[FAQ] How to Troubleshoot Polycom VoIP related Issues

[SteffenBaierUK]

To troubleshoot an issue or to look for solutions, before posting a new topic, the => FAQ <= and/or the Community Search Functionality should be consulted.

To troubleshoot Poly VoIP phone-related issues your Reseller or Polycom support may request a Wireshark Trace or Log of the issue that is being observed.

Question: What is Wireshark?

Wireshark is an industry-standard network protocol analyzer. It's Freeware and can be used on Windows or Linux PCs.

Details on how to use Wireshark can be found on their Wiki page => here <=

Question: How can I capture the Ethernet Traffic?

Usually, a mirrored/spanned Port would be used in a professional Network Environment.

A Hub can be used but does not provide the required PoE for the VoIP Phones.
 

Technical Support sometimes uses a Product like this => here <= as it provides PoE and does not require additional IT skills to setup a spanned/mirrored port.

Question: How would I capture the issue?

Usually, technical support does recommend rebooting the Phone in question, starting the Wireshark Trace, and then reproducing the issue, and stopping the Wireshark trace.

Question: Wireshark running on Windows seems to be missing some data/details?

Resolution: Please check => here <=

Question: How can I capture Wireshark network traffic from the phone remotely?

Resolution: Please check => here <=

Question: is there any additional Data that the reseller / Polycom Support should be supplied with?

All Files that are used to => provision <= the Phone, all => Log <= Files like <mac>-app.log and <mac>-boot.log matching the Phone in Question and a short write-up of the issue and how it was reproduced.

Since UC Software 4.0.0 or later simply provide a Backup using the Web Interface Utilities > Phone Backup & Restore > Phone Backup > Phone Backup

Question: Will a User be able to post Wireshark Traces & Logs here in the Community and expect support?

The Polycom Community is not a support community and all issues should be reported to the Polycom Reseller. Users can post logs and traces but should not expect Polycom to fix their issues based on these. For more details please check => here <=

If the Polycom reseller in question is not a qualified reseller, the Polycom Support team may suggest the original Polycom Partner that sold the Unit.

If the Partner / Reseller is unable to assist the Customer Polycom Support may be contacted but a PPI (Pay per Incident) Fee may occur.

Question: How can I look at the Phone Logs shown below?

Since UC Software 4.0.0 or later simply browse to the phone and then navigate to Diagnostics > View & Download Logs

Troubleshooting Tips:

The below example can utilize the Polycom Phone Logs.

Please familiarize yourself with the following post => here <= first in order to change the relevant Log Levels.

Settings > Logging > Global Settings > Global Log Level Limit > Log File Size (Kbytes) > 

Phone Model	Size
SoundStation IP	Leave as is
SoundPoint IP	Leave as is
VVX before 5.5.0	180
VVX from 5.5.0	1000
Poly Trio or CCX Phones	10240

Example simple Phone registration (SIP log Event 3):

Wireshark 

Phone Log

000022.048|sip  |3|03|NewRegisterState: 'Unknown' 'Unregistered' -> 'Registering' Expires 0 Overlap 0 for (0x94f9ceb0)
000022.048|sip  |3|03|CCallNoCall::NewCallState 'Unknown'->'Register' (0x94f9ceb0)
000022.050|sip  |3|03|RegClient:RegClient expire 66 overlap 0 
000022.052|sip  |*|03|Fast Boot Measurement Point: Ready for Call, uptime: 22.052 sec.
000022.052|sip  |3|03|SipStartFailOver 0
000022.052|app1 |4|03|[AppHybridC::procCfgParamChange] unexpected line index=(-1)
000022.106|sip  |3|03|UA Client Non-INVITE REGISTER trans state 'callingTrying'->'completed' by 401 resp 10 timeout(0x94ef8bf0)
000022.106|sip  |3|03|401 challenge received
000022.146|sip  |3|03|UA Client Non-INVITE REGISTER trans state 'callingTrying'->'completed' by 200 resp 10 timeout(0x94efa190)
000022.146|sip  |3|03|NewRegisterState: 'Register' 'Registering' -> 'Registered' Expires 66 Overlap 0 for (0x94f9ceb0)
000022.146|sip  |3|03|CUser::OnRegistered Entry for call 0x94f9ceb0 with expires 290 ticks Transport 'UDP' inval Method 2 RROFO 0
000022.152|sip  |3|03|SipOnEvRegistrarUpdate User 0, index 0, state 2, expire 145, working 1

Above example shows a simple registration of a Phone running UCS 4.1.0. The first attempt is rejected with a 401 due not sending the Username & Password.

