--- title: "Using Wireshark to Log Interfaces" slug: "using-wireshark-to-log-interfaces" updated: 2024-12-19T06:32:06Z published: 2024-12-19T06:32:06Z canonical: "docs.telosalliance.com/using-wireshark-to-log-interfaces" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.telosalliance.com/llms.txt > Use this file to discover all available pages before exploring further. # Using Wireshark to Log Interfaces ## Scope Here is a procedure for setting up rolling packet captures on a Telos-commissioned Asterisk* SIP server. ***** ***Any information provided here regarding "Wireshark," "Asterisk" or "FreePBX" servers refers only to Telos-commissioned FreePBX (Asterisk) servers used with Telos Alliance telephony products. While these are third-party servers and software, we are able to provide limited pointers and advice (like this article) under normal support.*** > [!NOTE] > We are also happy to provide advanced, dedicated support and training on a VX and FreePBX* system through various paid [TelosCare Service Level Agreement options](https://success.telosalliance.com/teloscare), or a la carte via our Dedicated Remote and Onsite Support service. Please use the Contact Us link above for more information on these options. We can guide you through this entire process. ## Description Sometimes the causes of issues experienced with telephony gear are rather ambiguous. In a few of these cases, it becomes necessary to take packet captures of the Asterisk* server's network interfaces to prove where the problem is originating. These packet captures can be very large, so you'll need to configure Wireshark* to manage the data it's saving to your server to avoid filling up the disk and crashing the system. If your Asterisk* server was built by Announcement Technologies or commissioned by Telos, there should already be a version of Wireshark* installed. Below, we'll show you one way to do this. ## 1) Log in to Asterisk* and start XWindow - [Click here for instructions on logging in to Asterisk*](/v1/docs/logging-in-to-asterisk) - Once logged in to the command line, type **startx** and press Enter to load the xWindow UI. ## 2) Start Wireshark* From the menu bar in xWindow, go to **Applications -> Internet** and choose **Wireshark Network Analyzer.** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/2ca47885-9e7f-40cc-a172-67b55a7a6689.png) ## 3) Create a Capture Session When Wireshark* opens, click **Interface List** under the **Capture** section: ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/0bafeeab-a1ca-4999-ba75-7bfae7de7bd9.png) This will bring up a list of interfaces available to capture from. In this example, we'll tell it to look at **any** interface. Once we've done that, click **Options:** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/e83755aa-f65c-4b2c-8e62-8c3f1b6a5700.png) In the options window, click **Browse** under **Capture File(s)** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/68d4842d-bbf3-4ddf-b7f6-72c35eee8bb6.png) This is where you will tell Wireshark* where to save the packet captures. We'll usually create a new folder on the Desktop. Once you've created / selected the folder, name the session and click **OK.** (in this example we have created a folder on the desktop called "troubleshoot" and we have named the session "capture") ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/5a2d32b4-d877-41d0-bba8-6dabae9027e8.png) ## 4) Configure a Rolling Packet Capture Once you've created a folder and a name for the session and have clicked OK, you will be brought back to the capture options window. Under **Capture File(s)**: - Check **Use multiple files** - Check **Next file every** and set this to **500MB** - Check **Ring buffer with** and configure for **6 files** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/d7e0c8e1-aa8c-458a-920c-4536982688d7.png) > [!WARNING] > This will create a rolling packet capture that will start a new file every 500MB. The logger will keep up to 6 of these files before it starts rolling, or deleting the oldest file. This means that the captures will take up a max of 3GB on your disk. **BE SURE YOU HAVE ENOUGH SPACE ON YOUR DISK!** Then under **Display Options**, - Uncheck **Update list of packets in real time** - Uncheck **Hide Capture info dialog** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/3fddad7d-e9fd-4d8e-aa47-1ea5c7ad3ee6.png) Finally, Click **Start.** ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/09108935-c599-4273-a303-81bccaacd97b.png) This begins the capture process, which will continue running until you stop it. ![](https://cdn.document360.io/57e3cd80-d493-453c-9672-ad1b043dadc3/Images/Documentation/ba6da97b-bd82-465b-9309-59970e92f1db.png) ## 5) Gathering and Sending Results Once the issue has been reproduced, make note of the time it happened, the time it stopped happening, and the caller ID that was displayed or the number that was dialed when the issue occurred. This gives us a place to start looking. - Click the **Stop** button on the capture info dialog to stop the recording - Plug a USB thumb drive into the Asterisk* - Go to the Desktop in xWindow and drag the folder you created to the thumb drive - Send us the files for analysis along with the information described above. > [!NOTE] > These files can get rather large. If you are able to stop the packet capture immediately after recreating the problem, you can send us the latest file in the folder, which will be 500MB or smaller (according to our configuration here). Keep the remaining files handy just in case you are asked to provide them. ***** ***Any information provided here regarding "Wireshark," "Asterisk" or "FreePBX" servers refers only to Telos-commissioned FreePBX (Asterisk) servers used with Telos Alliance telephony products. While these are third-party servers and software, we are able to provide limited pointers and advice (like this article) under normal support.*** ## Let us know how we can help If you have further questions on this topic or have ideas about how we can improve this document, please [contact us](https://www.telosalliance.com/support-request).