Collecting Packet Capture from Cisco IP Phone

There are instances that you might be asked to collect packet capture from Cisco IP Phone or I would say that you may need the packet capture for your own troubleshooting and learning purposes.
For example : You are trying to register a Cisco IP Phone, SIP or SCCP but the phone is not registering to Cisco Unified Communications Manager (CUCM) and you have done all the basic troubleshooting but you are unable to figure out why the IP Phone is not registering. At this moment, packet capture would help you to understand the issue.

To do a packet capture there are multiple ways to do it. In this article we are going to use PC Ports for packet capture. In this method, you are sending the packets to switch, also you are getting copies of the packets to PC Port.  In your PC/Laptop, you can use Wireshark tool to capture the traffic.

Configuration on CUCM:

• When you look at the back side of an IP Phone, it will have a PC Port/Computer Port and Network Port. So one Ethernet cable should go out of the Network Port to the Switch and another Ethernet cable should go out of the PC Port/Computer Port to the PC/Laptop.
• Now login to Cisco Unified Communications Manager and locate the IP Phone for which you are doing a packet capture.  In the Phone page, you will find an option “Span to PC Port” under Product Specific Configuration Layout. By default Span to PC port will be disabled. You need to enable the configuration and click on Save, Apply Configuration and Reset the IP Phone.

  

  Use Wireshark to capture traffic:

  Now launch Wireshark application on your PC/Laptop and start capturing the traffic on the Ethernet where your PC/Laptop is connected to the IP Phone. To do so, follow the below steps:

  • Launch Wireshark Application
  • Click on Interface List
  • Check Mark > Interface where the network cable is connected
  • Click on Start
    

That’s all ! Your packet capture has started now. You can Stop the packet capture once you are done and Save it for analysis.

Hope this helps!

Avinash Karnani

I am working in an IT company and having 10+ years of experience into Cisco IP Telephony and Contact Center. I have worked on products like CUCM, CUC, UCCX, CME/CUE, IM&P, Voice Gateways, VG224, Gatekeepers, Attendant Console, Expressway, Mediasense, Asterisk, Microsoft Teams, Zoom etc. I am not an expert but i keep exploring whenever and wherever i can and share whatever i know. You can visit my LinkedIn profile by clicking on the icon below.

“Everyone you will ever meet knows something you don’t.” ― Bill Nye