I recently swapped out a 3750 stack with a 3850 stack and I am not getting the same results when I am spanning a port.
I am mirroring the switchport connected to the inside of our ASA and sending the traffic to the switchport of my IDS. I have noticed that the captures do not seem to contain traffic destined TO the internet (transmitted from the source port). It contains TX traffic that is destined to the inside ASA interface but not traffic that should be flowing through the ASA.
I do see the return web traffic (RX).
My config is the same that I used on the 3750 so I am not sure what is going on.