When configuring a SPAN session for a single direction on core 6509:
monitor session 1 source vlan 1, 5 , 7, 9 rx
Monitor session 1 destination interface g1/1
VLAN 5 is uplink to Firrewall/Internet
VLAN 7 is workstation VLAN
If a workstation is attempting to connect to an FTP server on the Internet, would I see any traffic on VLAN 5 in the rx direction?
Or does the SPAN session only see traffic sourced from the FTP server?
It the traffic is outbound to the FTP server, would there be any rx traffic inbound on the VLAN 5 port?