Recently I have been working with Cisco SPAN. Port mirroring. The goal was to capture rtp/voice traffic at a call centre and pipe the data out to a server which would store all the data.
At the call centre there are 4 x 3560 48port switches with trunks between switches. The destination port was positioned in such a way that the SVI and the destination SPAN port were located on the same switch.
In this case we were able to use Cisco SPAN as opposed to RSPAN or ERSPAN.
The commands were:
Monitor session 1 source vlan 112
Monitor session 1 destination interface fastethernet 0/46
When logging into the server, opening Wireshark, monitoring the capture NIC and filtering rtp we could see the rtp traffic flooding in.