The fourth exchange between the phone and the server sees the server offering a expire timer of 145 seconds (only an example).

Example simple Phone re-registration (SIP log Event 3):

Wireshark 

Phone Log

0213114050|sip  |3|03|NoCall::TimeOut500ms 'Registered' overlap was 120
0213114050|sip  |3|03|NewRegisterState: 'Register' 'Registered' -> 'Renewing' Expires 60 Overlap 60 for (0x94f9ceb0)
0213114050|sip  |3|03|RegClient:RegClient expire 60 overlap 60 
0213114050|sip  |3|03|NoCall::TimeOut500ms 'Renewing' m_nExpire 60 m_nOverlap 60
0213114050|sip  |3|03|UA Client Non-INVITE REGISTER trans state 'callingTrying'->'completed' by 401 resp 10 timeout(0x94ef7a30)
0213114050|sip  |3|03|401 challenge received
0213114050|sip  |3|03|UA Client Non-INVITE REGISTER trans state 'callingTrying'->'completed' by 200 resp 10 timeout(0x94efa250)
0213114050|sip  |3|03|NewRegisterState: 'Register' 'Renewing' -> 'Registered' Expires 60 Overlap 60 for (0x94f9ceb0)
0213114050|sip  |3|03|CUser::OnRegistered Entry for call 0x94f9ceb0 with expires 290 ticks Transport 'UDP' inval Method 2 RROFO 0
0213114050|sip  |3|03|SipOnEvRegistrarUpdate User 0, index 0, state 2, expire 145, working 1

Above example shows a simple re-registration of a Phone running UCS 4.1.0. The first attempt is again rejected with a 401 due not sending the Username & Password.

The Time period cycled in red shows the duration between the original registration and the re-registration. The Polycom phone will always attempt to do this before the proposed expiration time.

NOTE: The UCS /SIP Admin Guide matching the used Software version has more details on the expiry timer and the overlap.

Example Incoming Call (SIP log Event 3):

Wireshark 

Phone Log

0213114359|sip  |3|03|CStkDialog::CreateRouteSet: transport set to Target URI 'UDP'
0213114359|sip  |3|03|CStkDialog::SetAddressLocal localTag set to ''
0213114359|sip  |3|03|CStkDialog::SetAddressLocal new address added of 1
0213114359|sip  |3|03|CStateInviteServer::CStateInviteServer central conf user user '' found in contact user '3096' for cent conf URI ''. Set is focus
0213114359|sip  |3|03|CStkCall::NewCallState 'Unknown'->'Offering' (0x94f8b910)
0213114359|sip  |3|03|GetRemotePartyAddress from 'From'

Example Incoming Call answered:(SIP log Event 3):

Wireshark 

Phone Log

0213114433|sip  |3|03|CStkDialog::CreateRouteSet: transport set to Target URI 'UDP'
0213114433|sip  |3|03|CStkDialog::SetAddressLocal localTag set to ''
0213114433|sip  |3|03|CStkDialog::SetAddressLocal new address added of 1
0213114433|sip  |3|03|CStateInviteServer::CStateInviteServer central conf user user '' found in contact user '3096' for cent conf URI ''. Set is focus
0213114433|sip  |3|03|CStkCall::NewCallState 'Unknown'->'Offering' (0x94f8bd64)
0213114433|sip  |3|03|GetRemotePartyAddress from 'From'
0213114435|sip  |3|03|CStkCall::ReportCodec: call state 'Offering' exit with held 0 (0x94f8bd64)
0213114435|sip  |3|03|AddIceDescription: No SDP to add
0213114435|sip  |3|03|UA Server INVITE INVITE trans state 'proceeding'->'terminated' by 200 resp 4995 timeout(0x94efca10)
0213114435|sip  |3|03|CStateInviteServer::OnEvRequest ACK setting call state
0213114435|sip  |3|03|CStkCall::NewCallState 'Offering'->'Connected' (0x94f8bd64)

