Setting up a switch to pass data from a SPAN port

A routed port is specifically not a switch port. You are putting the no switchport command on the port to disable the switching functions. It becomes a router interface.

SPAN will not work on a switch port which is routed. Some Cisco devices (very few) can use ERSPAN to route SPAN traffic, but the 3560G is not one of them. SPAN and RSPAN are layer-2 only and ERSPAN is across layer-3.

Understanding SPAN,RSPAN,and ERSPAN

Local SPAN: Mirrors traffic from one or more interface on the switch to one or more interfaces on the same switch.

Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches, which means that you can centralize your network capture devices. RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.

Encapsulated remote SPAN (ERSPAN): encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains.

ERSPAN is a Cisco proprietary feature and is available only to Catalyst 6500, 7600, Nexus, and ASR 1000 platforms to date. The ASR 1000 supports ERSPAN source (monitoring) only on Fast Ethernet, Gigabit Ethernet, and port-channel interfaces.

Update:

The latest information I have is that Cisco is planning to add ERSPAN support to some Catalyst 3K and 4K switches in code versions to be released later in 2016, albeit there were no guarantees.

A switch stack basically works like a single switch with a single configuration, much like a chassis switch with multiple blades.

You would configure SPAN the same way you do on a single switch. You can set up all the traffic to go to a single monitor port on any of the switches, although you could easily overload the single port and drop a lot of traffic.

For understanding your traffic mix and quantities, NetFlow may be a better solution.