We can capture the packets sent to CPU by following steps. There is no CPU consuming when doing SPAN.
1,Choose an administratively shut down port for the SPAN source interface
Router(config)#monitor session 1 source interface <<empty administratively down port>>
2,Choose a destination port, connect the PC to this port
Router(config)#monitor session 1 destination interface <<sniffer port>>
3,Loginto the SP, set the SPAN session
Router#remote login switch
Router-sp#test monitor add 1 rp-inband rx
Router-sp#exit
4,Then you could capture the date with wireshake.
5,Delete the capture process
Router-sp#test monitor del 1 rp-inband
Router-sp#exit
6,Delete the monitor session
Router(config)#no monitor session 1
That's all!
转载于:https://blog.51cto.com/ipneter/697743