[SteffenBaierUK]

Troubleshooting 2

NOTE: In order to set the lowest Level of logging this Parameter may be used:

log.render.level="0" log.level.change.sip="0"

 

Checking the offered Codec in an Invite (SIP Log Debug 0):

Wireshark

Phone Log

0213120926|sip  |0|03|    INVITE sip:3095@10.253.200.135 SIP/2.0
0213120926|sip  |0|03|    Via: SIP/2.0/UDP 10.252.75.203:5060;branch=z9hG4bK7caf0395
0213120926|sip  |0|03|    Max-Forwards: 70
0213120926|sip  |0|03|    From: "Ekiga Asterisk 119 PC" <sip:3096@10.252.75.203>;tag=as2904bf49
0213120926|sip  |0|03|    To: <sip:3095@10.253.200.135>
0213120926|sip  |0|03|    Contact: <sip:3096@10.252.75.203:5060>
0213120926|sip  |0|03|    Call-ID: 4fc7d03e0b9e0211634a8eae6216fc03@10.252.75.203:5060
0213120926|sip  |0|03|    CSeq: 102 INVITE
0213120926|sip  |0|03|    User-Agent: Steffens Asterisk 1.8.4.3
0213120926|sip  |0|03|    Date: Wed, 13 Feb 2013 10:31:39 GMT
0213120926|sip  |0|03|    Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
0213120926|sip  |0|03|    Supported: replaces, timer
0213120926|sip  |0|03|    Alert-Info: 
0213120926|sip  |0|03|    Content-Type: application/sdp
0213120926|sip  |0|03|    Content-Length: 284
0213120926|sip  |0|03|    
0213120926|sip  |0|03|    v=0
0213120926|sip  |0|03|    o=root 656226955 656226955 IN IP4 10.252.75.203
0213120926|sip  |0|03|    s=Asterisk PBX 1.8.4.3
0213120926|sip  |0|03|    c=IN IP4 10.252.75.203
0213120926|sip  |0|03|    t=0 0
0213120926|sip  |0|03|    m=audio 19018 RTP/AVP 0 8 9 101
0213120926|sip  |0|03|    a=rtpmap:0 PCMU/8000
0213120926|sip  |0|03|    a=rtpmap:8 PCMA/8000
0213120926|sip  |0|03|    a=rtpmap:9 G722/8000
0213120926|sip  |0|03|    a=rtpmap:101 telephone-event/8000
0213120926|sip  |0|03|    a=fmtp:101 0-16
0213120926|sip  |0|03|    a=ptime:20
0213120926|sip  |0|03|    a=sendrecv

Phone returns 100 trying (SIP Log Debug 0):

Wireshark

Phone Log

0213120926|sip  |0|03|    SIP/2.0 100 Trying
0213120926|sip  |0|03|    Via: SIP/2.0/UDP 10.252.75.203:5060;branch=z9hG4bK7caf0395
0213120926|sip  |0|03|    From: "Ekiga Asterisk 119 PC" <sip:3096@10.252.75.203>;tag=as2904bf49
0213120926|sip  |0|03|    To: "3095" <sip:3095@10.253.200.135>;tag=AB9A23F5-17E195D8
0213120926|sip  |0|03|    CSeq: 102 INVITE
0213120926|sip  |0|03|    Call-ID: 4fc7d03e0b9e0211634a8eae6216fc03@10.252.75.203:5060
0213120926|sip  |0|03|    Contact: <sip:3095@10.253.200.135>
0213120926|sip  |0|03|    User-Agent: PolycomSoundPointIP-SPIP_650-UA/4.1.0.83139
0213120926|sip  |0|03|    Accept-Language: en
0213120926|sip  |0|03|    Content-Length: 0

Phone starts to Ring 180 Ringing  (SIP Log Debug 0):

