/1
port monitor fa0/2
port monitor fa0/3
^Z
show port monitor
Monitor Port Port Being Monitored
--------------------- ---------------------
FastEthernet0/24 FastEthernet0/1
FastEthernet0/24 FastEthernet0/2
FastEthernet0/24 FastEthernet0/3
Monitored ports must be on same VLAN
Cannot modify monitored ports
“port monitor vlan” is only valid for VLAN 1, and will only monitor management traffic destined to the IP address configured as VLAN 1 on the switch “port monitor”, by itself, will configure the port to monitor all ports on the switch that belong to the vlan that port is assigned to.

On Cat6k:
set span {src_mod/src_ports | src_vlans | sc0} {dest_mod/dest_port} [rx | tx | both] [inpkts {enable | disable}] [learning {enable | disable}] [multicast {enable | disable}] [filter vlans...] [create]

On Cat4k:
set span {src_mod/src_ports | src_vlan} dest_mod/dest_port [rx | tx | both] [filter vlan] [inpkts {enable | disable}] [learning {enable | disable}] [create]
Use the ‘create’ keyword with different destination ports to create multiple SPAN sessions.
If the ‘create’ keyword is not used, and a span session exists with the same destination port, the existing session will be replaced. If the destination port is different, then a new session will be created.
With source 2/1 and destination 3/5
c6500 (enable) set span 2/1 3/5

Cisco Catalyst 4000 6000  with IOS Switches
Submitted By Mark McDonagh
Information Updated: 16 Aug 2004

Syntax for Cat4k:
Cat4k(config)# [no] monitor session {session_number} {source {interface type/num} | {vlan vlan_ID}} [, | - | rx | tx | both]
Cat4k(config)# [no] monitor session {session_number} {destination {interface type/num} }

Syntax for Cat6k:
Cat6k(config)# monitor session session_number source {{single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]} | {remote vlan rspan_vlan_ID}}
Cat6k(config)# monitor session session_number destination {single_interface | interface_list | interface_range | mixed_interface_list} | {remote vlan rspan_vlan_ID}}

Cisco Catalyst 2950 Switches
Submitted By Kevin Farnes
Information Updated: 16 Aug 2004
( From Configuration Mode )
monitor session 1 source interface Interface
monitor session 1 destination interface Interface
The first line determines which ports are being monitored in the session and can be repeated. The second line determines where the
monitor output is to be sent. On the 2950 only ports can be monitored. With Cisco the monitoring capability and commands can vary significantly with different models of switch.

Cisco 3500XL Switches
Submitted By Chris McCulloh
Information Updated: 16 Aug 2004
Connect via a command line, then enter enable mode (type 'en').. then execute the following commands, assuming the sniffer is plugged into port 14 on the switch, and all other ports in a 24 port switch are desired except 23:
configure terminal
interface f14
port monitor f1-13, f15-22,f24
end
The box should then see all traffic.

Cisco Catalyst 5000 Switches
Submitted By Dave Rodrigue
Information Updated: 16 Aug 2004

set span 2-3 5/7 create
where 2-3 are the VLANs I'm monitoring.
Switch ports can be specified as well
set span 2/3 5/7 create     to monitor port 2/3
~From Cisco's docs, in case that makes it clearer:
set span {src_mod/src_ports | src_vlan | sc0} dest_mod/dest_port [rx | tx | both] [inpkts {enable | disable}] [learning {enable | disable}] [multicast {enable | disable}] [create]

Foundry Switches
Submitted By Kevin Farnes
Information Updated: 16 Aug 2004
( From Configuration Mode )
interface Interface
port monitor interface { rx | tx | both}
The first line takes you into the interface that the mirror output should be presented on. The second line defines those interfaces you wish to have mirrored and whether just the input, output or both are copied.

Juniper M or T Series
Submitted By Donald Smith
Information Updated: 20 Aug 2004
Port Mirroring
Define the destination where copies of sampled packets will be sent:
[edit]
user@router# show forwarding-options
port-mirroring { input {family inet; rate <sample-rate>; run-length
<run-length>;} output {interface <interface-name> {next-hop <address>;}
no-filter-check;} }
2. Define a sampling filter to identify "interesting" traffic:
[edit]
user@router# show firewall filter mirror-sample
from {...} then {sample; accept;}
3. Apply the filter to the incoming interface
[edit]
user@router# show interface <interface-name> unit 0 family inet
filter {input mirror-sample;}
Notes:
1. Packets that pass the input filter are sampled based on the <sample-rate> and <run-length>.  In each batch of <sample-rate>   packets, the first <run-length> packets are mirrored.
2. The mirror interface should not participate in any routing. The sampled packets are not in any way encapsulated, so the raw packets are sent out the interface.  Hopefully, the device on the far end is a traffic analyzer and not another router!
3. The <address> needs to be specified when the mirror interface is a multi-access media, and is used to fil in the MAC address.
4. Works only for IPv4 packets, and only for transit traffic.
5. You can only set up one mirror interface per router; all   "sampled" traffic is mirrored.