Embedded Wireshark on the 3850

monitor capture test interface g1/0/22 both

monitor capture test match any

monitor capture test file location flash:test.pcap

monitor capture test start

  sh monitor capture test

  sh monitor capture file flash:test.pcap

monitor capture test stop

  sh flash:

copy flash:test.pcap tftp://TFTP_SERVER_IP