The other day I was attempting to analyze traffic traversing an 802.1Q trunk via SPAN, and I noticed the trunk headers were missing. I also noticed I wasn't seeing the typical background traffic like STP and CDP. A bit of poking around suggested I needed to configure SPAN to replicate the source 802.1Q encapsulation.
Switch(config)# monitor session 1 source interface g0/1 Switch(config)# monitor session 1 destination interface g0/2 encapsulation replicate
Alternatively, the encapsulation can be explicitly configured as either 802.1q or ISL. After modifying the SPAN session I was seeing all traffic as expected. Seems strange that this isn't done by default.