I'm curious why the 6509 is limited to only 2 SPAN sessions. This doesn't seem logical when you can port monitor as many ports as you have on the lower end switches.
Also, I tried implementing the alternate way recommended by Cisco for capturing data using the method described here: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/sft_6_1/configgd/acc_list.htm#38131 "Capturing Traffic Flows". Has anyone got this to work, and if so, could send a config example? I set it up but it didn't appear to work, as I couldn't see the traffic I could normally with a SPAN session.