Wireshark

Phone Log

0213120926|sip  |0|03|    SIP/2.0 180 Ringing
0213120926|sip  |0|03|    Via: SIP/2.0/UDP 10.252.75.203:5060;branch=z9hG4bK7caf0395
0213120926|sip  |0|03|    From: "Ekiga Asterisk 119 PC" <sip:3096@10.252.75.203>;tag=as2904bf49
0213120926|sip  |0|03|    To: "3095" <sip:3095@10.253.200.135>;tag=AB9A23F5-17E195D8
0213120926|sip  |0|03|    CSeq: 102 INVITE
0213120926|sip  |0|03|    Call-ID: 4fc7d03e0b9e0211634a8eae6216fc03@10.252.75.203:5060
0213120926|sip  |0|03|    Contact: <sip:3095@10.253.200.135>
0213120926|sip  |0|03|    User-Agent: PolycomSoundPointIP-SPIP_650-UA/4.1.0.83139
0213120926|sip  |0|03|    Allow-Events: conference,talk,hold
0213120926|sip  |0|03|    Accept-Language: en
0213120926|sip  |0|03|    Content-Length: 0

200 OK when answered  (SIP Log Debug 0):

Wireshark

Phone Log

0213121140|sip  |0|03|    SIP/2.0 200 OK
0213121140|sip  |0|03|    Via: SIP/2.0/UDP 10.252.75.203:5060;branch=z9hG4bK3fd41c06
0213121140|sip  |0|03|    From: "Ekiga Asterisk 119 PC" <sip:3096@10.252.75.203>;tag=as28ea0377
0213121140|sip  |0|03|    To: "3095" <sip:3095@10.253.200.135>;tag=D7D46CF2-D615286D
0213121140|sip  |0|03|    CSeq: 102 INVITE
0213121140|sip  |0|03|    Call-ID: 788e88804e84bbd656b45cda5d0be401@10.252.75.203:5060
0213121140|sip  |0|03|    Contact: <sip:3095@10.253.200.135>
0213121140|sip  |0|03|    Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
0213121140|sip  |0|03|    Supported: 100rel,replaces
0213121140|sip  |0|03|    User-Agent: PolycomSoundPointIP-SPIP_650-UA/4.1.0.83139
0213121140|sip  |0|03|    Allow-Events: conference,talk,hold
0213121140|sip  |0|03|    Accept-Language: en
0213121140|sip  |0|03|    Content-Type: application/sdp
0213121140|sip  |0|03|    Content-Length: 215
0213121140|sip  |0|03|    
0213121140|sip  |0|03|    v=0
0213121140|sip  |0|03|    o=- 1360753900 1360753900 IN IP4 10.253.200.135
0213121140|sip  |0|03|    s=Polycom IP Phone
0213121140|sip  |0|03|    c=IN IP4 10.253.200.135
0213121140|sip  |0|03|    t=0 0
0213121140|sip  |0|03|    a=sendrecv
0213121140|sip  |0|03|    m=audio 2254 RTP/AVP 0 101
0213121140|sip  |0|03|    a=sendrecv
0213121140|sip  |0|03|    a=rtpmap:0 PCMU/8000
0213121140|sip  |0|03|    a=rtpmap:101 telephone-event/8000

In the above exchange a Codec of G711 uLaw was negotiated and DTMF inbound was used with a Payload type of 101.

[SteffenBaierUK]

Troubleshooting 3

NOTE: In order to set the lowest Level of logging this Parameter may be used:

log.render.level="0" log.level.change.sip="0"

 

Placing a call on hold (transfer or conference):

Wireshark

Phone Log

INVITE sip:3071@10.252.122.122:5060 SIP/2.0
Via: SIP/2.0/UDP 10.253.200.40;branch=z9hG4bK1c75e7347E64C107
From: "3078" <sip:3078@10.253.200.40>;tag=DFAC970A-D89A70B5
To: "3071" <sip:3071@10.252.122.122>;tag=as2259e875
CSeq: 1 INVITE
Call-ID: 2d7b457f46174cf818adfd9c34f278e4@10.252.122.122:5060
Contact: <sip:3078@10.253.200.40>
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
User-Agent: PolycomVVX-VVX_600-UA/5.0.0.6874
Accept-Language: en
Supported: 100rel,replaces
Allow-Events: conference,talk,hold
Max-Forwards: 70
Content-Type: application/sdp
Content-Length: 307

v=0
o=- 2592 2593 IN IP4 10.253.200.40
s=Polycom IP Phone
c=IN IP4 10.253.200.40
b=AS:384
t=0 0
a=sendonly
m=audio 2230 RTP/AVP 0 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=sendonly
m=video 2232 RTP/AVP 99
a=rtpmap:99 H264/90000
a=fmtp:99 profile-level-id=42800d
a=sendonly
listener: Received packet from %s:%d
listener: Received packet from %s:%d

In above scenario the phone received a call starting with the initial INVITE (1) from the SIP Server.

