This was answered in a previous posting, but I am unclear on the answer,
According to Cisco documentation:
"Monitored Traffic Direction
You can configure local SPAN sessions, RSPAN source sessions, and ERSPAN source sessions to monitor ingress traffic (called ingress SPAN), or to monitor egress traffic (called egress SPAN), or to monitor traffic flowing in both directions.
Ingress SPAN copies traffic received by the source ports and VLANs for analysis at the destination port. Egress SPAN copies traffic transmitted from the source ports and VLANs. When you enter the both keyword, SPAN copies the traffic received and transmitted by the source ports and VLANs to the destination port."
I can understand how either direction of traffic on a single port is mirrored to the destination port.
But if you have a layer three switch and you desiginate the direction of traffic like so:
monitor session 1 source vlan 2-20 rx
monitor session 1 destination interface Gi1/1
Is the traffic mirrored from the layer 2 vlan or the SVI of the vlan on the switch?
If it is the layer 2 vlan, what is considered the "rx" direction point of the layer 2 vlan?
Is the inbound traffic to each individual port in vlans 2-20 mirrored to Gi1/1?
If it is the SVI of the vlan, would the mirrored traffic be the traffic received on the SVI from the devices in the vlan using the SVI as a default gateway?