Specifications

Configuring and Maintaining 400-Series IP Phones Viewing Diagnostic Information on a Phone
5
ShoreTel 14 Maintenance Guide 150
6. To return to the Diagnostics menu, do one of the following:
 On the IP420, press #.
 On the IP480, IP480g, and IP485g, press the Back soft key or press the selector button on the
navigation key pad.
7. To exit, do one of the following:
 On the IP420, scroll to the bottom of the Diagnostics menu to select the Exit option, and then
press the selector button on the navigation key pad.
 On the IP480, IP480g, and IP485g, press the Exit soft key or press the selector button on the
navigation key pad.
Capturing Packets for Phone Network Traffic
To diagnose problems on a phone, you might need to capture packets to see details about network
traffic to and from the phone. You can capture packets by using the phone interface, which is described
here, or you can initiate packet capture and view the results (using Wireshark or a similar network
protocol analysis tool) through the Diagnostics & Monitoring system. For details, see the ShoreTel
System Administration Guide.
On the 400-Series IP phones signaling packets are encrypted, and packet capture tools available on
the network cannot decrypt these packets. However, using the packet capture tool built into the phone,
both the encrypted and decrypted versions of the packets are displayed.
The packet capture can run for up to two hours or until the resulting .pcap file reaches 70 MB.
If you specify a location through the diagnosticServers configuration parameter, packet capture (.pcap)
files are uploaded to that location. (For details, see Table 23 on page 138.) If your installation does not
have a diagnosticServers path configured, by default the .pcap files from the capture operation are
uploaded to the following directory on the Headquarters server:
<Drive>:\inetpub\ftproot (or the default FTP location on the server)
However, unless this directory allows anonymous write access (which is not recommended), uploading
the capture file to this directory will fail.
Uploaded packet capture files are named as follows:
<Phone MAC address>_YYYYMMDD_HHMMSS.pcap
Where:
 YYYYMMDD is the date (four-digit year, two-digit month, and two-digit day) when the .pcap file was
created on the phone.
 HHMMSS is the time (two-digit hour, two-digit minute, and two-digit second) when the .pcap file was
created on the phone.
The results of a packet capture operation are also accessible through the phone interface until you
start a new packet capture operation.