Catalyst3850可以配置SPAN，RSPAN，另外还可以配置Monitor Capture
Creating a Local SPAN Session

SUMMARY STEPS
1.    configure terminal
2.    no monitor session {session_number | all | local | remote}
3.    monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx]
4.    monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]}
5.    end

配置示例：

Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1
Switch(config)# monitor session 1 destination interface gigabitethernet1/0/2 encapsulation replicate
Switch(config)# end

Creating an RSPAN VLAN
配置示例：

This example shows how to create the RSPAN VLAN 901:
Switch(config)# vlan 901
Switch(config-vlan)# remote span
Switch(config-vlan)# end
This example shows how to remove any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination as RSPAN VLAN 901:
Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 tx
Switch(config)# monitor session 1 source interface gigabitethernet1/0/2 rx
Switch(config)# monitor session 1 source interface port-channel 2
Switch(config)# monitor session 1 destination remote vlan 901
Switch(config)# end
This example shows how to remove any existing configuration on RSPAN session 2, configure RSPAN session 2 to monitor traffic received on trunk port 2, and send traffic for only VLANs 1 through 5 and 9 to destination RSPAN VLAN 902:
Switch(config)# no monitor session 2
Switch(config)# monitor session 2 source interface gigabitethernet1/0/2 rx
Switch(config)# monitor session 2 filter vlan 1 - 5 , 9
Switch(config)# monitor session 2 destination remote vlan 902
Switch(config)# end
This example shows how to configure VLAN 901 as the source remote VLAN and port 1 as the destination interface:
Switch(config)# monitor session 1 source remote vlan 901
Switch(config)# monitor session 1 destination interface gigabitethernet2/0/1
Switch(config)# end
This example shows how to configure VLAN 901 as the source remote VLAN in RSPAN session 2, to configure Gigabit Ethernet source port 2 as the destination interface, and to enable forwarding of incoming traffic on the interface with VLAN 6 as the default receiving VLAN:
Switch(config)# monitor session 2 source remote vlan 901
Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6
Switch(config)# end

参考：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/network_management/configuration_guide/b_nm_3se_3850_cg/b_nm_3se_3850_cg_chapter_0111.html#ID2070
注意：完成相关配置的之前，请注意查看相关限制和注意事项。
关于Monitor Capture：
配置示例

monitor capture mycap interface GigabitEthernet4/0/1 both  /interface or svi
monitor capture mycap match ipv4  any any / ipv4 host 10.1.1.1 host 20.1.1.1
monitor capture mycap limit packets 100
monitor capture mycap start
monitor capture mycap file location flash:mycap.pcap buffer-size 10 
Monitor capture mycap stop

参考：
https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/117639-configure-wireshark-00.html