The call was then placed on hold to initiate either a conference or transfer via the new INVITE (2) to the SIP server.

This INVITE indicates to the far end via the session attribute SENDONLY that the call is placed on hold.

The methods used for hold can be changed depending on your Phones Software Version.

Parameter	Options	Standard
voIpProt.SIP.useRFC2543hold	0 or 1	0

• If set to 0, use SDP media direction parameters (such as a=sendonly) per RFC 3264 when initiating a call.
  
  Otherwise use the obsolete c=0.0.0.0 RFC2543 technique.
  
  In either case, the phone processes incoming hold signaling in either format.

Note: voIpProt.SIP.useRFC2543hold is effective only when the call is initiated.

Parameter	Options	Standard
voIpProt.SIP.useSendonlyHold	0 or 1	1

• If set to 1, the phone will send a reinvite with a stream mode parameter of “sendonly” when a call is put on hold. This is the same as the previous behavior.
  
  If set to 0, the phone will send a reinvite with a stream mode parameter of “inactive” when a call is put on hold.

NOTE: The phone will ignore the value of this parameter if set to 1 when the parameter voIpProt.SIP.useRFC2543hold is also set to 1 (default is 0).

Placing the Call on HOLD or starting a Conference will show the following in the logs:

000718.176|sip  |2|00|SipCallHold ffd810,11bf8c8

Taking the call off HOLD:

000748.284|sip  |2|00|SipCallResume hsCall 0xffd810 huCall 0x11bf8c8 Dialog 0x0 Template
000748.284|sip  |2|00|CStkCall::Resume This 0xffd810 Dialog 0x0

Wireshark:

Phonelog:

INVITE sip:3071@10.252.122.122:5060 SIP/2.0
Via: SIP/2.0/UDP 10.253.200.40;branch=z9hG4bK5c682349BD7C719
From: "3078" <sip:3078@10.252.122.122>;tag=1C528377-DEEF431C
To: <sip:3071@10.252.122.122;user=phone>;tag=as7d6f34be
CSeq: 6 INVITE
Call-ID: dd1f5d8b-f189ba30-7856c615@10.253.200.40
Contact: <sip:3078@10.253.200.40>
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
User-Agent: PolycomVVX-VVX_600-UA/4.1.5.3071
Accept-Language: en
Supported: 100rel,replaces
Allow-Events: conference,talk,hold
Authorization: Digest username="3078", realm="asterisk", nonce="332e76f6", uri="sip:3071@10.252.122.122;user=phone"
Max-Forwards: 70
Content-Type: application/sdp
Content-Length: 494

v=0
o=- 392 396 IN IP4 10.253.200.40
s=Polycom IP Phone
c=IN IP4 10.253.200.40
b=AS:384
t=0 0
a=sendrecv
m=audio 2230 RTP/AVP 9 102 0 8 18 127
a=rtpmap:9 G722/8000
a=rtpmap:102 G7221/16000
a=fmtp:102 bitrate=32000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:127 telephone-event/8000
m=video 2232 RTP/AVP 109 34
a=rtpmap:109 H264/90000
a=fmtp:109 profile-level-id=42800d
a=rtpmap:34 H263/90000
a=fmtp:34 CIF=1;QCIF=1;SQCIF=1

In above follow up scenario the phone placed a call on hold starting with the initial INVITE (1) to the SIP Server.

The call was then retrieved from hold via the new INVITE (2) to the SIP server.

This second INVITE indicates to the far end via the session attribute SENDRECV that the call is no longer placed on hold.

