How to Get Syslog and Ethernet Packets from Grandstream Devices (using Wireshark)

If you are new to telephony networking and troubleshooting, this guide shows you step-by-step in setup and configuring the parameters to capture the packets locally in Grandstream devices.

Description

When we run into telephony issues (for eg. no audio, BLF keys are not working, unable to make calls, etc), in order to have the Support and Developer teams identify the root cause, we need to get logs from the phones.

There are 2 types of troubleshooting tools built-in Grandstream devices:

a. Ethernet Packet (available in most of the IP telephony devices)

b. Syslog (available in all models)

Syslog Utility tool

Recently, we have added a Syslog Utility - a Windows tool to collect Grandstream products syslog for troubleshooting purpose.

System Requirements

a. A laptop or PC

b. Networking switch

c. Phones

Getting Started: How to Capture Syslog

Step 1: Download Wireshark to your laptop or PC. Then, connect your phones to a laptop via a networking switch or make sure they are in the same LAN network.

Step 2: Log in to the phone's Web GUI > Maintenance > Syslog and configure the following

Syslog Protocol: UDP
Syslog Server: IP address of your laptop (which has the Wireshark app installed)
Syslog Level: DEBUG
Send SIP Log: Yes

Step 3: Click Save and Apply, followed by a Reboot to take effect immediately.

Step 4. Next, launch the Wireshark application, select the correct Interface and click Start

Step 5. Apply the filter 'syslog && ip.addr == <Phone's IP>' to make sure you capture the live Syslog messages of the phone

Step 6. Now, reproduce your issue

Step 7. Once it completes, click the Stop button and save as pcap format

**NOTE: You may configure Syslog Server: http://syslog1.grandstream.com/. Grandstream Support team would retrieve the files from internal portal. Make sure your phones are able to access the URL.