For troubleshooting purposes one may need to gather a packet (sniffer) capture from an IP Phone. There are many ways this can be accomplished. This article describes how to collect the capture using the IP Phone's built in PC ports. It can be enabled to copy all traffic entering into the SWITCH port, and send it to the PC port. From there, the data can be captured using a packet capture utility.
These instructions are relevant for Cisco IP Phone Models, 7941, 7942, 7961, 7962, 7965, 7970, 7975, 99xx, 89xx, and 699xx.
For models 7940 and 7960, skip Step 2 since "Span to PC Port setting" is not required.
1. Connect the Cisco IP Phone
There should be a PC connected to the back of the IP phone in the PC port, and the phone connected to the Switch.
2. Enable the Span to PC port feature.
From the IP phone configuration page, scroll down to the Protocol Specific Configuration section, and enable the "Span to PC Port" configuration option. This will trigger a change to the phone's TFTP configuration file. Save and reset the phone so it can retrieve the new configuration file.
7940 and 7960 Cisco IP Phones do not support the span to PC port feature, all data is automatically sent to the PC port.
3. Capture the packets with wireshark.
3a. Starting the capture
Open Wireshark and click on the first NIC to the left.
This will open the capture interfaces dialog, were you can select the NIC connected to the back of the IP phone we will capture. Click on start to initiate the capture
3b. Reproduce the issue to be captured
Traffic should start to scroll down on the window. Depending on the current PC activity it could be a lot of traffic. To filter down use the eth.addr filter with the MAC Address of the IP phone. The resulting traffic should show only traffic comming to and from the IP phone.
I have a Cisco 8961 running sip8961.9-4-2SR4-1 firmware. On my config file I have Bluetooth and the USB ports enabled. When I plug in a USB device it says that the port is disabled by the administrator. When I try to find Bluetooth in the setting I c...
I have a Cisco 2911 router with the UC license running IOS c2900-universalk9-mz.SPA.157-3.M.bin abd a SM-ES2-24-P switch installed into it with 5 IP phones connected to the switch. Please note that this is a Service Module switch and not an external switc...
We have registered Webex Team (Windows )with CUCM.My Queries are following:1.Shall CUCM corporate directory work on Webex Teams,just like it works on Cisco Jabber.2.How can we retrieve voicemail on Webex Teams ,just like we do on Cisco Jabber.
Hi, It's nice that Expressway supports certification renewal with ACME / Let's encrypt. Sadly even the current 12.5.5 is still using ACMEv1. This is an old version and is being replaced with ACMEv2 since 2018.I've just had an issue where ACMEv1 didn'...
Hello, I'm running UCM 188.8.131.5200-16 and a subscriber node has stopped to authenticate users. LDAP authentication is configured but even local users fails authentication. There are no authentication attempts in UDS logs with enabled debug leve...