We can capture the packets sent to CPU by following steps. There is no CPU consuming when doing SPAN.
 
1，Choose an administratively shut down port for the SPAN source interface
 Router(config)#monitor session 1 source interface <>
 
2，Choose a destination port, connect the PC to this port
 Router(config)#monitor session 1 destination interface <>
 
3，Loginto the SP, set the SPAN session
 Router#remote login switch
 Router-sp#test monitor add 1 rp-inband rx
 Router-sp#exit
 
4，Then you could capture the date with wireshake.
 
5，Delete the capture process
Router-sp#test monitor del 1 rp-inband
Router-sp#exit
 
6，Delete the monitor session
Router(config)#no monitor session 1

That's all!