How to Get Syslog and Ethernet Packets from Grandstream Devices (using Wireshark)


If you are new to telephony networking and troubleshooting, this guide shows you step-by-step in setup and configuring the parameters to capture the packets locally in Grandstream devices.

When we run into telephony issues (for eg. no audio, BLF keys are not working, unable to make calls, etc), in order to have the Support and Developer teams identify the root cause, we need to get logs and system information from the devices: 

a. System Information under Status > System Info > Download System Information (available in GRP26XX, WP8XX, and GXP21XX models only)

b. *Syslog at (Extra) Debug level under Maintenance

c. *Packet Capture under Maintenance

d. Core Dump under Status > System Info (for freezing issues only)

e. Internal Syslog Capture under Maintenance > Syslog. It is able to capture the supplicant logs to flash (available in WP810 only)

Grandstream Windows Syslog Utility tool

Recently, we have added a Syslog Utility – a Windows tool to collect Grandstream products (especially ATAs and Gateways) Syslog for troubleshooting purposes. 

Replicating the issue

Make sure that you enable the log before you make a test call or replicate the issue/ scenario. Stop or end the log capture when the call disconnects.

Figure 1: Timeframe between the start and stop of the log capture

Getting Started

System Requirements

a. A laptop or PC

b. Networking switch (unmanaged)

c. Phones

How to

Step 1: Download Wireshark to your laptop or PC. Then, connect your phones to a laptop via a networking switch or make sure they are in the same LAN network.

Figure 1: Download Wireshark

Step 2: Log in to the phone’s Web GUI > Maintenance > Syslog and configure the following 

  • Syslog Protocol: UDP
  • Syslog Server: IP address of your laptop (which has the Wireshark app installed)
  • Syslog Level: DEBUG
  • Send SIP Log: Yes

Step 3: Click Save and Apply, followed by a Reboot to take effect immediately.

Figure 2: Save and Apply the Syslog configuration, followed by a Reboot to take effect immediately.

If you do not have a switch, you can configure Mirrored PC Port Mode under Network > Advanced Setting. Then, connect your laptop directly to the phone’s PC port and capture the live Syslog messages.

Figure 2a: Configuring PC port mode to Mirrored allows the traffic in the LAN port to go through the PC port. Thus, the packets can be captured by connecting a laptop/PC to the phone’s PC port.

Step 4. Next, launch the Wireshark application, select the correct Interface and click Start

Figure 3: Select the correct interface and click Start to capture the traffic.

Step 5. Apply the filter ‘syslog && ip.addr == <Phone’s IP>’ to make sure you capture the live Syslog messages of the phone

Figure 4: Live traffic of Syslog messages

Step 6. Now, replicate your issue

Step 7. Once it completes, click the Stop button and save as pcap format

Figure 5: Click Stop to end the packet capture

**NOTE: You may configure Syslog Server: Grandstream Support team would retrieve the files from the internal portal. Make sure your phones are able to access the URL.

How to do Ethernet Packet Capture (for the phones)

Step 1: Go to phone’s Web GUI > Maintenance > Packet Capture

  • Capture Location: Internal Storage
  • With RTP Packets: Yes (for audio issues)
  • USB Filename: (if you are select USB)

Step 2: Click Start

Step 3: Replicate the issue

Step 4: Click Stop and Download

Figure 5: Click Stop and Download after replicating the issue.

The figures below show the Syslog and Packet Capture settings of different models.

IP Voice Telephony


Figure 6: GXP1625’s Web UI > Maintenance > Syslog & Packet Capture


Figure 7: GXP21XX’s Web UI > Maintenance > Syslog & Packet Capture


Figure 8: GRP260X’s Web UI > Maintenance > Syslog & Packet Capture


Figure 9: GRP2616’s Web UI > Maintenance > Syslog
Figure 10: GRP2616’s Web UI > Maintenance > Packet Capture


Click here to find out more on how to use internal Syslog capture in WP810.

Figure 11: WP810’s Web UI > Maintenance > Syslog & Packet Capture


Figure 12: DP750’s Web UI > Maintenance > Syslog & Packet Capture

Facility Management

GDS3710 & GSC361X’s Debug Log

Figure 13: GDS3710’s Web UI > Maintenance > Debug Log


Figure 14: GDS3705’s Web UI > Maintenance > Debug Log

Gateways and ATAs


Figure 15: GXW41XX’s Web UI > Maintenance > Syslog Setup

GXW42XX’s Syslog and Packet Capture

Figure 16: GXW42XX’s Web UI > Maintenance > Syslog
Figure 17: GXW42XX’s Web UI > Maintenance > Syslog


Figure 18: HT8XX’s Web UI > Maintenance > Syslog Setup

Video Conferencing

GVC32XX’s Syslog & Debug Log

Figure 19: GVC32XX’s Web UI > Troubleshooting > Syslog
Figure 20: GVC32XX’s Web UI > Troubleshooting > Debug

Grandstream GWN Access Point

Figure 21: GWN AP’s Web UI > System > Maintenance > Syslog

Grandstream IP PBX UCM

Grandstream UCM has built-in troubleshooting tools under the Maintenance tab. They are:

  2. Network Troubleshooting (VoIP or PBX related issues)
  3. Signaling Troubleshooting (analog trunk related issues)

Click here to read more on the UCM troubleshooting tools.

Leave a Comment