[SteffenBaierUK]

Troubleshooting 4

NOTE: In order to set the lowest Level of logging this Parameter may be used:

log.render.level="0" log.level.change.sip="0"

 

Checking Message Waiting NOTIFY message MWI On (SIP Log level 0):

Wireshark

Phone Log

1202125859|sip  |0|00|    NOTIFY sip:3001@10.252.122.95 SIP/2.0
1202125859|sip  |0|00|    Via: SIP/2.0/UDP 10.252.122.122:5060;branch=z9hG4bK0e024cb1;rport
1202125859|sip  |0|00|    Max-Forwards: 70
1202125859|sip  |0|00|    From: "asterisk" <sip:asterisk@10.252.122.122>;tag=as1532e6dc
1202125859|sip  |0|00|    To: <sip:3001@10.252.122.95>
1202125859|sip  |0|00|    Contact: <sip:asterisk@10.252.122.122:5060>
1202125859|sip  |0|00|    Call-ID: 21140adf7f59b24f5c1b5c1061ea5011@10.252.122.122:5060
1202125859|sip  |0|00|    CSeq: 102 NOTIFY
1202125859|sip  |0|00|    User-Agent: Steffens Asterisk 1.8.13.1
1202125859|sip  |0|00|    Event: message-summary
1202125859|sip  |0|00|    Content-Type: application/simple-message-summary
1202125859|sip  |0|00|    Content-Length: 94
1202125859|sip  |0|00|
1202125859|sip  |0|00|    Messages-Waiting: yes
1202125859|sip  |0|00|    Message-Account: sip:mailbox@10.252.122.122
1202125859|sip  |0|00|    Voice-Message: 1/0 (0/0)

Checking Message Waiting NOTIFY message MWI Off (SIP Log level 0):

Wireshark

Phone Log

1202125926|sip |0|00| NOTIFY sip:3001@10.252.122.95 SIP/2.0
1202125926|sip |0|00| Via: SIP/2.0/UDP 10.252.122.122:5060;branch=z9hG4bK2340b720;rport
1202125926|sip |0|00| Max-Forwards: 70
1202125926|sip |0|00| From: "asterisk" <sip:asterisk@10.252.122.122>;tag=as1d2cec15
1202125926|sip |0|00| To: <sip:3001@10.252.122.95>
1202125926|sip |0|00| Contact: <sip:asterisk@10.252.122.122:5060>
1202125926|sip |0|00| Call-ID: 5588c8483212c7ce028fa57216b225db@10.252.122.122:5060
1202125926|sip |0|00| CSeq: 102 NOTIFY
1202125926|sip |0|00| User-Agent: Steffens Asterisk 1.8.13.1
1202125926|sip |0|00| Event: message-summary
1202125926|sip |0|00| Content-Type: application/simple-message-summary
1202125926|sip |0|00| Content-Length: 93
1202125926|sip |0|00|
1202125926|sip |0|00| Messages-Waiting: no
1202125926|sip |0|00| Message-Account: sip:mailbox@10.252.122.122
1202125926|sip |0|00| Voice-Message: 0/0 (0/0)

[SteffenBaierUK]

Hello all,

Poly Rove devices utilize a different format when collecting Logs to troubleshoot SIP related issues.

• Browse to Service Providers > Common Settings > SIP > X_SipDebugOption and set this to Log all Messages
  
  
  

  The above only sends the Data to a defined >syslog< server. The Syslog server can be added by navigating to System Management > Device Admin > Syslog
  (Poly support should advise the level or Event Parameters required when opening a case)
  
  The above may be used in conjunction with a >wireshark< trace when using a routable IP or FQDN address
  
  

• Another way is to navigate to Platform > SIP Log
  
  

[SteffenBaierUK]

Hello all,

Poly Edge B devices utilize a different format when collecting Logs to troubleshoot SIP-related issues.

Via the Web Interface Navigate to Voice Services > SPx > Debug Options > An change the X_SIPDebugOptions to log all messages

Ensure under System Settings > Device Admin > Syslog a server is set

the Server Address can either be the real address of a Syslog server or as an example a routable IP address like 8.8.8.8

The above only send the Data to a defined >syslog< server.

The built-in Wireshark Capture tool can be used to gather the logs as shown >here<