A back-to-back SPAN session would seem to work. I can't say that is what was used in your environment but I just labbed it up and it worked with no problems. I was able to capture packets on the laptop that were from the gi0/7 interface on the 2960G. A poor mans RSPAN.
Test layout and configurations below. No special configuration on the switchports at all, just our leftover lab stuff.
rest-of-world ======== [gi0/7]2960G[gi0/2] ====== [fa1/0/1]3750-24[fa1/0/2] =========== laptop
2960G
====================
!
interface GigabitEthernet0/2
switchport access vlan 705
switchport mode access
switchport nonegotiate
spanning-tree portfast
!
interface GigabitEthernet0/7
description Trunk to rest of world
switchport trunk allowed vlan 1,4,113,125,130,132,270,420,444,655,705,998
switchport mode trunk
switchport nonegotiate
logging event trunk-status
!
monitor session 1 source interface Gi0/7
monitor session 1 destination interface Gi0/2
!
3750-24
=======================
!
interface FastEthernet1/0/1
switchport access vlan 777
spanning-tree portfast
!
interface FastEthernet1/0/2
switchport access vlan 777
spanning-tree portfast
!
monitor session 1 source interface Fa1/0/1
monitor session 1 destination interface Fa1/0/2
!
Edit: Does not work with "encapsulation replicate" on the monitor destination command.
A switch stack basically works like a single switch with a single configuration, much like a chassis switch with multiple blades.
You would configure SPAN the same way you do on a single switch. You can set up all the traffic to go to a single monitor port on any of the switches, although you could easily overload the single port and drop a lot of traffic.
For understanding your traffic mix and quantities, NetFlow may be a better solution.
Best Answer
Packet Tracer has some built-in functionality to allow you to view the packets on the wire and won't support the monitor commands.
However, if you weren't on tracer, the setup is straightforward. E.g.