How to Get Syslog and Ethernet Packets from Grandstream Devi

Description

If you are new to telephony networking and troubleshooting, this guide shows you step-by-step setup and configuring the parameters to capture the packets locally in Grandstream devices.

When we run into telephony issues (for eg. no audio, BLF keys are not working, unable to make calls, etc), to have the Support and Developer teams identify the root cause, we need to get logs and system information from the devices:

a. System Information under Status > System Info > Download System Information (available in GRP26XX, WP8XX, and GXP21XX models only)

b. *Syslog at (Extra) Debug level under Maintenance

c. *Packet Capture under Maintenance

d. Core Dump under Status > System Info (for freezing issues only)

e. Internal Syslog Capture under Maintenance > Syslog. It can capture the supplicant logs to flash. (available in WP8XX only)

Replicating the issue

Ensure you enable the log before you make a test call or replicate the issue/ scenario. Stop or end the log capture when the call disconnects.

Figure 1 shows the time stamp between the start and stop of the log capture

Method 1: Wireshark Application

System Requirements

a. A laptop or PC

b. Networking switch (unmanaged)

c. Phones

How to

Step 1: Download Wireshark to your laptop or PC. Then, connect your phones to a laptop via a networking switch or make sure they are in the same LAN network.

Step 2: Log in to the phone’s Web GUI > Maintenance > Syslog and configure the following

Syslog Protocol: UDP
Syslog Server: IP address of your laptop (which has the Wireshark app installed)
Syslog Level: DEBUG
Send SIP Log: Yes

Step 3: Click Save and Apply, followed by a Reboot to take effect immediately.

Figure 2: Save and Apply the Syslog configuration, followed by a Reboot to take effect immediately.

If you do not have a switch, you can configure Mirrored PC Port Mode under Network > Advanced Setting. Then, connect your laptop directly to the phone’s PC port and capture the live Syslog messages. **Please note that the PC Port Mode option is not available in HT801 and HT802.

Figure 2a: Configuring PC port mode to Mirrored allows the traffic in the LAN port to go through the PC port. Thus, the packets can be captured by connecting a laptop/PC to the phone’s PC port.

Step 4. Next, launch the Wireshark application, select the correct Interface, and click Start

Figure 3: Select the correct interface and click Start to capture the traffic.

Step 5. Apply the filter ‘syslog && ip.addr == <Phone’s IP address>‘ to make sure you capture the live Syslog messages of the phone

Figure 4: Live traffic of Syslog messages

Step 6. Now, replicate your issue

Step 7. Once it completes, click the Stop button and save as pcap format

Figure 5: Click Stop to end the packet capture

Method 2: Grandstream Windows Syslog Utility tool

Recently, we have added a Syslog Utility – a Windows tool to collect Grandstream products (especially ATAs and Gateways) Syslog for troubleshooting purposes.

Method 3: Built-in Packet Capture tool

Step 1: Go to the phone’s Web GUI > Maintenance > Packet Capture

Capture Location: Internal Storage
With RTP Packets: Yes (for audio issues)
USB Filename: (if you select USB)

Step 2: Click Start

Step 3: Replicate the issue

Step 4: Click Stop and Download

Figure 5: Click Stop and Download after replicating the issue.

Method 4: GDMS Diagnostic tool

GDMS (Grandstream Device Management System) provides real-time monitoring and troubleshooting tools to help diagnose and resolve issues. Ping tools, Syslog, Capture Trace, Network Diagnostics, and System Status are available.

Step 1: Make sure your devices are listed in the supported models. Create a free account in gdms.cloud

Step 2. Connect your device with the internet. Navigate to Device Management > VoIP Device and Add Device with MAC address and Serial Number.

Step 3: Once it shows online (green dot) under the Device list, click the Diagnostic button and replicate the issue.

Step 4: Click Start on Syslog and Capture Trace

Method 5: Grandstream Public Syslog Server

Grandstream provides a public Syslog server that receives and stores system log messages from telephony devices. The users can point their devices to one of the syslog servers: syslog1.grandstream.com or syslog2.grandstream.com. The recommended timeframe is below 4 hours. Ensure that the users’ DNS points to 104.x.x.x, otherwise, the Grandstream Helpdesk engineers will not be able to retrieve or download the devices’ Syslog.