Which http address is calle upon when we press the Hlog button on the Cisco Phone to logged in/out from a Hunt Group. I have tried with Cisco 7841 with Wireshark but no luck. Which AXL or http is called need to know.
If memory serves, when the publisher is down you aren't able to log into or out of a line group / hunt. My guess would be that the hlog button communicates with the publisher.
If not the Publisher servers IP address, then they key press will be passed to the subscriber that the phone is registered with in the first instance who will then update the publisher. So your wire shark capture should certainly show conversation between the telephone end points IP address and either the Publisher or the Subscriber. Are you seeing any traffic at all on the mirrored network port?